Configuring a Certificate Manager to Publish Certificates and CRLs
Chapter
19
Setting Up LDAP Publishing
597
•
Identify your publishing directory. If you’ve already configured the Certificate
Manager to use an LDAP directory for authenticating users (for example, if
you’re using the directory-based or directory- and PIN-based authentication),
you should consider publishing certificates and CRLs to the same directory.
This way, users’ security credentials will be kept with the rest of the user
information.
•
Note the following information for the directory: the host name, the port
number, and the port type—whether it’s an SSL or nonSSL port.
•
Determine how you want the Certificate Manager to authenticate to the
directory: whether to publish with basic authentication, publish over SSL
without SSL client authentication, or publish over SSL with SSL client
authentication. Accordingly, you will need to configure the Directory Server.
•
If you want the Certificate Manager to authenticate to the directory using SSL
client authentication, determine the certificate the Certificate Manager must
use for SSL client authentication; see “Certificate Manager’s Key Pairs and
Certificates” on page 421. By default, the server uses its SSL server certificate;
see “SSL Server Key Pair and Certificate” on page 425.
Depending on your PKI setup, you may use an external CA for requesting the
certificate. For example, if your Certificate Manager is a subordinate CA to an
external CA, you can get the Directory Server’s certificate signed by the same
CA that signed your Certificate Manager’s certificate.
•
If certificates the Directory Server and Certificate Manager will use during
SSL-enabled communication already exist, check the CA that issued these
certificates. The CA that issued the Directory Server’s SSL server certificate
must be trusted by the Certificate Manager. Similarly, the Directory Server
must trust the CA that issued the certificate the Certificate Manager will use for
client authentication.
•
Determine how you want the Certificate Manager to bind to the directory:
whether to bind as
CN=Directory Manager
or as another user; if it’s another
user, the entry must have read-write privileges to the directory tree that
contains entries for end-entities to whom you intend to issue certificates.
•
If you’re not the directory administrator, consult the directory administrator
about making changes to the schema, if required.
•
Keep your directory documentation handy. For Netscape Directory Server
documentation, check this site:
http://enterprise.netscape.com
Summary of Contents for NETSCAPE MANAGEMENT SYSTEM 6.0
Page 1: ...Installation and Setup Guide Netscape Certificate Management System Version6 0 March 2002...
Page 22: ...22 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 32: ...32 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 160: ...160 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 776: ...776 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 807: ...807 Part 5 Appendix Appendix A Certificate Download Specification...
Page 808: ...808 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 830: ...830 Netscape Certificate Management System Installation and Setup Guide March 2002...
