Understanding Cs Installation; Configuring Cs To Use Hardware Tokens; Revocation Checking; Ssl Client Authentication With The Internal Database - Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual

Understanding CS Installation

When you begin installation, you will be instructed to create a special user ID, which you
will then use to log in to the Operating System when you install CS. This user ID will be the
effective user ID of the CS server itself during runtime. You will then need to create groups
for the auditor and administrator roles, which you must then assign to the actual user IDs for
the CS administrators and CS auditor users on the operating system.
After CS files are installed, you will be instructed to change the ownership of the CS files to
the special user ID that you've created by running a shell script provided with this product.
Finally, you will be instructed to disable this special user ID account, preventing users from
logging in with this user ID.
Understanding CS Installation
You must install CS on each host on which a CS subsystem is installed. You can set up the
environment with all subsystems installed on the same host, or with some or all subsystems
on separate hosts, but every host must have CS.

Configuring CS to Use Hardware Tokens

You will be instructed to configure each CS installation to use a FIPS 140-1 Level 3
certified hardware token after installing CS on the host, but before installing and
configuring any subsystems on that host. Hardware tokens are required for all subsystems
(CA, RA, DRM, and OCSP Responder); DRM needs at least two: one for user private key
transport key, and one for user private key storage key.

Revocation Checking

In order to check the status of CS user certificates, you will be instructed to set up
revocation checking for each CS instance by setting up the revocation feature in the NES
instance used by that CS instance.

SSL Client Authentication with the Internal Database

In the Common Criteria Environment, the internal LDAP database used by the subsystem
must be set up for SSL client authentication. You will be instructed on how to set this up
when you follow instructions in the document CS Common Criteria Setup Procedure.
Appendix C Understanding the Common Criteria Evaluated CS Setup 699