Step 2. Set Up The Directory For Publishing; Step A. Verify The Directory Schema - Netscape MANAGEMENT SYSTEM 6.01 Installation And Setup Manual

Configuring a Certificate Manager to Publish Certificates and CRLs

Step 2. Set Up the Directory for Publishing

For a Certificate Manager to publish certificates and CRLs to an LDAP directory,
the directory needs to be set up to receive certificate- and CRL-related information
from the Certificate Manager.
•

Step A. Verify the Directory Schema

• Step B. Add an Entry for the CA
• Step C. Identify an Entry That Has Write Access
• Step D. Verify Entries for End Entities
• Step E. Specify the Directory Authentication Method
• Step F. Modify the Certificate Mapping File
• Step G. Restart Directory Server
Step A. Verify the Directory Schema
For a Certificate Manager to publish certificates and CRLs to a directory, it must be
configured with specific attributes and object classes. This section discusses those
basic schema requirements. Is it assumed that you're familiar with directory
schema and related terminology. If you're not, check the Netscape Directory Server
documentation.
Required Schema for Publishing End-Entity Certificates
The Certificate Manager publishes an end entity's certificate to the
userCertificate;binary
object. This attribute is multivalued; each value is a DER encoded binary X.509
certificate. The LDAP object class named
object class is supported by Directory Server versions 1.0, 3.x, 4.x, and later. The
mix-in object class named
can be combined with any other object class to allow certificate publication to that
object. Note that the Certificate Manager does not automatically add this object
class to the schema table of the corresponding Directory Server while publishing or
unpublishing end-entity certificates. If the directory object that it finds does not
allow the
specific certificate fails.
If you have created user entries as
attribute already exists in the directory. Otherwise, you must add the
userCertificate;binary
information on modifying directory schema, check the Directory Server
documentation.
598 Netscape Certificate Management System Installation and Setup Guide • May 2002
attribute within the end entity's or subject's directory
strongAuthenticationUser
userCertificate;binary
attribute to your directory's schema table. For
inetOrgPerson
attribute, the addition or removal of that
, the
inetOrgPerson userCertificate;binary
allows this attribute. This
allows this attribute and