Previous Next Topics

Certificate Management System Help



Using Netscape Certificate Management System

With Netscape Certificate Management System, you can perform the following tasks:

For an introduction to basic terms and concepts, see "Understanding Certificates."


User Enrollment
Certificate Management System provides forms that support three kinds of user enrollment: manual (based on explicit approval by someone who verifies the user's identity), directory-based enrollment (based on user information in an LDAP directory), and directory- and PIN-based enrollment (based on user information and an identifying PIN number in a directory). Additional enrollment forms may be available at your site.

Manual User Enrollment
When you enroll manually, you submit all the information Certificate Management System needs to create a certificate for you. This information is then evaluated by a person who may use a variety of means to confirm your identity (physical proof, information gathered over the telephone, and so on). This person then decides whether to issue the certificate. Because you must wait for someone to review and approve your request, it can take some time before your certificate is issued.

Fill out the enrollment form as directed. If you are not sure how to supply some of the information, ask your system administrator. When you are sure everything is correct, click the Submit button at the bottom of the form.

When the enrollment request is approved, you will receive an email notification that includes the certificate and instructions for importing it into your browser.

For an introduction to basic terms and concepts, see "Understanding Certificates."

About the Form Elements
The form you see is customized for your site and may not include all the elements explained here.

Organization Unit, Organization, and Country

These attributes are combined with your name and login ID to form a unique identifier called your distinguished name. Ask your system administrator for specific designations for your organization unit and organization. Depending on how your system is configured, you may not need to provide all of these attributes.

Additional Comments

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.

Key-length Information

The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with. If you are not sure what key length to use, ask your system administrator.

Directory-Based User Enrollment
If your organization has a Lightweight Directory Access Protocol (LDAP) directory, the directory contains much of the information that Certificate Management System needs to verify your identity and issue a certificate. The directory-based user enrollment form uses such a directory.

Fill out the enrollment form as directed. If you are not sure how to supply some of the information, ask your system administrator. When you are sure everything is correct, click the Submit button at the bottom of the form.

Upon receiving the request and confirming the information you provided with an LDAP directory, Certificate Management System issues the certificate automatically and immediately. If the certificate is successfully issued, your new certificate will appear in a browser window, along with instructions on how to import it into your browser.

For an introduction to basic terms and concepts, see "Understanding Certificates."

About the Form Elements
The form you see is customized for your site and may not include all the elements explained here.

IMPORTANT NOTICE TO ADMINISTRATORS

If you see text at the top of the form that says IMPORTANT NOTICE TO ADMINISTRATORS, you should immediately contact your system administrator. If this text is present, the form probably won't work, and your administrator may not have set up Certificate Management System and the LDAP directory correctly.

Key-length Information

The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with. If you are not sure what key length to use, ask your system administrator.

Directory- and PIN-Based Enrollment
If your organization has a Lightweight Directory Access Protocol (LDAP) directory, the directory contains much of the information that Certificate Management System needs to verify your identity and issue a certificate. Before you enroll, your system administrator sends you a unique personal identification number (PIN) that helps guarantee your identity. This is the number you must enter in the enrollment form.

Fill out the enrollment form as directed, using the PIN you have received. If you are not sure how to supply some of the information, ask your system administrator. When you are sure everything is correct, click the Submit button at the bottom of the form.

Upon receiving the request and confirming the information you provided, Certificate Management System issues the certificate automatically and immediately. If the certificate is successfully issued, your new certificate will appear in a browser window, along with instructions on how to import it into your browser.

For an introduction to basic terms and concepts, see "Understanding Certificates."

About the Form Elements
The form you see is customized for your site and may not include all the elements explained here.

IMPORTANT NOTICE TO ADMINISTRATORS

If you see text at the top of the form that says IMPORTANT NOTICE TO ADMINISTRATORS, you should immediately contact your system administrator. If this text is present, the form probably won't work, and your administrator may not have set up Certificate Management System and the LDAP directory correctly.

Key-length Information

The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with. If you are not sure what key length to use, ask your system administrator.


Server Enrollment
Certificate Management System provides forms that support three kinds of server enrollment: manual (based on explicit approval by someone who verifies the server's identity) and directory-based (based on server information in an LDAP directory). Additional enrollment forms may be available at your site.

