Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 338 / 874

Agent Certificates
338 Netscape Certificate Management System Administrator’s Guide • June 2003
3.
Ask the user to send you the certificate information sent by the public CA. In
the information that you receive, locate the user’s certificate in base-64 encoded
form.
You can also get the user’s certificate from the public CA that issued it. Access
the public CA site, search for the user’s certificate, and locate the certificate in
base-64 encoded form.
4.
Copy the base-64 encoded certificate, including the
-----BEGIN
CERTIFICATE-----
and
-----END CERTIFICATE-----
marker lines, to a text
file.
5.
Save the text file and use it to store a copy of the certificate in a subsystem’s
internal database. See “Setting up Administrators, Agents, and Auditors,” on
page 328
Getting an Agent’s Certificate from Certificate
Management System
The following general instructions explain how a user can get a client certificate
from CMS and how you can copy that certificate (in base-64 encoded form) to the
internal database of a subsystem:
1.
The user sends a client certificate request to CMS from the computer that they
will use to access the subsystem from the Agent Services interface. It is
important that user generate and submit this request from the computer they
will use later to access the subsystem, because part of this request process
generates a private key on the local machine. Alternatively, if location
independence is required, the user can also use a hardware token, such as a
smart card, to generate and store the key pair (and the certificate when the user
receives it from the public CA).
2.
Depending on how your system is configured for certificate issuance, one of
the following events happen:
❍
If CMS is configured for manual certification, an issuing agent must
process the request and approve it for issuance. Once the request is
approved, the server issues the client certificate to the user.
❍
If CMS is configured for automated certification and the request passes
authentication and policy checks, the server automatically issues the client
certificate to the user.