Netscape Certificate Management System 6.1, Administrator'S Manual, Page: 317 / 840

Tokens for Storing CMS Keys and Certificates
Chapter 7 Administrative Basics 317
http://developer.netscape.com/support/faqs/pkcs_11.html
If you haven’t already done so, consider using external tokens for generating and
storing the key pairs and certificates used by Certificate Management System.
These devices represent another security measure you can take to safeguard
private keys because hardware tokens are sometimes considered more secure than
software tokens. For additional details, check the literature provided by
hardware-token vendors.
Installing External Tokens
To use external encryption devices or tokens, you need to take the following steps:
• Install the Cryptographic Device
• Install the PKCS #11 Module
Install the Cryptographic Device
To install the drivers provided by the device manufacturer, follow the instructions
that came with the device. When you install a hardware token, you are given an
opportunity to name it; be sure to use a name that will help you identify the token
later.
Install the PKCS #11 Module
PKCS #11 is a standard set of APIs and shared libraries used by Netscape and a
number of encryption vendors. PKCS #11 isolates an application from the details of
the cryptographic device, thus enabling the application to provide a unified
interface for PKCS #11-compliant cryptographic devices.
The PKCS #11 module implemented in Certificate Management System (in
Netscape Administration Server) enables it to support cryptographic devices
supplied by many different manufacturers. Specifically, it allows Certificate
Management System to plug in shared libraries or DLLs supplied by
manufacturers of external encryption devices and use them for generating and
storing keys and certificates for the CMS managers.
There are two ways in which you can install a PKCS #11 module, by using the
interface provided within Netscape Console or by using the command-line utility
named
modutil
. Both the methods are documented below.
• To install the PKCS #11 module using Netscape Console:
a.
Log in to the CMS window (see “Logging Into the CMS Console” on
page 247).