Server Certificate Enrollment (for Server Administrators)
This form is intended for use by server administrators. Before a server can support the Secure Sockets Layer (SSL) protocol for authentication, encryption, and tamper detection, it must have an SSL server certificate.

When you enroll manually for an SSL server certificate, you submit all the information Certificate Management System needs to create the certificate. This information is then evaluated by a person who may use a variety of means to confirm your identity (physical proof, information gathered over the telephone, and so on). This person then decides whether to issue the certificate. Because you must wait for someone to review and approve your request, it can take some time before your certificate is issued.

Fill out the enrollment form as directed. If you are not sure how to supply some of the information, ask your system administrator. When you are sure everything is correct, click the Submit button at the bottom of the form.

When the enrollment request is approved, you will receive an email notification that includes either the certificate itself or a URL at which you can find the certificate. You must copy the encoded certificate and import it into your server. (For a Netscape server, use the administration forms provided by the Administration Server associated with your server.)

About the Form Elements
The form you see is customized for your site and may not include all the elements explained here.

PKCS #10 Request

Server Administrator Contact Information

This information is used to verify your identity and to direct the certificate to you when it is issued.

Additional Comments

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.

Directory-Based Server Enrollment (for Server Administrators)
This form is intended for use by server administrators. Before a server can support the Secure Sockets Layer (SSL) protocol for authentication, encryption, and tamper detection, it must have an SSL server certificate. If your organization has a Lightweight Directory Access Protocol (LDAP) directory, the information that Certificate Management System needs to verify your identity and issue such a certificate can be stored in the directory.

Fill out the enrollment form as directed. If you are not sure how to supply some of the information, ask your system administrator. When you are sure everything is correct, click the Submit button at the bottom of the form.

Upon receiving the request, Certificate Management System issues the certificate automatically and immediately. If the certificate is successfully issued, your new certificate will appear in a browser window. You must copy the encoded certificate and import it into your server. (For a Netscape server, use the administration forms of the Administration Server associated with your server.)

About the Form Elements
The form you see is customized for your site and may not include all the elements explained here.

IMPORTANT NOTICE TO ADMINISTRATORS

If you see text at the top of the form that says IMPORTANT NOTICE TO ADMINISTRATORS, you should immediately contact your system administrator. If this text is present, the form probably won't work, and your administrator may not have set up Certificate Management System and the LDAP directory correctly.

PKCS #10 Request

Server Administrator Information

This information is used to find your entry in the directory and to identify you in case an administrator needs to contact you.

Additional Comments

You may be able to provide comments that will help your system administrator to track or identify your enrollment request.


Registration Manager Enrollment
This form is intended for use by agents who are managing a Certificate Management System Registration Manager. Registration Managers must have a signing certificate issued by the Certificate Manager for which the Registration Manager is handling end-entity interactions. This form allows Registration manager agents to enroll for such a certificate. This type of enrollment is always manual; that is, the request must be approved by the human agent responsible for the Certificate Manager.

Fill out the enrollment form as directed. When the enrollment request is approved, you will receive an email notification that includes the certificate or a URL at which you can find the certificate. You must copy the certificate and import it into the Registration Manager from the CMS window in Netscape Console.

About the Form Elements
The form you see is customized for your site and may not include all the elements explained here.

PKCS #10 Request

The PKCS #10 certificate request that you need to paste here is created during installation of the Registration Manager.

Server Administrator Contact Information

This information is used to identify you in case the administrator needs to contact you and to direct the certificate to you when it is issued.

Additional Comments

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.


Certificate Manager Enrollment
This form is intended for use by agents who are managing a Certificate Management System Certificate Manager that is to be used as a subordinate CA. A Certificate Manager that functions as a subordinate CA must have a signing certificate issued by the Certificate Manager to which it is subordinate. This type of enrollment is always manual; that is, the request must be approved by the human agent responsible for the Certificate Manager that will be issuing the certificate.

Fill out the enrollment request form as directed. When the enrollment request is approved, you will receive an email notification that includes the certificate or a URL at which you can find the certificate. You must copy the certificate and import it into the subordinate Certificate Manager, using Netscape Console's CMS window.

