Netscape MANAGEMENT SYSTEM 6.1 - ADMINISTRATOR Administrator's Manual page 133

clone CA, assigning this user to the Trusted Manager Group, and storing the
SSL server certificate for the master CA in the user entry for the clone CA that
you just created. For details about setting up users, assigning them to groups,
and storing certificates for them, see Chapter 8, "Authorization."
Using the Master CA's Agent Certificate in Clone CAs
This step is optional.
The procedure below explains how to use the master Certificate Manager's agent
certificate for a clone Certificate Manager (instead of creating a new agent
certificates for clone CAs).
Go to the configuration directory of a cloned CA:
1.
<server_root>/cert-<instance_id>config
Open the configuration file (
2.
Locate this line:
3.
cmsgateway.enableAdminEnroll=true
Change the value to
4.
This configures the cloned CA in to a mode where it expects a certificate (that
was already issued and chains properly) to be presented when you access its
agent interface.
Restart the clone CA.
5.
Use Netscape Console and open the CMS window for the clone CA instance.
6.
Go to the "Users and Groups" section, create a new agent user, and add the
7.
master CA's agent certificate to the clone CA's certificate database.
To add the correct certificate, check the serial number of the master CA's agent
certificate; this certificate should already exist in one of the browsers that you
use to access the master CA's agent interface. Use the serial number to search
for the certificate in the master CA's certificate repository. Once you locate the
certificate, look for its base-64 encoded form, copy it, and then paste it as the
agent certificate in the clone CA.
For step-by-step instructions to create an agent user, see "Setting up
Administrators, Agents, and Auditors" on page 330.
After creating the agent entry for the clone CA, go to
8.
hostname>:<agent_port>
successfully.
Repeat the above steps for other clone CAs.
9.
) in a text editor.
CMS.cfg
:
false cmsgateway.enableAdminEnroll=false
to verify that you can access its agent interface
Cloning a CA
https://<cloneCA
Chapter 3 Certificate Manager 133