Formatting Smart Cards; Resetting The Smart Card Pin; Applet Upgrade - Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Administration Manual

Chapter 8. Token Processing System
The mapping and filter parameters are listed in

8.2. Formatting Smart Cards

When the TPS is contacted by a smart card for a format operation, there are several different
operations the TPS can perform, depending on the status of the smart card.
• Whether an empty token should be rejected or have the required applet (card format) uploaded, so it
is made usable.
• Whether a smart card with an outdated applet should be upgraded and, if so, which version of
applet to upload.
• Whether a smart card with outdated keys should be updated with new symmetric keys. Keys can
become outdated if the TKS had a master key changeover.
• Whether to revoke the certificates associated with the token.
For example, to configure the TPS to reject a smart card without an applet, to update a smart card
with new symmetric keys, and to revoke certificates associated with the smart card, the following
parameters are set:
op.format.tokenKey.revokeCert=true
op.format.tokenKey.update.applet.emptyToken.enable=true
op.format.tokenKey.update.symmetricKeys.enable=true
The different format operations can be configured to happen automatically by setting the appropriate
parameters in the CS.cfg file. The TPS can also be configured with other options, such as requiring
LDAP authentication and setting which subsystem instances will process the formatting operations.
The parameters are listed in

8.3. Resetting the Smart Card PIN

The PIN is the password which protects the certificates and keys on the smart card. The TPS can
place two restrictions on the PIN: the maximum length and the minimum length. For example, to
require PINs to be between 6 and 12 characters, the following parameters are set:
op.pinReset.userKey.pinReset.pin.maxLen=12
op.pinReset.userKey.pinReset.pin.minLen=6
Like the formatting operation, the TPS can be configured to upload or update the applet version on
the smart card, update the symmetric key, and required LDAP authentication, as well as setting which
subsystem instances will process the operation. The CS.cfg file parameters for resetting the PIN are
Table 8.9, "PIN Reset Operation
listed in

8.4. Applet Upgrade

The TPS communicates with an applet on the smart card. The smart cards can be manufactured with
both a card manager applet and a vendor applet or with only the card manager applet. If the cards
only have the card manager applet, the TPS can install the Certificate System applet onto the smart
186
Table 8.10, "Format Operation
Preferences".
Table 8.7, "Mapping and
Preferences".
Filters".