Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Manual

Red Hat Certificate
System 8.0
Admin Guide
Publication date: July 22, 2009, updated on March 25, 2010

Admin Guide
Red Hat Certificate System 8.0 Admin Guide
Copyright © 2009 Red Hat, Inc.
Copyright © 2009 Red Hat, Inc.
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons
Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available
at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this
document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert,
Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity
Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
All other trademarks are the property of their respective owners.
1801 Varsity Drive
Raleigh, NC 27606-2072 USA
Phone: [phone]
Phone: [phone]
Fax: [phone]
PO Box 13588
Research Triangle Park, NC 27709 USA
This manual covers all aspects of installing, configuring, and managing Certificate System
subsystems. It also covers management tasks such as adding users; requesting, renewing, and
revoking certificates; publishing CRLs; and managing smart cards. This guide is intended for
Certificate System administrators.

iii
About This Guide xv
1. Recommended Concepts ............................................................................................... xv
2. What Is in This Guide .................................................................................................... xv
3. Supported Platforms, Hardware, and Programs .............................................................. xvi
3.1. Supported Platforms ........................................................................................... xvi
3.2. Supported Web Browsers ................................................................................... xvi
3.3. Supported Smart Cards ..................................................................................... xvii
3.4. Supported HSM ................................................................................................ xvii
3.5. Supported Charactersets ................................................................................... xvii
4. Examples and Formatting ............................................................................................ xviii
4.1. Formatting for Examples and Commands ........................................................... xviii
4.2. Tool Locations .................................................................................................. xviii
4.3. Guide Formatting .............................................................................................. xviii
5. Additional Reading ........................................................................................................ xix
6. Giving Feedback ........................................................................................................... xx
7. Document History ......................................................................................................... xxi
1. Overview of Red Hat Certificate System Subsystems 1
1.1. How Certificates Are Used ............................................................................................ 1
1.1.1. Uses for Certificates .......................................................................................... 1
1.1.2. Types of Certificates .......................................................................................... 3
1.2. A Review of Certificate System Subsystems .................................................................. 5
1.2.1. Certificate Manager ........................................................................................... 6
1.2.2. Registration Authority ......................................................................................... 7
1.2.3. Data Recovery Manager .................................................................................... 7
1.2.4. Online Certificate Status Manager ...................................................................... 7
1.2.5. Token Processing System .................................................................................. 7
1.2.6. Token Key Service ............................................................................................ 8
1.2.7. Enterprise Security Client ................................................................................... 8
1.3. A Look at Managing Certificates ................................................................................... 8
1.4. A Look at the Token Management System ................................................................... 11
1.5. Red Hat Certificate System Services ........................................................................... 13
1.5.1. Interfaces for Administrators ............................................................................. 13
1.5.2. Agent Interfaces .............................................................................................. 16
1.5.3. End User Pages .............................................................................................. 17
1.5.4. Enterprise Security Client ................................................................................. 18
I. Setting up Certificate Services 21
2. Making Rules for Issuing Certificates 23
2.1. About Certificate Profiles .................................................................................... 23
2.1.1. The Profile .............................................................................................. 23
2.1.2. Certificate Extensions: Defaults and Constraints ........................................ 25
2.1.3. Inputs and Outputs .................................................................................. 26
2.2. Setting up Certificate Profiles .............................................................................. 26
2.2.1. Creating Certificate Profiles through the CA Console .................................. 27
2.2.2. Editing Certificate Profiles in the Console .................................................. 35
2.2.3. Creating and Editing Certificate Profiles through the Command Line ............ 36
2.2.4. Defining Key Defaults in Profiles ............................................................... 39
2.2.5. Configuring Cross-Pair Profiles ................................................................. 39
2.2.6. List of Certificate Profiles ......................................................................... 41
2.3. Configuring Custom Enrollment Profiles to Use with an RA ................................... 48

Admin Guide
iv
2.3.1. Default RA Profiles .................................................................................. 48
2.3.2. Creating RA Enrollment Forms ................................................................. 48
2.3.3. Configuring the Request Queues .............................................................. 50
2.4. Managing Smart Card CA Profiles ....................................................................... 53
2.4.1. Editing Enrollment Profiles for the TPS ..................................................... 54
2.4.2. Creating Custom TPS Profiles .................................................................. 54
2.4.3. Using the Windows Smart Card Logon Profile ........................................... 55
2.5. Setting the Signing Algorithms for Certificates ...................................................... 55
2.5.1. Setting the CA's Default Signing Algorithm ................................................ 55
2.5.2. Setting the Signing Algorithm Default in a Profile ....................................... 56
2.6. Managing CA-Related Profiles ............................................................................ 58
2.6.1. Setting Restrictions on CA Certificates ..................................................... 58
2.6.2. Changing the Restrictions for CAs on Issuing Certificates ........................... 59
2.7. Managing Subject Names and Subject Alternative Names ..................................... 61
2.7.1. Inserting LDAP Directory Attribute Values and Other Information into the
Subject Alt Name .............................................................................................. 61
2.7.2. Changing DN Attributes in CA-Issued Certificates ...................................... 64
2.7.3. Customizing the Subject DN in a Certificate Request Issued by an RA ......... 67
3. Setting up Key Archival and Recovery 69
3.1. About Key Archival and Recovery ....................................................................... 69
3.2. Setting up Key Archival ...................................................................................... 70
3.3. Setting up Agent-Approved Key Recovery Schemes ............................................. 72
3.4. Testing the Key Archival and Recovery Setup ...................................................... 73
4. Requesting, Enrolling, and Managing Certificates 75
4.1. About Enrolling and Renewing Certificates ........................................................... 75
4.2. Configuring Internet Explorer to Enroll Certificates ................................................ 75
4.3. Requesting and Receiving Certificates ................................................................. 77
4.3.1. Requesting and Receiving a User or Agent Certificate through the End-
Entities Page .................................................................................................... 77
4.3.2. Requesting Certificates Using certutil ........................................................ 81
4.4. Enrolling a Certificate on a Cisco Router ............................................................. 85
4.4.1. Configuring a Router for SCEP Enrollment ................................................ 86
4.4.2. Generating the SCEP Certificate for a Router ............................................ 86
4.4.3. Working with Subordinate CAs ................................................................. 89
4.4.4. Re-enrolling a Router ............................................................................... 90
4.4.5. Enabling Debugging ................................................................................. 90
4.5. Performing Bulk Issuance ................................................................................... 90
4.5.1. Creating the Bulk Issuance File ................................................................ 91
4.5.2. Running the Bulk Issuance Command ....................................................... 92
4.6. Configuring and Using the Auto Enrollment Proxy ................................................. 93
4.6.1. About Auto Enrollment ............................................................................. 93
4.6.2. Installing and Setting up the Auto Enrollment Proxy ................................... 98
4.6.3. Managing Auto Enrollment Proxy Settings ............................................... 109
4.6.4. Manually Requesting Domain Certificates ................................................ 112
4.7. Renewing Certificates ....................................................................................... 116
4.7.1. About Renewal ...................................................................................... 116
4.7.2. Creating Custom Renewal Profiles .......................................................... 119
4.7.3. Renewing Certificates ............................................................................ 121
5. Using and Configuring the Token Management System: TPS, TKS, and Enterprise
Security Client 127

