Netscape MANAGEMENT SYSTEM 4.5 Installation And Setup Manual page 617

• Identify your publishing directory. If you've already configured the Certificate
Manager to use an LDAP directory for authenticating users (for example, if
you're using the directory-based or directory- and PIN-based authentication),
you should consider publishing certificates and CRLs to the same directory.
This way, users' security credentials will be kept with the rest of the user
information.
• Note the following information for the directory: the host name, the port
number, and the port type—whether it's an SSL or nonSSL port.
• Determine how you want the Certificate Manager to authenticate to the
directory: whether to publish with basic authentication, publish over SSL
without SSL client authentication, or publish over SSL with SSL client
authentication. Accordingly, you will need to configure the Directory Server.
• If you want the Certificate Manager to authenticate to the directory using SSL
client authentication, determine the certificate the Certificate Manager must
use for SSL client authentication; see "Certificate Manager's Key Pairs and
Certificates" on page 437. By default, the server uses its SSL server certificate;
see "SSL Server Key Pair and Certificate" on page 441.
Depending on your PKI setup, you may use an external CA for requesting the
certificate. For example, if your Certificate Manager is a subordinate CA to an
external CA, you can get the Directory Server's certificate signed by the same
CA that signed your Certificate Manager's certificate.
• If certificates the Directory Server and Certificate Manager will use during
SSL-enabled communication already exist, check the CA that issued these
certificates. The CA that issued the Directory Server's SSL server certificate
must be trusted by the Certificate Manager. Similarly, the Directory Server
must trust the CA that issued the certificate the Certificate Manager will use for
client authentication.
• Determine how you want the Certificate Manager to bind to the directory:
whether to bind as
user, the entry must have read-write privileges to the directory tree that
contains entries for end-entities to whom you intend to issue certificates.
• If you're not the directory administrator, consult the directory administrator
about making changes to the schema, if required.
• Keep your directory documentation handy.
Configuring a Certificate Manager to Publish Certificates and CRLs
CN=directory manager
or as another user; if it's another
Chapter 19 Setting Up LDAP Publishing 617