Ca Signing Certificate; Ca's Serial Number Range; Cloned Key And Certificate Material - Netscape MANAGEMENT SYSTEM 6.0 Installation And Setup Manual

Cloned Certificate Manager Configuration
You can clone a Certificate Manager instance to have two server processes
perfoming the same CA functions using the same keys and certificates. Each cloned
Certificate Manager, including the original, must only issue certificates with serial
numbers that do not conflict with the serial numbers issued by other clones. Use
the CA serial number range to make sure that the serial numbers used by a clone
do not overlap with the serial number range of another clone (or the original
server).
If the cloned Certificate Manager has the same hostname as the original server, the
clone can use the same SSL server certificate. The SSL server certificate DN contains
the hostname as the common name (CN) attribute, so a clone with a different
hostname must enroll for a new SSL server certificate.

CA Signing Certificate

When you install the Certificate Manager, you must supply information for the CA
certificate that the Certificate Manager will use to sign the certificates it issues. This
certificate can also function as the Certificate Manager's SSL client certificate. If the
clone uses a different hostname than the original CA, you will need to generate a
new SSL server certificate.

CA's Serial Number Range

For most CAs, you only need to enter the starting serial number. When you
configure cloned CAs, you must specify upper and lower bounds for the serial
numbers on all CAs and you must make sure the ranges do not overlap.
• CA's starting serial number __________________
Enter the lowest serial number available for this CA to assign to certificates it
creates. You can enter the number in decimal or hexadecimal (0xnn). The
default is 0x1.
• CA's ending serial number ____________________
Enter the highest serial number available for this CA. You can enter the
number in decimal or hexadecimal (0xnn). The default is no upper limit
(blank).

Cloned Key and Certificate Material

If you do not use the copied key and certificate databases, the Certificate Manager
will need to generate a new signing key and certificate; consequently, it will not be
a clone.
206 Netscape Certificate Management System Installation and Setup Guide • March 2002