v
5.1. Configuring TPS Smart Card Operations ............................................................ 127
5.1.1. Configuring Format Operations ............................................................... 127
5.1.2. Configuring TPS Enrollment Operations .................................................. 128
5.1.3. Configuring TPS Renewal Operations ..................................................... 133
5.1.4. Configuring the PIN Reset Operation ...................................................... 134
5.1.5. Configuring the Applet Update Operation ................................................. 135
5.2. Allowing Token Renewal ................................................................................... 136
5.3. Changing the Token Policy ................................................................................ 137
5.4. Setting Token Types for Specified Smart Cards .................................................. 139
5.4.1. Default Token Types .............................................................................. 139
5.4.2. Mapping Token Types to Smart Card Operation Profiles ........................... 139
5.4.3. Example: Token Mapping with Two Different Token Types ......................... 141
5.5. Automating Encryption Key Recovery ................................................................ 143
5.5.1. Configuring Enrollment for Replacement Tokens ...................................... 143
5.5.2. Configuring Key Generation for Temporary Tokens ................................... 144
5.6. Managing Shared Keys ..................................................................................... 145
5.6.1. Generating Master Keys ......................................................................... 145
5.6.2. Generating and Transporting Wrapped Master Keys ................................. 146
5.6.3. Using HSM for Generating Keys ............................................................. 149
5.6.4. Updating Master Key Versions and Associating the Master Key with Its
Version ........................................................................................................... 151
5.6.5. Configuring Symmetric Key Changeover ................................................. 152
5.7. Configuring the TPS ......................................................................................... 154
5.7.1. Enabling SSL for TPS-Enterprise Security Client Connections ................... 154
5.7.2. Configuring the Channels between the TPS and Tokens ........................... 156
5.7.3. Configuring or Disabling LDAP Authentication .......................................... 157
5.7.4. Configuring the Token Database ............................................................. 159
5.7.5. Configuring Server-Side Key Generation and Archival of Encryption Keys .. 160
5.7.6. Configuring IPv6 Support ....................................................................... 163
5.8. Scaling the TPS and Its Support Subsystems ..................................................... 163
5.8.1. Configuring Failover Support .................................................................. 164
5.8.2. Configuring Multiple Support Subsystem Instances for Different Functions
........................................................................................................................ 166
5.9. Potential Token Operation Errors ....................................................................... 167
6. Revoking Certificates and Issuing CRLs 169
6.1. About Revoking Certificates .............................................................................. 169
6.1.1. User-Initiated Revocation ........................................................................ 171
6.1.2. Reasons for Revoking a Certificate ......................................................... 171
6.1.3. CRL Issuing Points ................................................................................ 171
6.1.4. Delta CRLs ............................................................................................ 172
6.1.5. Publishing CRLs .................................................................................... 172
6.1.6. Certificate Revocation Pages .................................................................. 172
6.2. CMC Revocation .............................................................................................. 172
6.2.1. Setting up CMC Revocation ................................................................... 173
6.2.2. Testing CMC Revoke ............................................................................. 173
6.3. Issuing CRLs .................................................................................................... 174
6.3.1. Configuring Issuing Points ...................................................................... 175
6.3.2. Configuring CRLs for Each Issuing Point ................................................. 176
6.3.3. Setting CRL Extensions ......................................................................... 180
6.3.4. Setting a CA to Use a Different Certificate to Sign CRLs ........................... 181
6.4. Setting Full and Delta CRL Schedules ............................................................... 182