About the Form Elements
The form you see is customized for your site and may not include all the elements explained here.

PKCS #10 Request

The PKCS #10 certificate request that you need to paste here is created during installation of the Certificate Manager for which you are requesting a signing certificate.

Server Administrator Information

This information is used to find your entry in the directory and to identify you in case an administrator needs to contact you.

Additional Comments

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.


Object Signing Enrollment
This form is intended for use by administrators or software developers who want to enroll for an object-signing certificate. Object-signing certificates are used to create digital signatures that can be attached to software objects such as Java applets. Digital signatures provide recipients of such objects with some assurance that you are really the person or company responsible for the object, rather than an imposter.

This type of enrollment is always manual. After you submit all the information Certificate Management System needs to create an object-signing certificate for you, the information is evaluated by a person who may use a variety of means to identify you (physical proof, information gathered over the telephone, and so on). This person then decides whether to issue the certificate. Because you must wait for someone to review and approve your request, it can take some time before your certificate is issued.

Fill out the enrollment request form as directed. If you are not sure how to supply some of the information, ask your system administrator.

When the enrollment request is approved, you will receive an email notification that includes the certificate and instructions for importing it into your browser.

About the Form Elements
The form you see is customized for your site and may not include all the elements explained here.

Organization Unit, Organization, and Country

These attributes are combined with your name and login ID to form a unique identifier called your distinguished name. Ask your system administrator for specific designations for your organization unit and organization. Depending on how your system is configured, you may not need to provide all of these attributes.

Key-length Information

The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with. If you are not sure what key length to use, ask your system administrator.

Additional Comments

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.


User Certificate Renewal
Certificates have a starting date and an expiration date, just like your driver's license and credit cards. When the expiration date of your certificate approaches, you must renew the certificate.

You may receive an email notification that a certificate is about to expire and must be renewed. The message may include a link to this page, which you use to request the renewal.

Be sure you are renewing the certificate from the same computer and browser that you used when you acquired the certificate. This is the computer on which your private key is stored.

You cannot use this form unless you have reached it via the URL for the HTTPS port of Certificate Management System. The URL in the Location field near the top of the window in which the form appears should begin with https://. If it doesn't, the form won't work, and you should ask your system administrator for the correct URL.

For an introduction to basic terms and concepts, see "Understanding Certificates."


User Certificate Revocation
You may need to revoke a certificate if, for example, it is superseded by another one or if you no longer use the service for which it is required.

To revoke any certificate, you must present that certificate to identify yourself.

For an introduction to basic terms and concepts, see "Understanding Certificates."

About the Form Elements
The form you see is customized for your site and may not include all the elements explained below.

Revocation Reason

Select the reason for the revocation. The reason is stored with the revoked certificate, where it can be reviewed by an administrator.


Certificate Retrieval
You may need to find one or more certificates. For example, if you want to send encrypted email, you must have the recipients' certificates. The retrieval feature lets you search for any certificate that is in the Certificate Management System database.

The Retrieval tab allows you to perform the following tasks:

For an introduction to basic terms and concepts, see "Understanding Certificates."

List Certificates
This form allows you to list certificates by serial number.

For an introduction to basic terms and concepts, see "Understanding Certificates."

About the Form Elements
The form you see is customized for your site and may not include all the elements explained here.

Serial Number Range

You can enter a serial number in hexadecimal form, as it appears in the certificate display (a number preceded by 0x), or in decimal form.

If you are searching within a range of serial numbers, you can choose to filter out certificates that are not currently valid. To do so, click one or both of the checkboxes at the bottom of the form.

Search Certificates
Use the form as directed. It is quite long; scroll down to see the different sections. When you have specified the search criteria, scroll to the bottom of the form and click Find.

For an introduction to basic terms and concepts, see "Understanding Certificates."

About the Form Elements
The form you see is customized for your site and may not include all the elements explained here.

Serial Number Range

You can enter a serial number in hexadecimal form, as it appears in the certificate display (a number preceded by 0x), or in decimal form.

Subject Name

Enter values for one or more of these fields to find certificates by their owner information. When you have entered the field values for the server to match, go to the bottom of this section to specify the type of search (Exact or Partial) that you want performed.

