Managing Tokens Used By The Subsystems - Netscape MANAGEMENT SYSTEM 6.1 - ADMINISTRATOR Administrator's Manual

Managing Tokens Used by the Subsystems

There are two main tasks involved in managing the tokens used by Certificate
Management System:
• Viewing Tokens
• Changing a Token's Password
Viewing Tokens
To view a list of the tokens currently installed for a CMS instance:
Log in to the CMS window (see "Logging Into the CMS Console" on page 247).
1.
Select the Configuration tab, and then in the right pane, select the Encryption
2.
tab.
In the Map To section, check the Token drop-down list.
3.
It shows the names (as specified when the tokens were installed) of external
tokens installed for the currently selected CMS instance. For information on
installing external tokens, see "External Token" on page 316.
Changing a Token's Password
The token, internal or external, that stores the key pairs and certificates for the
subsystems is protected (encrypted) by a password. To decrypt the key pairs or to
gain access to them, you must enter that password. The first time you specified this
password is when you used the token the first time, most likely during CMS
installation.
It is good security practice to periodically change the password that protects your
server's keys and certificates; changing the password periodically minimizes the
risk of someone finding out the password. To change a token's password, use the
command-line utility, the documentation for which can be found at this
certutil
site:
http://www.mozilla.org/projects/security/pki/nss/tools/
Note that the single sign-on password cache stores the passwords for tokens in
order to start the server using a single password; for details, see "Starting,
Stopping, and Restarting CMS Instances" on page 254. Whenever you change the
password, the cache is updated with the new password.
Tokens for Storing CMS Keys and Certificates
Chapter 7 Administrative Basics 319