Admin Guide
vi
6.4.1. Configuring Extended Updated Intervals for CRLs in the Console .............. 183
6.4.2. Configuring Extended Updated Intervals for CRLs in CS.cfg ...................... 183
6.5. Enabling Automatic Revocation Checking for Agent Certificates ........................... 184
7. Using the Online Certificate Status Protocol Responder 187
7.1. Setting up the OCSP Responder ....................................................................... 187
7.2. Identifying the CA to the OCSP Responder ........................................................ 188
7.2.1. Verify Certificate Manager and Online Certificate Status Manager
Connection ...................................................................................................... 189
7.2.2. Configure the Revocation Info Stores ...................................................... 189
7.2.3. Testing the OCSP Service Setup ............................................................ 190
7.3. Enabling the Certificate Manager's Internal OCSP Service ................................... 191
7.4. Enabling Revocation Checking for the TPS and RA ............................................ 192
7.5. Enabling Certificate Revocation Checking for DRM and TKS Users ...................... 194
7.6. Submitting OCSP Requests Using the GET Method ............................................ 196
7.7. Setting up a Redirect for Certificates Issued in Certificate System 7.1 and Earlier ... 197
II. Additional Configuration to Manage CA Services 201
8. Publishing Certificates and CRLs 203
8.1. About Publishing .............................................................................................. 203
8.1.1. Publishers ............................................................................................. 204
8.1.2. Mappers ................................................................................................ 205
8.1.3. Rules .................................................................................................... 205
8.1.4. Publishing to Files ................................................................................. 205
8.1.5. OCSP Publishing ................................................................................... 205
8.1.6. LDAP Publishing .................................................................................... 206
8.2. Setting up Publishing ........................................................................................ 206
8.2.1. Configuring Publishing to a File .............................................................. 207
8.2.2. Configuring Publishing to an OCSP ......................................................... 210
8.2.3. Configuring Publishing to an LDAP Directory ........................................... 211
8.2.4. Creating Rules ....................................................................................... 217
8.2.5. Enabling Publishing ................................................................................ 221
8.3. Publishing CRLs over HTTP ............................................................................. 222
8.3.1. Configuring CRL Publishing to Resume after Interrupted Downloads .......... 223
8.3.2. Retrieving CRLs Using wget ................................................................... 228
8.3.3. Retrieving Partial CRLs .......................................................................... 228
8.4. Publishing Cross-Pair Certificates ...................................................................... 229
8.5. Testing Publishing to Files ................................................................................. 230
8.6. Viewing Certificates and CRLs Published to File ................................................. 231
8.7. Updating Certificates and CRLs in a Directory .................................................... 231
8.7.1. Manually Updating Certificates in the Directory ........................................ 232
8.7.2. Manually Updating the CRL in the Directory ............................................ 233
8.8. Registering and Deleting Mapper and Publisher Plug-in Modules ......................... 233
9. Authentication for Enrolling Certificates 235
9.1. Configuring Agent-Approved Enrollment ............................................................. 235
9.2. Automated Enrollment ....................................................................................... 236
9.2.1. Setting up Directory-Based Authentication ............................................... 236
9.2.2. Setting up PIN-Based Enrollment ............................................................ 238
9.2.3. Using Certificate-Based Authentication .................................................... 241
9.2.4. Configuring Flat File Authentication ......................................................... 241

vii
9.3. Setting up CMC Enrollment ............................................................................... 244
9.3.1. Setting up the Server for Multiple Requests in a Full CMC Request ............ 245
9.3.2. Testing CMCEnroll ................................................................................. 246
9.4. Testing Enrollment ............................................................................................ 246
9.5. Managing Authentication Plug-ins ...................................................................... 247
10. Using Automated Notifications 249
10.1. About Automated Notifications for the CA ......................................................... 249
10.1.1. Types of Automated Notifications .......................................................... 249
10.1.2. Determining End-Entity Email Addresses ............................................... 249
10.1.3. About RA Notifications ......................................................................... 250
10.2. Setting up Automated Notifications for the CA .................................................. 250
10.2.1. Setting up Automated Notifications in the Console .................................. 250
10.2.2. Configuring Specific Notifications by Editing the CS.cfg File .................... 251
10.2.3. Testing Configuration ............................................................................ 252
10.3. Customizing Notification Messages .................................................................. 253
10.3.1. Customizing CA Notification Messages .................................................. 253
10.3.2. Customizing RA Notification Messages .................................................. 255
10.4. Configuring a Mail Server for Certificate System Notifications ............................. 256
10.5. Creating Custom Notifications for the CA ......................................................... 257
11. Setting Automated Jobs 259
11.1. About Automated Jobs .................................................................................... 259
11.1.1. Setting up Automated Jobs ................................................................... 259
11.1.2. Types of Automated Jobs ..................................................................... 259
11.2. Setting up the Job Scheduler ........................................................................... 260
11.3. Setting up Specific Jobs .................................................................................. 261
11.3.1. Configuring Specific Jobs Using the Certificate Manager Console ............ 261
11.3.2. Configuring Jobs by Editing the Configuration File .................................. 264
11.3.3. Configuration Parameters of certRenewalNotifier .................................... 265
11.3.4. Configuration Parameters of requestInQueueNotifier ............................... 265
11.3.5. Configuration Parameters of publishCerts .............................................. 266
11.3.6. Configuration Parameters of unpublishExpiredCerts ................................ 266
11.3.7. Frequency Settings for Automated Jobs ................................................. 267
11.4. Registering or Deleting a Job Module ............................................................... 268
III. Managing the Subsystem Instances 271
12. Editing Configuration in the CS.cfg File 273
12.1. Default File and Directory Locations for Certificate System Subsystems .............. 273
12.1.1. Default CA Instance Information ............................................................ 273
12.1.2. Default RA Instance Information ............................................................ 274
12.1.3. Default DRM Instance Information ......................................................... 275
12.1.4. Default OCSP Instance Information ....................................................... 275
12.1.5. Default TKS Instance Information .......................................................... 276
12.1.6. Default TPS Instance Information .......................................................... 277
12.1.7. Shared Certificate System Subsystem File Locations .............................. 278
12.2. CS.cfg Files .................................................................................................... 279
12.2.1. Locating the CS.cfg File ....................................................................... 279
12.2.2. Overview of the CS.cfg Configuration File .............................................. 279
12.2.3. Editing the Configuration File ................................................................ 285
12.3. System Passwords ......................................................................................... 285