Revocation Information

Find certificates that have been revoked during a particular period or by a particular agent. For example, you can search for all certificates revoked between July 1996 and January 1997, or all certificates revoked by the agent with the user name admin.

Issuing Information

Find certificates that have been issued during a particular period or by a particular agent. For example, you can search for all certificates issued between July 1996 and January 1997, or all certificates issued by the agent with the user name betatest.

Dates of Validity

Find certificates that become effective or expire during a particular period. For example, you can list all certificates that became valid on June 1, 1996, or that will expire between January 1, 2001 and June 1, 2001.

You can also list certificates that have a validity period of a certain length of time. For example, you can list all certificates that are valid for less than one month.

Type

Find certain types of certificates—that is, those that are intended for a particular use. For example, you can search for all certificates for subordinate CAs.

For each usage type, choose whether to find certificates where that type is On, Off, or Absent. If you leave the usage type blank, that type is not considered in the search.

Note. The type search works only for certificates containing the netscape-cert- type extension, which stores type information.


Import CA Certificate Chain
Before you can use any certificate that you receive, the certificate authority (CA) that signed it must be in your browser's list of trusted CAs. That CA's certificate may in turn be signed by another CA. There can be a whole chain of subordinate CAs, all the way to a root CA. At least one of the CAs in the chain must be trusted in order for you to use the certificate. To add a CA to your list of trusted CAs, you import the CA's certificate or certificate chain into your browser.

When you begin to use Netscape Certificate Management System as your local CA, you must import its certificate chain into your browser in order to use certificates that it issues. Similarly, if you are a server administrator, you must import the certificate chain into the server in order for that server to accept client authorization certificates signed by that Certificate Management System.

Use this form to import the certificate chain for Certificate Management System into your browser or into a server you manage. You need to do this only once, when you first begin using Certificate Management System.

For an introduction to basic terms and concepts, see "Understanding Certificates."

About the Form Elements
The form you see is customized for your site and may not include all the elements explained below.

Import the CA certificate chain into your browser

This imports the certificate chain for Certificate Management System into your browser's list of trusted CAs. This option works for most browsers.

Download the CA certificate chain in binary form

If your browser does not use the standard importation format or procedure, use this option to save the chain as a binary file and import it by some other method.

Display the CA certificate chain for importing into a server

This displays the entire certificate chain on your screen in PKCS #7 format, so that you can copy and paste it to import it into a server you manage. For Netscape servers, use the Administration Server associated with the server to import the chain.

Display certificates in the CA certificate chain for importing individually into a server

For a server that does not accept the PKCS #7 format for certificate chains, this displays each certificate in the chain separately, so that you can import each one into the server.


Import Certificate Revocation List
Your browser may automatically import the latest certificate revocation list (CRL) from an LDAP directory that receives regular updates from Netscape Certificate Management System, and it may automatically check all certificates against the CRL to ensure that they have not been revoked. If your browser does not do this automatically, or if you have reason to believe that the CRL is out of date (if your computer or the LDAP directory has been down, for example), use this form to check the master CRL or update the browser's version.

For an introduction to basic terms and concepts, see "Understanding Certificates."

About the Form Elements
The form you see is customized for your site and may not include all the elements explained below.

Check whether the following certificate is revoked

Use this option to manually check the revocation status of a particular certificate if you are not sure whether you have the latest version of the CRL. Enter the serial number of the certificate in decimal form, or in hexadecimal form (preceded by 0x) as it appears in the certificate display.

Import the latest CRL to your Netscape Navigator

If you are using Netscape Navigator or Netscape Communicator, use this option to automatically download and import the latest version of the CRL into your browser.

Download the latest CRL in binary form

If you are not using Netscape Navigator or Netscape Communicator, use this option to save a binary form of the latest CRL to a local file. You can import this file into your browser by whatever method is appropriate.

Display the CRL header information

The header of the master CRL published by Certificate Management System contains the date and time of the latest update. You can compare this information to that in your browser's CRL to see if you have the latest version.

 

© Copyright 1999 Netscape Communications Corp., a subsidiary of America Online, Inc. All rights reserved.