Netscape Certificate Management System 6.1, Administrator'S Manual

Page: 113 / 840

Configuring the Certificate Manager
Chapter 3 Certificate Manager 113
f.
Log in to the Agent Services interface, check the request for required
extensions. For example, the CRL signing certificate must contain the Key
Usage extension with the
crlSigning
bit set. (By default, the Certificate
Manager’s policy is configured to add the Key Usage extension with
correct bits to the CRL signing certificate; see the policy rule named
CRLSignCertKeyUsageExt
, which is an instance of
KeyUsageExt
plug-in.)
g.
Approve the request.
h.
Once you have the CRL signing certificate ready, restart the wizard and
install the certificate in the Certificate Manager’s database.
2.
Stop the Certificate Manager.
3.
Update the Certificate Manager’s configuration to recognize the new key pair
and certificate.
a.
In the Certificate Manager host machine, go to this directory:
<server_root>/cert-<instance_id>/config
b.
Open the
CMS.cfg
file in a text editor.
c.
Add the following lines to the configuration file:
ca.crl_signing.cacertnickname=<nickname> cert-<instance_id>
ca.crl_signing.defaultSigningAlgorithm=<signing_algorithm>
ca.crl_signing.tokenname=<token_name>
Where:
nickname
Is the name assigned to the CRL signing
certificate.
instance_id
Is the name assigned to the Certificate
Manager instance.
signing_algorithm
Is
MD5withRSA
,
MD2withRSA
, or
SHA1withRSA
, if the key type is RSA, or
SHA1withDSA
, if the key type is DSA.
token_name
Is the name of the token used for generating
the key pair and the certificate. If you used
the internal/software token, use
Internal
Key Storage Token
as the value.