Admin Guide
viii
12.3.1. Configuring the password.conf .............................................................. 286
12.3.2. Protecting the password.conf File .......................................................... 286
12.3.3. Requiring System Password Prompts .................................................... 287
12.3.4. Changing System Passwords ............................................................... 293
12.3.5. Password-Quality Checker .................................................................... 293
12.4. Configuration Files for Web Services ............................................................... 294
13. Basic Subsystem Management 295
13.1. Starting and Stopping Subsystem Instances ..................................................... 295
13.1.1. Starting and Stopping a Subsystem Server Instance ............................... 295
13.1.2. Restarting a Subsystem after a Machine Restart .................................... 295
13.1.3. Checking the Subsystem Instance Status .............................................. 295
13.1.4. Managing Subsystem Processes with chkconfig ..................................... 296
13.2. Opening Subsystem Consoles and Services ..................................................... 298
13.2.1. Finding the Subsystem Web Services Pages ......................................... 298
13.2.2. Starting the Certificate System Administrative Console ........................... 300
13.3. Customizing Web Services Pages ................................................................... 301
13.3.1. Customizing CA End-Entities Pages ...................................................... 301
13.3.2. Customizing RA End-Entities Pages ...................................................... 303
13.3.3. Setting Limits on Searches through the CA End-Entities Pages ............... 304
13.4. Configuring Ports ............................................................................................ 306
13.4.1. Changing a Port Number ...................................................................... 307
13.4.2. Using a Single SSL Port ....................................................................... 308
13.4.3. Updating Existing CAs to Use End-Entity Client Authentication Ports
(Avoiding TLS-Related Man-in-the-Middle Attacks) ............................................ 309
13.5. Configuring the LDAP Database ...................................................................... 312
13.5.1. Changing the Internal Database Configuration ....................................... 313
13.5.2. Enabling SSL Client Authentication with the Internal Database ................ 314
13.5.3. Restricting Access to the Internal Database ........................................... 317
13.6. Searching the SQLite Database ....................................................................... 318
13.7. Viewing Security Domain Configuration ............................................................ 318
13.8. Managing the SELinux Policies for Subsystems ................................................ 319
13.8.1. About SELinux ..................................................................................... 320
13.8.2. Viewing SELinux Policies for Subsystems .............................................. 320
13.9. Backing up and Restoring Certificate System ................................................... 322
13.10. Self-Tests ..................................................................................................... 324
13.10.1. Self-Test Logging ............................................................................... 324
13.10.2. Configuring Self-Tests ......................................................................... 324
13.10.3. Modifying Self-Test Configuration ........................................................ 325
14. Managing Certificate System Users and Groups 327
14.1. About Authorization ......................................................................................... 327
14.2. Default Groups ............................................................................................... 327
14.2.1. Administrators ...................................................................................... 328
14.2.2. Auditors ............................................................................................... 329
14.2.3. Agents ................................................................................................. 329
14.2.4. Enterprise Groups ................................................................................ 329
14.3. Managing Users and Groups for a CA, OCSP, DRM, or TKS ............................. 330
14.3.1. Managing Groups ................................................................................ 330
14.3.2. Managing Users ................................................................................... 331
14.4. Creating and Managing Users and Groups for an RA ........................................ 336
14.4.1. Managing RA Groups ........................................................................... 337

ix
14.4.2. Managing RA Users ............................................................................. 340
14.5. Creating and Managing Users for a TPS .......................................................... 349
14.5.1. Searching for Users ............................................................................. 349
14.5.2. Adding Users ....................................................................................... 350
14.5.3. Setting Profiles for Users ...................................................................... 351
14.5.4. Changing Roles for Users .................................................................... 352
14.5.5. Renewing TPS Agent and Administrator Certificates ............................... 353
14.5.6. Deleting Users ..................................................................................... 353
14.6. Configuring Access Control for Users for the CA, OCSP, DRM, and TKS ............. 354
14.6.1. About Access Control ........................................................................... 354
14.6.2. Editing ACLs ........................................................................................ 356
15. Configuring Subsystem Logs 359
15.1. An Overview of Log Settings ........................................................................... 359
15.1.1. Services That Are Logged .................................................................... 359
15.1.2. Log Levels (Message Categories) ......................................................... 360
15.1.3. Buffered and Unbuffered Logging .......................................................... 361
15.1.4. Log File Rotation ................................................................................. 362
15.2. Certificate System Logs .................................................................................. 362
15.2.1. System Log ......................................................................................... 362
15.2.2. Transactions Log ................................................................................. 363
15.2.3. Debug Logs ......................................................................................... 363
15.2.4. Error Log ............................................................................................. 365
15.2.5. Installation Logs ................................................................................... 366
15.2.6. Apache and Tomcat Error and Access Logs ........................................... 366
15.2.7. Self-Tests Log ...................................................................................... 367
15.3. Configuring Logs Using the UI ......................................................................... 367
15.3.1. Configuring Logs in the Console (for the CA, OCSP, DRM, and TKS) ....... 367
15.3.2. Configuring TPS Audit Logs in the Admin Services Page ........................ 368
15.4. Configuring Logs in the CS.cfg File .................................................................. 370
15.4.1. Configuring Logs in the CS.cfg File for the CA, OCSP, DRM, and TKS ...... 370
15.4.2. Configuring RA Logging ....................................................................... 371
15.4.3. Configuring TPS Logging ...................................................................... 373
15.5. Managing Signed Audit Logs ........................................................................... 376
15.5.1. Configuring a Signed Audit Log for a CA, OCSP, DRM, or TKS ................ 376
15.5.2. Configuring TPS Signed Audit Logging .................................................. 379
15.5.3. Handling Audit Logging Failures ............................................................ 381
15.5.4. Signing Log Files ................................................................................. 382
15.6. Viewing Logs .................................................................................................. 382
15.7. Smart Card Error Codes ................................................................................. 383
15.8. Managing Log Modules ................................................................................... 384
15.8.1. Registering a Log Module ..................................................................... 384
15.8.2. Deleting a Log Module ......................................................................... 385
16. Managing Subsystem Certificates 387
16.1. Required Subsystem Certificates ..................................................................... 387
16.1.1. Certificate Manager Certificates ............................................................ 387
16.1.2. RA Certificates ..................................................................................... 389
16.1.3. Online Certificate Status Manager Certificates ........................................ 389
16.1.4. Data Recovery Manager Certificates ..................................................... 391
16.1.5. TKS Certificates ................................................................................... 392
16.1.6. TPS Certificates ................................................................................... 393

