Certificate-Based Enrollment
52
Netscape Certificate Management System Plug-Ins Guide • March 2002
•
doSslAuth
—this variable specifies whether the server should request the client
for SSL client authentication. You must set the value of this parameter to
on
and make sure that the port number specified in the authentication instance is
an SSL port.
Before modifying a form, be sure to take a look at the default certificate-based
enrollment forms. Also check the customization-related information for the
enrollment forms in CMS Customization Guide.
In addition to the enrollment forms, a policy plug-in named
IssuerConstraints
is
also provided; see “IssuerConstraints Plug-in Module” on page 94. This plug-in
allows you to configure the server to recognize the CA that issues the certificates
that your users will use for authentication purposes; you need this policy to ensure
that the CA issues certificates only to those users who present a valid certificate
during enrollment. Note that in the current implementation, the CA that issues the
new certificates must be the same as the one that issues the certificates users will
use for authentication. That is, the issuer DN in the authentication certificate must
match the issuer DN specified in the policy configuration.
Here are a few things to keep in mind:
•
Enrollment requests for dual certificates must be submitted directly to the
Certificate Manager; the Registration Manager doesn’t support generation of
dual certificates.
•
The Certificate Manager provides a bulk-enrollment interface, which can be
used to preload keys and certificates on hardware tokens before distributing
them to users for certificate enrollment. For details, see section “Bulk
Enrollment Interface” of CMS Customization Guide.
•
When using certificate-based enrollment, the
IssuerConstraints
policy must
be enabled and configured to check the CA (its issuer DN) in certificates users
will use to authenticate to the server. Also, the value assigned to the
issuerDN
parameter must match the issuer DN of the CA that was used to generate
hardware tokens in bulk.
•
Enabling certificate-based enrollment creates one link, named
Certificate
,
under the list of user-enrollment links in the end-entity enrollment interface.
By default, the link points to the
CertBasedDualEnroll.html
form. If you
want to use either of the other two forms,
CertBasedEncryptionEnroll.html
or
CertBasedSingleEnroll.html
, you should associate the
Certificate
link
to the form you want to use or add more links to the
index.html
file.
Summary of Contents for Certificate Management System 6.0
Page 1: ...Plug Ins Guide Netscape Certificate Management System Version6 0 March 2002...
Page 10: ...10 Netscape Certificate Management System Plug Ins Guide March 2002...
Page 62: ...Enrollment Forms 62 Netscape Certificate Management System Plug Ins Guide March 2002...
Page 308: ...NTEventLog Plug in Module 308 Netscape Certificate Management System Plug Ins Guide March 2002...
