Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 33 / 874

Features
Chapter 1 Overview 33
Root or Subordinate CA
CMS can function as a root CA; in this case, the server signs its own CA signing
certificate as well as other CA signing certificates, enabling you to create your own
CA hierarchy. You can also install the server to function as a subordinate CA; in this
case, the server gets its CA signing key signed by another CA in an existing CA
hierarchy. See “Self-Signed Root vs. Subordinate CA,” on page 86 for complete
details.
Linked CA
CMS can function as a linked CA, chaining up to many third-party or public CAs for
validation; this provides cross-company trust, so applications can verify certificate
chains outside the company certificate hierarchy. You chain a Certificate Manager
to a third-party CA by requesting the Certificate Manager’s CA signing certificate
from the third-party CA.
CA Cloning
If you don’t want to create a CA hierarchy comprising root and subordinate CAs,
you can create clones of a Certificate Manager and configure each clone to issue
certificates that fall within a distinct range of serial numbers. Because cloned CAs
and master CAs use the same CA signing key and certificate to sign the certificates
they issue, the issuer name in all the certificates will be the same. Cloned CAs and
the master Certificate Managers they are based on issue certificates as if they are a
single CA, and can be placed on different hosts for high availability failover
support. See “Cloning a CA,” on page 131 for details. Also see Appendix ,
“Configuring CMS for High Availability” for information on configuring clones for
failover in a CMS system.
Interfaces
Each of the subsystems contains interfaces allowing interaction with various
portions of the subsystem. All four subsystems share a common administrative
interface. All four subsystems have an agent interface specific to that subsystem
allowing agents to perform the tasks assigned to them. A Certificate Manager and a
Registration Manager have an end-entity services interface allowing end-entities to
enroll in the PKI.