Netscape NETSCAPE MANAGEMENT SYSTEM 6.1 - AGENT GUIDE User manual

Agent’s Guide
Netscape Certificate Management System
Version6.1
February 2003

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs
offered by Netscape (referred to herein as "Software") and related documentation. Use of the Software and related
documentation is governed by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation
works is prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to
time without notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL
NETSCAPE BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND
ARISING FROM ANY ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR
INTERRUPTION OF BUSINESS, PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002-2003 Netscape
Communications Corporation. All rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States
and other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape
Communications Corporation, which may be registered in some countries. Other product and brand names are the exclusive
property of their respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in
full compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or
documentation to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
About This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Who Should Read This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
What You Should Know . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
What’s in This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Conventions Used in This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Chapter 1 Agent Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Overview of Certificate Management System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Agent Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Certificate Manager Agent Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Registration Manager Agent Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Data Recovery Manager Agent Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Online Certificate Status Manager Agent Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Forms for Performing Agent Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Accessing Agent Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Administrator/Agent Certificate Enrollment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Agent Services Entry Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Services Summary Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Chapter 2 Working with Certificate Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
About Certificate Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
How Certificate Profiles Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Enabling and Disabling Certificate Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Getting Certificate Profile Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
End User Certificate Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Policy Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

4 Netscape Certificate Management System Agent’s Guide • February 2003
To Approve a Certificate Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
To Disapprove a Certificate Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Chapter 3 Handling Certificate Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Managing Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Listing Certificate Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Selecting a Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Approving Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Adjusting, Verifying, and Approving a Certificate Profile Request . . . . . . . . . . . . . . . . . . . . . . . . . 43
Assigning a Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Adjusting, Verifying, and Approving a Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Other Options for Handling Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Sending an Issued Certificate to the Requester . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Chapter 4 Finding and Revoking Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Basic Certificate Listing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Advanced Certificate Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Examining Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Revoking Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Searching for Certificates to Revoke . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Revoking One or More Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Revoking One Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Revoking Multiple Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Confirming a Revocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Managing the Certificate Revocation List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Viewing or Examining CRLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Updating the CRL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Chapter 5 Publishing to a Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Working with a Directory Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Automatic Directory Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Manual Directory Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Updating the Directory with Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Chapter 6 Recovering Encrypted Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Finding and Recovering Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Finding Archived Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Selecting a Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Recovering Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Remote Recovery Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Viewing Key Service Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Listing Key Service Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

5
Selecting a Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Chapter 7 Managing OCSP Service Related Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Listing CAs Identified by Online Certificate Status Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Identifying a CA to Online Certificate Status Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Adding a CRL to Online Certificate Status Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Checking the Revocation Status of a Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

6 Netscape Certificate Management System Agent’s Guide •February 2003

7
About This Guide
This guide describes the Agent Services interface that Netscape Certificate
Management System (CMS) agent uses to administer a subsystem’s certificates and
keys.
This preface contains the following sections:
•Who Should Read This Guide
•What You Should Know
•What’s in This Guide
•Conventions Used in This Guide
•Documentation
Who Should Read This Guide
This guide is intended for Certificate Management System agents—that is,
privileged users designated by the Certificate Management System administrator
to manage requests from end entities for certificate-related services. Each installed
CMS manager (Certificate Manager, Registration Manager, Data Recovery
Manager, and Online Certificate Status Manager) can have one or more agents.
What You Should Know
Before reading this guide, you should be familiar with the basic concepts of
public-key cryptography and the Secure Sockets Layer (SSL) protocol. These
include the following topics:

What’s in This Guide
8 Netscape Certificate Management System Agent’s Guide •February 2003
•Encryption and decryption
•Public keys, private keys, and symmetric keys
•Digital signatures
•The role of digital certificates in a public-key infrastructure (PKI)
•Certificate hierarchies
•SSL cipher suites
•The purpose of and major steps in the SSL handshake
What’s in This Guide
This guide describes the duties of the agents for the various CMS subsystems and
explains how to accomplish each task.
Chapter 1, “Agent Services”Provides an overview of the product and
identifies the different kinds of users, including
agents. The chapter also summarizes the tasks
of each subsystem agent and lists the HTML
forms you use to perform agent tasks. Finally,
the chapter explains how to access the Agent
Services pages and forms.
Chapter 2, “Working with
Certificate Profiles”Provides an overview of the profiles feature and details how an agent enables and disables
profiles.
Chapter 3, “Handling
Certificate Requests”As a Certificate Manager or Registration Manager agent, you are responsible for
handling requests for certificates that are made
by end entities (end users, server
administrators, or other CMS subsystems)
using manual enrollment. This chapter
describes the general procedure for handling
requests and explains how to handle different
aspects of certificate request management.

Conventions Used in This Guide
About This Guide 9
Conventions Used in This Guide
The following conventions are used in this guide:
Chapter 4, “Finding and
Revoking Certificates”Explains how, as a Certificate Manager agent, you can use the Agent Services page to find
and examine a specific certificate issued by
Certificate Management System, or retrieve a
list of certificates that match specified criteria.
This chapter also explains how to revoke
certificates, and manage the certificate
revocation list.
Chapter 5, “Publishing to a
Directory”Describes how a Certificate Manager agent can update the LDAP directory with the current
status of certificates.
Chapter 6, “Recovering
Encrypted Data”Describes how to process key recovery requests, and how to recover stored encrypted
data when the encryption key has been lost.
This service is only available when the Data
Recovery Manager is installed.
Chapter 7, “Managing OCSP
Service Related Tasks”Describes how to handle tasks related to the CMS OCSP responder, Online Certificate
Status Manager. This service is only available
when the Online Certificate Status Manager
subsystem is installed.
Monospaced font This typeface is used for any text that appears on the
computer screen or text that you should type. It’s also
used for filenames, functions, and examples.
Example: Server Root is the directory where the CMS
binaries are kept.
Italic Italic type is used for emphasis, book titles, and
glossary terms.
Example: This control depends on the access
permissions the super administrator has set up for you.

Conventions Used in This Guide
10 Netscape Certificate Management System Agent’s Guide •February 2003
Notes and Cautions:
Boldface Boldface type is used for various UI components such
as captions and field names, and the terminology
explained in the glossary.
Example:
Rotationfrequency. From the drop-down list, select the
interval at which the server should rotate the active
error log file. The available choices are Hourly, Daily,
Weekly, Monthly, and Yearly. The default selection is
Monthly.
Monospaced [ ] Square brackets enclose commands that are optional.
Example:
PrettyPrintCert <input_file> [<output_file>]
<input_file> specifies the path to the file that contains
the base-64 encoded certificate.
<output_file> specifies the path to the file to write the
certificate. This argument is optional; if you don’t
specify an output file, the certificate information is
written to the standard output.
Monospaced <> Angle brackets enclose variables or placeholders. When
following examples, replace the angle brackets and
their text with text that applies to your situation. For
example, when path names appear in angle brackets,
substitute the path names used on your computer.
Example: Using Netscape Communicator 4.7 or later,
enter the URL for the Netscape Administration Server:
http://<hostname>:<port_number>
/A slash is used to separate directories in a path.
Example: Except for the Security Module Database
Tool, you can find all the other command-line utilities
at this location: <server_root>/bin/cert/tools
NOTE A note alerts you to information that may be of interest to you.