Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual page 171

Click Next to continue.
e.
If you closed the end-entity interface, you can get the CA certificate chain this way:
Open a web browser window.
a.
Go to the end-entity URL for the Certificate Manager that issued the Online
b.
Certificate Status Manager's signing certificate.
Select the Retrieval tab, and then choose Import CA Certificate Chain.
c.
Select the "Display the CA certificate chain in PKCS#7 for importing into a
d.
server" option, and then click Submit.
Copy the certificate chain to the clipboard.
e.
Return to the Installation Wizard.
f.
Paste the certificate chain into the text box.
g.
Click Next to continue.
h.
Key-Pair Information for SSL Server Certificate.
17.
Token. Enter either
❍
the name of an external token to store the SSL server certificate and key pair. If
you have not previously initialized the token's password, you must do so in this
screen. See "Tokens," on page 164 for more information.
Key Type. Choose RSA .
❍
Key Length. Available key sizes for RSA are 512, 768, 1024, 2048, 4096, or
❍
Custom. Available key sizes for DSA are 512, 1024, or Custom (which must be in
increments of 64 bits only).
See "Signing Key Type and Length" on page 165 for more information.
Click Next to continue.
Subject Name for SSL Server Certificate. Type the values for the subject DN
18.
components; these values identify the Online Certificate Status Manager's SSL server
certificate. The CN must be the fully-qualified host name of the machine on which
you're installing the Online Certificate Status Manager.
Click Next to continue.
Certificate Extensions for SSL Server Certificate. Select the required extensions.
19.
The default settings should work for most deployments. If necessary, you can add an
additional extension by pasting its base-64 encoding in the space provided on this
screen.
(if you plan to use the internal/software token) or
internal
Installing an Online Certificate Status Manager
Chapter 5 OCSP Responder 171