Certificate Management System Help
Using Netscape Certificate Management System With Netscape Certificate Management System, you can perform the following tasks:
With Netscape Certificate Management System, you can perform the following tasks:
User EnrollmentServer EnrollmentRegistration Manager EnrollmentCertificate Manager EnrollmentObject Signing EnrollmentUser Certificate RenewalUser Certificate RevocationCertificate RetrievalImport CA Certificate ChainImport Certificate Revocation List
Manual User EnrollmentDirectory-Based User EnrollmentDirectory- and PIN-Based Enrollment
These attributes are combined with your name and login ID to form a unique identifier called your distinguished name. Ask your system administrator for specific designations for your organization unit and organization. Depending on how your system is configured, you may not need to provide all of these attributes.
You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.
The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with. If you are not sure what key length to use, ask your system administrator.
If you see text at the top of the form that says IMPORTANT NOTICE TO ADMINISTRATORS, you should immediately contact your system administrator. If this text is present, the form probably won't work, and your administrator may not have set up Certificate Management System and the LDAP directory correctly.
The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with. If you are not sure what key length to use, ask your system administrator. Directory- and PIN-Based Enrollment If your organization has a Lightweight Directory Access Protocol (LDAP) directory, the directory contains much of the information that Certificate Management System needs to verify your identity and issue a certificate. Before you enroll, your system administrator sends you a unique personal identification number (PIN) that helps guarantee your identity. This is the number you must enter in the enrollment form.
Server Certificate Enrollment (for Server Administrators)
Directory-Based Server Enrollment (for Server Administrators)
If you are the administrator for a Netscape server, create the PKCS #10 request using the Administration Server associated with the server for which you are requesting a certificate. In the Administration Server's administration forms, choose Encryption, then choose Request Server Certificate.
If you are not using a Netscape server, use your server's tools for creating a PKCS#10 request.
This information is used to verify your identity and to direct the certificate to you when it is issued.
If you are not using a Netscape server, use your server's tools for creating a PKCS #10 request.
This information is used to find your entry in the directory and to identify you in case an administrator needs to contact you.
You may be able to provide comments that will help your system administrator to track or identify your enrollment request.
The PKCS #10 certificate request that you need to paste here is created during installation of the Registration Manager.
This information is used to identify you in case the administrator needs to contact you and to direct the certificate to you when it is issued.
The PKCS #10 certificate request that you need to paste here is created during installation of the Certificate Manager for which you are requesting a signing certificate.
Select the reason for the revocation. The reason is stored with the revoked certificate, where it can be reviewed by an administrator.
List Certificates: Retrieve certificates by serial number Search Certificates: Find certificates by their owner or validity information. Import CA Certificate Chain: Retrieve the Certificate Manager's own identifying certificate.Import Certificate Revocation List: Review or update your local copy of the certificate revocation list (CRL).
You can enter a serial number in hexadecimal form, as it appears in the certificate display (a number preceded by 0x), or in decimal form.
If you know the specific serial number of the certificate you want, enter it in both the "Lowest Serial Number" and "Highest Serial Number" fields.
To find all certificates within a range of serial numbers, enter the lowest and highest numbers of the range. If you leave either the lower limit or upper limit field blank, all certificates before or after the one you specify are displayed.
If you are searching within a range of serial numbers, you can choose to filter out certificates that are not currently valid. To do so, click one or both of the checkboxes at the bottom of the form.
Enter values for one or more of these fields to find certificates by their owner information. When you have entered the field values for the server to match, go to the bottom of this section to specify the type of search (Exact or Partial) that you want performed.
Email address. Narrow the search by email address.
Common name. Find certificates associated with a specific person or server.
UserID. The UserID for the person whose certificate you want to find. For example, at many companies the UserID is the name used to log in to the network when starting up a computer.
Organization unit. Narrow the search to a specific division, department, or unit within an organization.
Organization. Narrow the search to a specific business, university, or organization.
Locality. Narrow the search to a local area (for example, the name of a city).
State. Narrow the search to a state or province.
Country. Narrow the search by country. Enter a two-letter code (for example, US).
If you select the Partial match method, you can specify wildcard patterns by using the question mark character (?) to match an arbitrary single character and the asterisk character (*) to match an arbitrary string of zero or more characters. A single asterisk in a field specifies that the corresponding component must be in the certificate's subject name but may have any value. A blank field indicates that you do not care if the component is present.
Find certificates that have been revoked during a particular period or by a particular agent. For example, you can search for all certificates revoked between July 1996 and January 1997, or all certificates revoked by the agent with the user name admin.
To find certificates revoked within a particular time period, select the day, month, and year from the drop-down lists to identify the beginning and ending dates.
To find certificates revoked by a particular agent, enter the name of the agent. You can use wildcards in this field.
Find certificates that have been issued during a particular period or by a particular agent. For example, you can search for all certificates issued between July 1996 and January 1997, or all certificates issued by the agent with the user name betatest.
To find certificates issued within a time period, select the day, month, and year from the drop-down lists to identify the beginning and ending dates.
To find certificates issued by a particular agent, enter the name of the agent. You can use wildcards in this field.
Find certificates that become effective or expire during a particular period. For example, you can list all certificates that became valid on June 1, 1996, or that will expire between January 1, 2001 and June 1, 2001.
You can also list certificates that have a validity period of a certain length of time. For example, you can list all certificates that are valid for less than one month.
To find certificates that become effective or expire within a time period, select the day, month, and year from the drop-down lists to identify the beginning and ending dates.
To find certificates that have a validity period of a certain length of time, select "Not greater" or "Not less" from the drop-down list, enter a number, and select a time unit from the drop-down list: Days, Weeks, Months, or Years.
Find certain types of certificatesthat is, those that are intended for a particular use. For example, you can search for all certificates for subordinate CAs.
For each usage type, choose whether to find certificates where that type is On, Off, or Absent. If you leave the usage type blank, that type is not considered in the search.
This imports the certificate chain for Certificate Management System into your browser's list of trusted CAs. This option works for most browsers.
If your browser does not use the standard importation format or procedure, use this option to save the chain as a binary file and import it by some other method.
This displays the entire certificate chain on your screen in PKCS #7 format, so that you can copy and paste it to import it into a server you manage. For Netscape servers, use the Administration Server associated with the server to import the chain.
For a server that does not accept the PKCS #7 format for certificate chains, this displays each certificate in the chain separately, so that you can import each one into the server.
Use this option to manually check the revocation status of a particular certificate if you are not sure whether you have the latest version of the CRL. Enter the serial number of the certificate in decimal form, or in hexadecimal form (preceded by 0x) as it appears in the certificate display.
If you are using Netscape Navigator or Netscape Communicator, use this option to automatically download and import the latest version of the CRL into your browser.
If you are not using Netscape Navigator or Netscape Communicator, use this option to save a binary form of the latest CRL to a local file. You can import this file into your browser by whatever method is appropriate.
The header of the master CRL published by Certificate Management System contains the date and time of the latest update. You can compare this information to that in your browser's CRL to see if you have the latest version.