Admin Guide
x
16.1.7. Using an HSM to Store Subsystem Certificates ...................................... 393
16.2. Requesting a Subsystem, Server, or Signing Certificate through the Console ....... 394
16.3. Renewing Subsystem Certificates .................................................................... 405
16.4. Using Cross-Pair Certificates ........................................................................... 406
16.4.1. Installing Cross-Pair Certificates ............................................................ 407
16.4.2. Searching for Cross-Pair Certificates ..................................................... 407
16.5. Managing the Certificate Database .................................................................. 407
16.5.1. Installing Certificates in the Certificate System Database ........................ 407
16.5.2. Viewing Database Content .................................................................... 410
16.5.3. Deleting Certificates from the Database ................................................. 412
16.6. Changing the Trust Settings of a CA Certificate ................................................ 413
16.6.1. Changing Trust Settings through the Console ........................................ 413
16.6.2. Changing Trust Settings Using certutil ................................................... 414
16.7. Managing Tokens Used by the Subsystems ...................................................... 414
16.7.1. Detecting Tokens ................................................................................. 415
16.7.2. Viewing Tokens .................................................................................... 415
16.7.3. Changing a Token's Password .............................................................. 415
IV. References 417
A. Certificate Profile Input and Output Reference 419
A.1. Input Reference ............................................................................................... 419
A.1.1. Certificate Request Input ........................................................................ 419
A.1.2. CMC Certificate Request Input ............................................................... 419
A.1.3. Dual Key Generation Input ..................................................................... 419
A.1.4. File-Signing Input .................................................................................. 420
A.1.5. Image Input ........................................................................................... 420
A.1.6. Key Generation Input ............................................................................. 420
A.1.7. nsHKeyCertRequest (Token Key) Input ................................................... 420
A.1.8. nsNKeyCertRequest (Token User Key) Input ........................................... 420
A.1.9. Serial Number Renewal Input ................................................................. 421
A.1.10. Subject DN Input ................................................................................. 421
A.1.11. Subject Name Input ............................................................................. 421
A.1.12. Submitter Information Input .................................................................. 421
A.2. Output Reference ............................................................................................. 421
A.2.1. Certificate Output .................................................................................. 421
A.2.2. PKCS #7 Output ................................................................................... 422
A.2.3. CMMF Output ....................................................................................... 422
B. Defaults, Constraints, and Extensions for Certificates and CRLs 423
B.1. Defaults Reference ........................................................................................... 423
B.1.1. Authority Info Access Extension Default .................................................. 423
B.1.2. Authority Key Identifier Extension Default ................................................ 425
B.1.3. Basic Constraints Extension Default ....................................................... 425
B.1.4. CRL Distribution Points Extension Default ............................................... 426
B.1.5. Extended Key Usage Extension Default .................................................. 429
B.1.6. Freshest CRL Extension Default ............................................................. 430
B.1.7. Issuer Alternative Name Extension Default .............................................. 433
B.1.8. Key Usage Extension Default ................................................................. 434
B.1.9. Name Constraints Extension Default ....................................................... 435
B.1.10. Netscape Certificate Type Extension Default .......................................... 440
B.1.11. Netscape Comment Extension Default .................................................. 440

xi
B.1.12. No Default Extension ........................................................................... 440
B.1.13. OCSP No Check Extension Default ...................................................... 440
B.1.14. Policy Constraints Extension Default ..................................................... 441
B.1.15. Policy Mappers Extension Default ......................................................... 442
B.1.16. Signing Algorithm Default ..................................................................... 443
B.1.17. Subject Alternative Name Extension Default .......................................... 443
B.1.18. Subject Directory Attributes Extension Default ....................................... 447
B.1.19. Subject Key Identifier Extension Default ................................................ 448
B.1.20. Subject Name Default .......................................................................... 448
B.1.21. Token Supplied Subject Name Default .................................................. 449
B.1.22. User Supplied Extension Default ........................................................... 449
B.1.23. User Key Default ................................................................................. 450
B.1.24. User Signing Algorithm Default ............................................................. 450
B.1.25. User Subject Name Default .................................................................. 451
B.1.26. User Validity Default ............................................................................ 451
B.1.27. Validity Default ..................................................................................... 451
B.2. Constraints Reference ...................................................................................... 451
B.2.1. Basic Constraints Extension Constraint ................................................... 452
B.2.2. Extended Key Usage Extension Constraint .............................................. 453
B.2.3. Extension Constraint .............................................................................. 453
B.2.4. Key Constraint ...................................................................................... 453
B.2.5. Key Usage Extension Constraint ............................................................ 453
B.2.6. No Constraint ........................................................................................ 455
B.2.7. Netscape Certificate Type Extension Constraint ....................................... 455
B.2.8. Renewal Grace Period Constraint ........................................................... 455
B.2.9. Signing Algorithm Constraint .................................................................. 456
B.2.10. Subject Name Constraint ..................................................................... 456
B.2.11. Unique Subject Name Constraint .......................................................... 457
B.2.12. Validity Constraint ................................................................................ 457
B.3. Standard X.509 v3 Certificate Extension Reference ............................................ 457
B.3.1. authorityInfoAccess ................................................................................ 459
B.3.2. authorityKeyIdentifier ............................................................................. 460
B.3.3. basicConstraints .................................................................................... 461
B.3.4. certificatePoliciesExt .............................................................................. 461
B.3.5. CRLDistributionPoints ............................................................................ 461
B.3.6. extKeyUsage ......................................................................................... 462
B.3.7. issuerAltName Extension ....................................................................... 463
B.3.8. keyUsage .............................................................................................. 463
B.3.9. nameConstraints .................................................................................... 464
B.3.10. OCSPNocheck .................................................................................... 464
B.3.11. policyConstraints .................................................................................. 465
B.3.12. policyMappings .................................................................................... 465
B.3.13. privateKeyUsagePeriod ........................................................................ 466
B.3.14. subjectAltName .................................................................................... 466
B.3.15. subjectDirectoryAttributes ..................................................................... 466
B.3.16. subjectKeyIdentifier .............................................................................. 467
B.4. CRL Extensions ............................................................................................... 467
B.4.1. About CRL Extensions ........................................................................... 467
B.4.2. Standard X.509 v3 CRL Extensions Reference ........................................ 471
B.4.3. Netscape-Defined Certificate Extensions Reference ................................. 480
C. Publishing Module Reference 483

