Netscape MANAGEMENT SYSTEM 4.5 Installation And Setup Manual page 288

Cloning a Certificate Manager
• Check the master Certificate Manager's serial number range. The "Next serial
number" field should be set to the next serial number of the certificate the CA
will issue and the "Last serial number" field must be blank. To locate the panel
that enables you to do this, see "Enabling End-Entity Interaction with a
Certificate Manager" on page 539.
• If the master Certificate Manager's keys and certificates are stored in a
hardware token, check the token vendor's documentation for copying the keys
and certificates (from the original token to a new token accessible to the clone
Certificate Manager). Keep the relevant instructions handy.
• Decide how many clone CAs you need to deploy, and note the following for
each clone CA.
288 Netscape Certificate Management System Installation and Setup Guide • October 2001
CA's serial number range—Each clone Certificate Manager must be
configured to issue certificates with unique serial numbers. Which means,
when you configure a clone Certificate Manager, you must specify upper
and lower bounds for the serial numbers and make sure that the
serial-number range does not overlap with the one specified for another
clone Certificate Manager.
When specifying the serial number range for the first clone Certificate
Manager, it's recommended that you start with, say, 0x100, as the
starting/lowest serial number. This will ensure that the master Certificate
Manager has sufficient serial numbers for its own certificates, such as the
CA signing certificate, SSL server certificate, agent's certificate, and so on.
The master Certificate Manager will also need distinct serial numbers in
the future, for example, when you renew its certificates in the future. Any
subsequent clone Certificate Manager does not need to make such a
provision; its serial numbers only need to not overlap with the ones
assigned to the previous clones.
CA's signing key and certificate—You must use the master Certificate
Manager's signing key and certificate. If you do not use the master
Certificate Manager's key and certificate databases, the clone Certificate
Manager will need to generate a new signing key and certificate;
consequently, it will not be a clone.
CA's SSL server key and certificate—This depends on the hostname of the
clone Certificate Manager. If the clone Certificate Manager uses the same
hostname as that of the master Certificate Manager, you can use the same
SSL server certificate and key copied from the master Certificate Manager.
If the hostnames are different, you must generate a new SSL server
certificate for the clone Certificate Manager; the SSL server certificate DN
contains the hostname as the common name (CN) attribute, so a clone with
a different hostname must enroll for a new SSL server certificate.