Step 2. Set Up The Directory For Publishing; Step A. Verify The Directory Schema - Netscape MANAGEMENT SYSTEM 4.5 Installation And Setup Manual

Configuring a Certificate Manager to Publish Certificates and CRLs

Step 2. Set Up the Directory for Publishing

For a Certificate Manager to publish certificates and CRLs to an LDAP directory,
the directory needs to be set up to receive certificate- and CRL-related information
from the Certificate Manager.
•

Step A. Verify the Directory Schema

• Step B. Add an Entry for the CA
• Step C. Identify an Entry That Has Write Access
• Step D. Verify Entries for End Entities
• Step E. Specify the Directory Authentication Method
• Step F. Modify the Certificate Mapping File
• Step G. Restart Directory Server
Step A. Verify the Directory Schema
For a Certificate Manager to publish certificates and CRLs to a directory, it must be
configured with specific attributes and object classes. This section discusses those
basic schema requirements. Is it assumed that you're familiar with directory
schema and related terminology. If you're not, check the Netscape Directory Server
documentation.
Required Schema for Publishing End-Entity Certificates
The Certificate Manager publishes an end entity's certificate to the
userCertificate;binary
object. This attribute is multivalued; each value is a DER encoded binary X.509
certificate. The LDAP object class named
object class is supported by Directory Server versions 1.0, 3.x, and 4.x. The mix-in
object class named
combined with any other object class to allow certificate publication to that object.
Note that the Certificate Manager does not automatically add this object class to the
schema table of the corresponding Directory Server while publishing or
unpublishing end-entity certificates. If the directory object that it finds does not
allow the
specific certificate fails.
If you have created user entries as
attribute already exists in the directory. Otherwise, you must add the
userCertificate;binary
information on modifying directory schema, check the Directory Server
documentation.
618 Netscape Certificate Management System Installation and Setup Guide • October 2001
attribute within the end entity's or subject's directory
strongAuthenticationUser
userCertificate;binary
attribute to your directory's schema table. For
inetOrgPerson
allows this attribute and can be
attribute, the addition or removal of that
, the
inetOrgPerson userCertificate;binary
allows this attribute. This