Introduction
The Red Hat Certificate System creates, manages, renews, and deletes certificates and keys
within an organization. There are five subsystems which govern the behavior of the public-key
infrastructure (PKI) of the organization:
• The Certificate Authority (CA), which creates, renews, and revokes certificates.
• The Data Recovery Manager (DRM), which archives and recovers keys.
• The Online Certificate Status Manager, which stores lists of revoked certificates for client
applications to use to check if a certificate is valid.
• The Token Processing System (TPS), which interacts with smart cards to generate and store
keys and certificates for a specific user.
• The Token Key Service (TKS), which generates and stores master keys used by the TPS.
End users can use security tokens, which are also called smart cards, to store user certificates
used for applications such as single sign-on access and client authentication. End users are
issued the tokens containing certificates and keys required for signing, encryption, and other
cryptographic functions. To use the tokens, the TPS must be able to recognize and
communicate with them. The tokens have to be enrolled, the process of formatting tokens with
keys and certificates and adding them to the Certificate System. Enterprise Security Client
provides the user interface for end entities to enroll tokens and to communicate with the TPS.
Enterprise Security Client provides the conduit through which TPS communicates with each
token over a secure HTTP channel (HTTPS).
After a token is enrolled, applications such as Mozilla Firefox and Thunderbird can be
configured to recognize the token and use it for security operations, like client authentication
and S/MIME mail. Enterprise Security Client provides the following capabilities:
• Supports Visa Open Platform-compliant smart cards like Axalto Cyberflex egate 32k tokens.
• Enrolls security tokens so they are recognized by TPS.
• Maintains the security token, such as re-enrolling a token with TPS.
• Provides information about the current status of the token or tokens being managed.
• Supports server-side key generation so that keys can be archived and recovered on a
separate token if a token is lost.
1. Features
• The Phone Home feature defines the token issuer name, TPS server, and TPS end-entities
Chapter 1.
1
Summary of Contents for CERTIFICATE SYSTEM ENTERPRISE - SECURITY GUIDE
Page 2: ...Red Hat Certificate System Enterprise Security Client Guide ...
Page 4: ...Red Hat Certificate System Enterprise Security Client Guide ...
Page 6: ...vi ...
Page 10: ...4 ...
Page 12: ...6 ...
Page 18: ...Figure 3 5 Beginning Installation Chapter 3 Installation 12 ...
Page 26: ...20 ...
Page 59: ...Index 53 ...
Page 60: ...54 ...
