Deploying Data Recovery Manager's Transport Certificate - Netscape MANAGEMENT SYSTEM 6.0 Installation And Setup Manual
Hide thumbs
Also See for NETSCAPE MANAGEMENT SYSTEM 6.0:
- Manual (302 pages) ,
- Installation and migration manual (66 pages) ,
- Administrator's manual (470 pages)
Table of Contents
Advertisement
Getting New Certificates for the Subsystems
Ensure that the CA that signed the Registration Manager's certificate is in the
2.
certificate database of the subsystem.
When a Registration Manager does SSL client authentication using its new
certificate, the subsystem, as a part of validating the certificate presented by the
Registration Manager, checks its trust database for the CA (certificate) that
signed the Registration Manager's new certificate. If the subsystem does not
find the CA as a trusted CA in its trust database, it rejects the Registration
Manager.
For instructions on checking the trust database of a subsystem, see "Viewing
the Certificate Database Content" on page 482.
Deploying Data Recovery Manager's Transport Certificate
Because clients capable of generating dual key pairs use the transport certificate for
encrypting end users' encryption private keys before sending them to the Data
Recovery Manager, you must update the appropriate enrollment or key archival
page to identify and use the new transport certificate. Otherwise, the Data
Recovery Manager will fail to archive users' encryption private keys.
In general, here's what you need to do:
Locate the enrollment page that embeds the key archival feature.
1.
View the HTML source, and identify the parameter that corresponds to the
2.
Data Recovery Manager's transport certificate.
The default enrollment forms for end users embed this feature. Figure 14-2
shows the default directory-based user enrollment form with the transport
certificate-related information. (For more information, see "Step C. Customize
the Certificate Enrollment Form" on page 733.)
472
Netscape Certificate Management System Installation and Setup Guide • March 2002
If you don't find the CA certificate, add it to the database as a trusted CA.
For instructions on adding a CA certificate to the trust database of a
subsystem, see "Installing a New CA Certificate in the Certificate
Database" on page 487.
If you find the CA certificate, verify its trust status. If it is untrusted,
change the status to trusted. For instructions on changing the trust setting
of a CA certificate, see "Changing the Trust Settings of a CA Certificate" on
page 485.
Advertisement
Table of Contents
