Netscape Certificate Management System 6.01, Manual

Page: 51 / 377

Certificate-Based Enrollment
Chapter 1 Authentication Plug-in Modules 51
To enable you to configure Certificate Management System for certificate-based
enrollment, the following three enrollment forms are provided:
•
CertBasedDualEnroll.htm
l—this form enables end users to request dual
certificates—one for signing another for encryption—by submitting pre-issued
certificates as authentication tokens; when a user enrolls for a certificate, the
server verifies the CA that has issued the certificate the user uses for
authentication, uses the configured directory to formulate subject names for
the new certificates, and issues the certificates.
•
CertBasedEncryptionEnroll.html
—this form is provided as a sample. It enables
end users to request encryption certificates by submitting pre-issued certificates as
authentication tokens; when a user enrolls for a certificate, the server verifies the CA
that has issued the certificate the user uses for authentication, uses the configured
directory to formulate the subject name for the new certificate, and issues the certificate.
•
CertBasedSingleEnroll.html
—this form is provided as a sample. It enables
end users to request signing certificates by submitting pre-issued certificates as
authentication tokens; when a user enrolls for a certificate, the server verifies
the CA that has issued the certificate the user uses for authentication, uses the
configured directory to formulate the subject name for the new certificate, and
issues the certificate.
Note that all three enrollment forms by default work with the directory-based
authentication module, named
UidPwdDirAuth
, explained in “UidPwdDirAuth
Plug-in Module” on page 22. You can use the certificate-based enrollment forms
with any of the authentication modules, for example, directory- and PIN-based or
NIS-server based authentication modules. However, this would require you to add
the necessary hidden fields or variables to enrollment form that’s provided for the
corresponding authentication module; check Table 1-6 on page 55 to figure out
which enrollment form works with which module.
In general, the following three hidden variables distinguish certificate-based
enrollment forms from other enrollment forms:
•
certauthEnroll
—this variable specifies whether certificate-based enrollment
is turned
on
or
off
.
•
certauthEnrollType
—this variable specifies one of the three
certificate-based-enrollment types:
dual
,
single
, or
encryption
;
dual
specifies that the enrollment request is for dual certificates;
single
specifies
that the enrollment request is for a signing certificate; and
encryption
specifies that the enrollment request is for an encryption certificate.
Note that choosing
dual
would require a client that’s capable of generating
dual key pairs.