Admin Guide
xii
C.1. Publisher Plug-in Modules ................................................................................ 483
C.1.1. FileBasedPublisher ................................................................................ 483
C.1.2. LdapCaCertPublisher ............................................................................. 483
C.1.3. LdapUserCertPublisher .......................................................................... 484
C.1.4. LdapCrlPublisher ................................................................................... 484
C.1.5. LdapDeltaCrlPublisher ........................................................................... 484
C.1.6. LdapCertificatePairPublisher .................................................................. 485
C.1.7. OCSPPublisher ..................................................................................... 485
C.2. Mapper Plug-in Modules ................................................................................. 485
C.2.1. LdapCaSimpleMap ................................................................................ 486
C.2.2. LdapDNExactMap ................................................................................. 487
C.2.3. LdapSimpleMap .................................................................................... 487
C.2.4. LdapSubjAttrMap ................................................................................... 488
C.2.5. LdapDNCompsMap ............................................................................... 488
C.3. Rule Instances ................................................................................................. 491
C.3.1. LdapCaCertRule .................................................................................... 491
C.3.2. LdapXCertRule ...................................................................................... 491
C.3.3. LdapUserCertRule ................................................................................. 492
C.3.4. LdapCRLRule ........................................................................................ 492
D. ACL Reference 493
D.1. About ACL Configuration Files .......................................................................... 493
D.2. Common ACLs ................................................................................................ 494
D.2.1. certServer.acl.configuration .................................................................... 494
D.2.2. certServer.admin.certificate .................................................................... 495
D.2.3. certServer.admin.request.enrollment ....................................................... 495
D.2.4. certServer.auth.configuration .................................................................. 496
D.2.5. certServer.clone.configuration ................................................................. 496
D.2.6. certServer.general.configuration .............................................................. 496
D.2.7. certServer.log.configuration .................................................................... 497
D.2.8. certServer.log.configuration.fileName ...................................................... 497
D.2.9. certServer.log.configuration.signedAudit.expirationTime ............................ 497
D.2.10. certServer.log.content .......................................................................... 498
D.2.11. certServer.log.content.signedAudit ........................................................ 498
D.2.12. certServer.registry.configuration ............................................................ 499
D.2.13. certServer.usrgrp.administration ............................................................ 499
D.3. Certificate Manager-Specific ACLs .................................................................... 499
D.3.1. certServer.admin.ocsp ........................................................................... 499
D.3.2. certServer.ca.certificate .......................................................................... 500
D.3.3. certServer.ca.certificates ........................................................................ 500
D.3.4. certServer.ca.clone ................................................................................ 500
D.3.5. certServer.ca.configuration ..................................................................... 501
D.3.6. certServer.ca.connector ......................................................................... 501
D.3.7. certServer.ca.connectorInfo .................................................................... 501
D.3.8. certServer.ca.crl .................................................................................... 502
D.3.9. certServer.ca.directory ........................................................................... 502
D.3.10. certServer.ca.group .............................................................................. 502
D.3.11. certServer.ca.ocsp ............................................................................... 503
D.3.12. certServer.ca.profile ............................................................................. 503
D.3.13. certServer.ca.profiles ........................................................................... 503
D.3.14. certServer.ca.registerUser .................................................................... 503
D.3.15. certServer.ca.request.enrollment ........................................................... 504

xiii
D.3.16. certServer.ca.request.profile ................................................................. 504
D.3.17. certServer.ca.requests ......................................................................... 504
D.3.18. certServer.ca.systemstatus ................................................................... 505
D.3.19. certServer.ee.certchain ......................................................................... 505
D.3.20. certServer.ee.certificate ........................................................................ 505
D.3.21. certServer.ee.certificates ...................................................................... 506
D.3.22. certServer.ee.crl .................................................................................. 506
D.3.23. certServer.ee.profile ............................................................................. 506
D.3.24. certServer.ee.profiles ........................................................................... 506
D.3.25. certServer.ee.request.enrollment ........................................................... 507
D.3.26. certServer.ee.request.ocsp ................................................................... 507
D.3.27. certServer.ee.request.revocation ........................................................... 507
D.3.28. certServer.ee.requestStatus .................................................................. 507
D.3.29. certServer.job.configuration .................................................................. 508
D.3.30. certServer.kra.configuration .................................................................. 508
D.3.31. certServer.ocsp.configuration ................................................................ 508
D.3.32. certServer.policy.configuration ............................................................... 509
D.3.33. certServer.profile.configuration .............................................................. 509
D.3.34. certServer.publisher.configuration .......................................................... 509
D.3.35. certServer.ra.configuration .................................................................... 510
D.3.36. certServer.securitydomain.domainxml ................................................... 510
D.4. Data Recovery Manager-Specific ACLs ............................................................. 511
D.4.1. certServer.job.configuration .................................................................... 511
D.4.2. certServer.kra.certificate.transport ........................................................... 511
D.4.3. certServer.kra.configuration .................................................................... 511
D.4.4. certServer.kra.connector ........................................................................ 512
D.4.5. certServer.kra.GenerateKeyPair .............................................................. 512
D.4.6. certServer.kra.getTransportCert .............................................................. 512
D.4.7. certServer.kra.group .............................................................................. 513
D.4.8. certServer.kra.key .................................................................................. 513
D.4.9. certServer.kra.keys ................................................................................ 513
D.4.10. certServer.kra.registerUser ................................................................... 513
D.4.11. certServer.kra.request .......................................................................... 514
D.4.12. certServer.kra.request.status ................................................................ 514
D.4.13. certServer.kra.requests ........................................................................ 514
D.4.14. certServer.kra.systemstatus .................................................................. 514
D.4.15. certServer.kra.TokenKeyRecovery ......................................................... 515
D.5. Online Certificate Status Manager-Specific ACLs ............................................... 515
D.5.1. certServer.ca.ocsp ................................................................................. 515
D.5.2. certServer.ee.crl .................................................................................... 516
D.5.3. certServer.ee.request.ocsp ..................................................................... 516
D.5.4. certServer.ocsp.ca ................................................................................. 516
D.5.5. certServer.ocsp.cas ............................................................................... 517
D.5.6. certServer.ocsp.certificate ...................................................................... 517
D.5.7. certServer.ocsp.configuration .................................................................. 517
D.5.8. certServer.ocsp.crl ................................................................................. 517
D.5.9. certServer.ocsp.group ............................................................................ 518
D.5.10. certServer.ocsp.info ............................................................................. 518
D.5.11. certServer.ocsp.systemstatus ................................................................ 518
D.6. Token Key Service-Specific ACLs ..................................................................... 518
D.6.1. certServer.tks.encrypteddata .................................................................. 519

