Privileged-User Types and Responsibilities
Chapter
13
Managing Privileged Users and Groups
375
Agent’s Certificate for SSL Client Authentication
To make a user an agent for a subsystem, one of the things you must do is store the
user’s client (personal) certificate information in the internal database of the
subsystem. For example, if you set up an agent for a Certificate Manager, you store
the agent’s client certificate in the internal database of that Certificate Manager.
Then, when the subsystem receives a request from the agent, it uses this certificate
to verify the authenticity of the request before servicing it. For details on how the
subsystem verifies the authenticity of a request from an agent, see “Authentication
of Agents” on page 492.
If the user you want to set up as an agent does not own a client certificate, ask the
user to get one. Depending on your company’s PKI policy, the user could get the
client certificate from either an internally deployed CA or any public CA.
Keep in mind that the CA that signs your agents’ certificates must be trusted by the
subsystem that processes requests sent by these agents; for example, if your
subsystems are set up not to trust public CAs, your agents should not get their
certificates signed by public CAs. Make sure that the CA’s certificate exists in the
subsystem’s certificate or trust database and that the certificate is valid and trusted.
To check whether or not the CA’s certificate exists in a subsystem’s trust database,
follow the instructions in “Viewing the Certificate Database Content” on page 482.
•
If the CA’s certificate isn’t listed, follow the instructions in “Using the Wizard
to Install a Certificate or Certificate Chain” on page 452 and add the certificate
to the subsystem’s certificate database.
•
If the CA’s certificate is listed but untrusted, follow the instructions in
“Changing the Trust Settings of a CA Certificate” on page 485 and change the
setting to trusted.
Getting an Agent’s Certificate from a Public CA
The following general guidelines explain how a user can get a client certificate
from a public CA and how you can copy that certificate (in base-64 encoded form)
to the internal database of the appropriate subsystem:
1.
The user sends a client certificate request to the public CA from the client
machine that he or she will use to access the subsystem from the Agent
Services interface. It is important that the user generate and submit this request
from the machine she or he will use later to access the subsystem, because part
of this request process generates a private key on the local machine.
Alternatively, if location independence is required, the user can use a
hardware token, such as a smart card, to generate and store the key pair (and
the certificate when the user receives it from the public CA).
Summary of Contents for NETSCAPE MANAGEMENT SYSTEM 6.0
Page 1: ...Installation and Setup Guide Netscape Certificate Management System Version6 0 March 2002...
Page 22: ...22 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 32: ...32 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 160: ...160 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 776: ...776 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 807: ...807 Part 5 Appendix Appendix A Certificate Download Specification...
Page 808: ...808 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 830: ...830 Netscape Certificate Management System Installation and Setup Guide March 2002...
