Cryptographic Token Decisions
Chapter
4
Planning Your Deployment
173
•
Renewing a CA certificate
involves issuing a new CA certificate with the same
subject name and public and private key material as the old CA certificate, but
with an extended validity period. As long as the new CA certificate is
distributed to all users well before the old CA certificate expires, this approach
allows certificates issued under the old CA certificate to continue working for
the full duration of their validity periods. However, because of potential
conflicts between the old CA certificate and the new CA certificate, this
approach requires special care with early versions of Communicator 4.x.
•
Reissuing a CA certificate
involves issuing a new CA certificate with a new
name, public and private key material, and validity period. This approach
avoids some of the problems associated with renewing a CA certificate, but it
requires more work for both administrators and users to implement. All
certificates issued by the old CA, including those that have not yet expired,
must be renewed by the new CA.
There are advantages and disadvantages to each approach. Correct use of
extensions, for example the
authorityKeyIdentifier
extension, can also affect
the transition from an old CA certificate to a new one. You should begin planning
for CA renewal or reissuance before you install any CMS managers; consider any
ramifications your planned procedures may have for extensions, policies, and
other aspects of your initial PKI deployment.
For information on certificate extensions, see Appendix C, “Certificate and CRL
Extensions” of CMS Plug-Ins Guide.
Cryptographic Token Decisions
As explained in “PKCS #11” on page 74, one or more PKCS #11 modules must be
available to any CMS instance. A PKCS #11 module, which can be implemented in
either software or hardware, manages cryptographic services such as encryption
and decryption. Netscape provides a built-in PKCS #11 module with Certificate
Management System; see “Installing External Tokens” on page 432.
A PKCS #11 module always has one or more slots, which can be implemented as
physical hardware slots in some form of physical reader (for example, for smart
cards) or as conceptual slots in software. Each slot for a PKCS #11 module can in
turn contain a token, which is the hardware or software device that actually
provides cryptographic services and optionally stores certificates and keys.
As shown in Figure 1-10 on page 74, the built-in PKCS #11 module for Certificate
Management System includes two tokens, one for cryptographic operations and
one for manipulating the key and certificate databases. You can accelerate
cryptographic operations such as the signing of new certificates by using
Summary of Contents for NETSCAPE MANAGEMENT SYSTEM 6.0
Page 1: ...Installation and Setup Guide Netscape Certificate Management System Version6 0 March 2002...
Page 22: ...22 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 32: ...32 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 160: ...160 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 776: ...776 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 807: ...807 Part 5 Appendix Appendix A Certificate Download Specification...
Page 808: ...808 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 830: ...830 Netscape Certificate Management System Installation and Setup Guide March 2002...