Admin Guide
xiv
D.6.2. certServer.tks.group ............................................................................... 519
D.6.3. certServer.tks.importTransportCert .......................................................... 519
D.6.4. certServer.tks.keysetdata ....................................................................... 519
D.6.5. certServer.tks.registerUser ..................................................................... 520
D.6.6. certServer.tks.sessionkey ....................................................................... 520
D.6.7. certServer.tks.systemstatus .................................................................... 520
Glossary 521
Index 535

xv
About This Guide
This guide explains how to install, configure, and maintain the Red Hat Certificate System and how to
use it for issuing and managing certificates to end entities such as web browsers, users, servers, and
virtual private network (VPN) clients.
This guide is intended for experienced system administrators planning to deploy the Certificate
System. Certificate System agents should refer to the Certificate System Agent's Guide for information
on how to perform agent tasks, such as handling certificate requests and revoking certificates.
1. Recommended Concepts
Before reading this guide, be familiar with the following concepts:
• Intranet, extranet, and Internet security and the role of digital certificates in a secure enterprise,
including the following topics:
• Encryption and decryption
• Public keys, private keys, and symmetric keys
• Significance of key lengths
• Digital signatures
• Digital certificates, including different types of digital certificates
• The role of digital certificates in a public-key infrastructure (PKI)
• Certificate hierarchies
• LDAP and Red Hat Directory Server
• Public-key cryptography and the Secure Sockets Layer (SSL) protocol, including the following:
• SSL cipher suites
• The purpose of and major steps in the SSL handshake
2. What Is in This Guide
Administering certificates relates to the setup and configuration of the individual subsystems, the
processes for issuing certificates, and the ways certificates are stored (in software databases or in
tokens). This administration guide, then, is divided into several functional areas, listed in Table 1,
“Content Overview”.
Concept Related Chapters
Overviews of important concepts Chapter 1, Overview of Red Hat Certificate System Subsystems
Section 1.5, “Red Hat Certificate System Services”
Issuing certificates Chapter 2, Making Rules for Issuing Certificates
Chapter 4, Requesting, Enrolling, and Managing Certificates
Managing certificates on tokens Chapter 5, Using and Configuring the Token Management System: TPS, TKS,
and Enterprise Security Client

About This Guide
xvi
Concept Related Chapters
Archiving keys Chapter 3, Setting up Key Archival and Recovery
Publishing certificates Chapter 8, Publishing Certificates and CRLs
Revoking certificates Chapter 6, Revoking Certificates and Issuing CRLs
Options for issuing certificates Chapter 7, Using the Online Certificate Status Protocol Responder
Chapter 9, Authentication for Enrolling Certificates
Chapter 10, Using Automated Notifications
Configuring and managing Certificate System subsystems Chapter 12, Editing Configuration in the CS.cfg File
Chapter 13, Basic Subsystem Management
Chapter 14, Managing Certificate System Users and Groups
Chapter 15, Configuring Subsystem Logs
Chapter 16, Managing Subsystem Certificates
Chapter 11, Setting Automated Jobs
References for Subsystem Components Appendix A, Certificate Profile Input and Output Reference
Appendix B, Defaults, Constraints, and Extensions for Certificates and CRLs
Appendix C, Publishing Module Reference
Table 1. Content Overview
3. Supported Platforms, Hardware, and Programs
3.1. Supported Platforms
The Certificate System subsystems (CA, RA, DRM, OCSP, RA, TKS, and TPS) are supported on the
following platforms:
• Red Hat Enterprise Linux 5.3 (x86, 32-bit)
• Red Hat Enterprise Linux 5.3 (x86_64, 64-bit)
The Enterprise Security Client, which manages smart cards for end users, is supported on the
following platforms:
• Red Hat Enterprise Linux 5.3 (x86, 32-bit)
• Red Hat Enterprise Linux 5.3 (x86_64, 64-bit)
• Microsoft Windows Vista 32-bit
• Microsoft Windows Vista 64-bit
• Microsoft Windows XP 32-bit
• Microsoft Windows XP 64-bit
3.2. Supported Web Browsers
The services pages for the subsystems require a web browser that supports SSL. It is strongly
recommended that users such as agents or administrators use Mozilla Firefox to access the agent
services pages. Regular users should use Mozilla Firefox or Microsoft Internet Explorer.

