Tokens For Storing Cms Keys And Certificates; Internal Token; External Token - Netscape MANAGEMENT SYSTEM 6.1 - ADMINISTRATOR Administrator's Manual

Tokens for Storing CMS Keys and Certificates

Tokens for Storing CMS Keys and Certificates
A token is a hardware or software device that performs cryptographic functions
and optionally stores public-key certificates, cryptographic keys, and data defined
by the application using the cryptographic services. Alternatively, a token can also
be considered as a device that you can use to generate and store your key pairs and
corresponding certificates.
Certificate Management System defines two types of tokens, internal and external,
for storing key pairs and certificates that belong to the Certificate Manager,
Registration Manager, Data Recovery Manager, and Online Certificate Status
Manager.
NOTE

Internal Token

An internal (software) token refers to a pair of software files, usually called
certificate database and key database, that Certificate Management System uses to
generate and store its key pairs and certificates. Certificate Management System
automatically generates these files in the file system of its host machine when you
choose to use the internal token for the first time. These files were created for you
during CMS installation if you chose to use the internal token for key-pair
generation.
In the CMS host system, the certificate database is identified by the name
cert-<instance_id>-<machine_name>-cert8.db
by the name
these files in the

External Token

An external (hardware) token refers to an external hardware device, such as a
smart card, FORTEZZA card, or other crypto card, that Certificate Management
System uses to generate and store its key pairs and certificates. Certificate
Management System supports any hardware tokens that are compliant with
PKCS#11 version 2.01. For details, see the information provided at this URL:
316 Netscape Certificate Management System Administrator's Guide • February 2003
Only those who have the password that protects a token can access
it. For information on changing this password, use the
tool. The documentation for the tool can be found here:
http://www.mozilla.org/projects/security/pki/nss/tools/
cert-<instance_id>-<machine_name>-key3.db
<server_root>/alias
; the key database is identified
directory.
certutil
. You can find both