Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 248 / 874

The Administrative Interface
248 Netscape Certificate Management System Administrator’s Guide • June 2003
Storing an Administrator’s Client Certificates
You must store the certificates for any of administrator using this system. The
certificate should be either from the CA itself, or from whichever CA signed the
certificate for the subsystem.
Make sure the client certificate is good for SSL client authentication, otherwise, the
server will not accept the client certificate and will post the following error
message in the error log located in the directory
<server_root>/cert-<instanceID>/logs/errors
:
failure (14290): Error receiving connection
(SEC_ERROR_INADEQUATE_CERT_TYPE - Certificate type not approved for
application.)
Enabling SSL Client Authentication
To enable SSL client authentication in Netscape Console:
1.
Since you need to use
certutil
to initialize
cert8.db
and
key3.db
and to
create certificate request, make sure to set the LD_LIBRARY_PATH correctly.
To do this, issue the following command:
setenv LD_LIBRARY_PATH <server_root>/lib:$LD_LIBRARY_PATH
2.
Use
certutil
in
/bin/cert/tools
to initialize the cert8.db and key3.db files
in
<home_directory>/.mcc
. To do this:
a.
Go to the following directory:
<server_root>/bin/cert/tools
b.
Issue the command:
./certutil -N -d <home_directory>/.mcc
3.
Request the client certificate. Go to the end-entity interface for the CA that will
issue the certificate and click on the Enrollment tab.
4.
Select the "Manual User Dual-Use Certificate Enrollment" link.
5.
Fill in all necessary information required for the form and click Submit.
6.
Once you get the certificate, make sure to import it to the browser.
7.
Export the certificate as p12 file.
8.
Import the client certificate in p12 format to the cert8.db.
./pk12util -i <pk12file> -d "<home directory>/.mcc"
9.
Log in to the CMS console (see “Logging Into the CMS Console” on page 245).