Supported Smart Cards
xvii
NOTE
The only browser that is fully-supported for the HTML-based instance configuration wizard
is Mozilla Firefox.
Platform Agent Services End User Pages
Red Hat Enterprise Linux Firefox 3.x Firefox 3.x
Windows Vista Firefox 2.x Firefox 2.x
Internet Explorer 7 and higher
Windows XP Firefox 2.x Firefox 2.x
Internet Explorer 6.0 and and
higher
Mac OS 10.x Agent services are not
supported for Mac
Firefox 2.x
Table 2. Supported Web Browsers by Platform
3.3. Supported Smart Cards
The Enterprise Security Client supports Global Platform 2.01-compliant smart cards and JavaCard 2.1
or higher.
The Certificate System subsystems have been tested using the following tokens:
• Gemalto TOP IM FIPS CY2 64K token, both as a smart card and GemPCKey USB form factor key
• Gemalto Cyberflex e-gate 32K token
• Safenet 330J Java smart card
Smart card testing was conducted using the SCM SCR331 CCID reader.
The only card manager applet supported with Certificate System is the CoolKey applet which ships
with Red Hat Enterprise Linux 5.3.
3.4. Supported HSM
Red Hat Certificate System supports two hardware security modules (HSM), Safenet Chrysalis-ITS
LunaSA and nCipher netHSM 2000.
HSM Firmware Appliance Software Client Software
Safenet Chrysalis-ITS
LunaSA
4.5.2 3.2.4 3.2.4
nCipher netHSM 2000 2.33.60 11.10
3.5. Supported Charactersets
Red Hat Certificate System fully supports UTF-8 characters in the CA end users forms for specific
fields. This means that end users can submit certificate requests with UTF-8 characters in those fields
and can search for and retrieve certificates and CRLs in the CA and retrieve keys in the DRM when
using those field values as the search parameters.

About This Guide
xviii
Four fields fully-support UTF-8 characters:
• Common name (used in the subject name of the certificate)
• Organizational unit (used in the subject name of the certificate)
• Requester name
• Additional notes (comments appended by the agent to the certificate)
NOTE
This support does not include supporting internationalized domain names, like in email
addresses.
4. Examples and Formatting
Each of the examples used in this guide, such as file locations and commands, have certain defined
conventions.
4.1. Formatting for Examples and Commands
All of the examples for Red Hat Certificate System commands, file locations, and other usage are
given for Red Hat Enterprise Linux 5 (32-bit) systems. Be certain to use the appropriate commands
and files for your platform.
To start the Red Hat Certificate System:
service pki-ca start
Example 1. Example Command
4.2. Tool Locations
All of the tools for Red Hat Certificate System are located in the /usr/bin directory. These tools can
be run from any location without specifying the tool location.
4.3. Guide Formatting
Certain words are represented in different fonts, styles, and weights. Different character formatting is
used to indicate the function or purpose of the phrase being highlighted.
Formatting Style Purpose
Monospace font Monospace is used for commands, package names, files and
directory paths, and any text displayed in a prompt.
Monospace
with a
background
This type of formatting is used for anything entered or returned
in a command prompt.
Italicized text Any text which is italicized is a variable, such as
instance_name or hostname. Occasionally, this is also used to
emphasize a new term or other phrase.

Additional Reading
xix
Formatting Style Purpose
Bolded text Most phrases which are in bold are application names, such as
Cygwin, or are fields or options in a user interface, such as a
User Name Here: field or Save button.
Other formatting styles draw attention to important text.
NOTE
A note provides additional information that can help illustrate the behavior of the system or
provide more detail for a specific issue.
IMPORTANT
Important information is necessary, but possibly unexpected, such as a configuration
change that will not persist after a reboot.
WARNING
A warning indicates potential data loss, as may happen when tuning hardware for
maximum performance.
5. Additional Reading
The documentation for Certificate System includes the following guides:
•Certificate System Deployment Guide1 describes basic PKI concepts and gives an overview of the
planning process for setting up Certificate System.
This manual is intended for Certificate System administrators.
•Certificate System Installation Guide2 covers the installation process for all Certificate System
subsystems.
This manual is intended for Certificate System administrators.
•Certificate System Administrator's Guide3 explains all administrative functions for the Certificate
System. Administrators maintain the subsystems themselves, so this manual details backend
configuration for certificate profiles, publishing, and issuing certificates and CRLs. It also covers
managing subsystem settings like port numbers, users, and subsystem certificates.
This manual is intended for Certificate System administrators.
•Certificate System Agent's Guide4 describes how agents — users responsible for processing
certificate requests and managing other aspects of certificate management — can use the
Certificate System subsystems web services pages to process certificate requests, key recovery,
OCSP requests and CRLs, and other functions.
This manual is intended for Certificate System agents.

About This Guide
xx
•Managing Smart Cards with the Enterprise Security Client5 explains how to install, configure,
and use the Enterprise Security Client, the user client application for managing smart cards, user
certificates, and user keys.
This manual is intended for Certificate System administrators, agents, privileged users (such as
security officers), and regular end users.
•Using End User Services6 is a quick overview of the end-user services in Certificate System, a
simple way for users to learn how to access Certificate System services.
This manual is intended for regular end users.
•Certificate System Command-Line Tools Guide7 covers the command-line scripts supplied with Red
Hat Certificate System.
This manual is intended for Certificate System administrators.
•Certificate System Migration Guide8 covers version-specific procedures for migrating from older
versions of Certificate System to Red Hat Certificate System 8.0.
This manual is intended for Certificate System administrators.
•Release Notes9 contains important information on new features, fixed bugs, known issues and
workarounds, and other important deployment information for Red Hat Certificate System 8.0.
All of the latest information about Red Hat Certificate System and both current and archived
documentation is available at http://www.redhat.com/docs/manuals/cert-system/.
6. Giving Feedback
If there is any error in this Administrator's Guide or there is any way to improve the documentation,
please let us know. Bugs can be filed against the documentation for Red Hat Certificate System
through Bugzilla10. Make the bug report as specific as possible, so we can be more effective in
correcting any issues:
• Select the Red Hat Certificate System product.
• Set the component to Doc - administration-guide.
• Set the version number to 8.0.
• For errors, give the page number (for the PDF) or URL (for the HTML), and give a succinct
description of the problem, such as incorrect procedure or typo.
For enhancements, put in what information needs to be added and why.
• Give a clear title for the bug. For example, "Incorrect command example for setup
script options" is better than "Bad example".
We appreciate receiving any feedback — requests for new sections, corrections, improvements,
enhancements, even new ways of delivering the documentation or new styles of docs. You are
welcome to contact Red Hat Content Services directly at [email protected].
10 http://bugzilla.redhat.com/bugzilla