Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 116 / 874

Configuring the Certificate Manager
116 Netscape Certificate Management System Administrator’s Guide • June 2003
h.
Once you have the CRL signing certificate ready, restart the wizard and
install the certificate in the Certificate Manager’s database.
2.
Stop the Certificate Manager.
3.
Update the Certificate Manager’s configuration to recognize the new key pair
and certificate.
a.
In the Certificate Manager host machine, go to this directory:
<server_root>/cert-<instance_id>/config
b.
Open the
CMS.cfg
file in a text editor.
c.
Add the following lines to the configuration file:
ca.crl_signing.cacertnickname=<nickname> cert-<instance_id>
ca.crl_signing.defaultSigningAlgorithm=<signing_algorithm>
ca.crl_signing.tokenname=<token_name>
Where:
For example, your edited entries might look like this:
ca.crl_signing.cacertnickname=crlSigningCert cert-demoCA
ca.crl_signing.defaultSigningAlgorithm=MD5withRSA
ca.crl_signing.tokenname=Internal Key Storage Token
d.
Save your changes and close the file.
4.
Restart the Certificate Manager. Now the Certificate Manager is ready to use
the CRL signing certificate to sign the CRLs it generates.
nickname
Is the name assigned to the CRL signing
certificate.
instance_id
Is the name assigned to the Certificate
Manager instance.
signing_algorithm
Is
MD5withRSA
,
MD2withRSA
, or
SHA1withRSA
, if the key type is RSA, or
SHA1withDSA
, if the key type is DSA.
token_name
Is the name of the token used for generating
the key pair and the certificate. If you used
the internal/software token, use
Internal
Key Storage Token
as the value.