Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 40 / 874

How Certificate Management System Works
40 Netscape Certificate Management System Administrator’s Guide • June 2003
• The Certificate Manager is the subsystem that provides Certificate Authority
functionality for issuing, renewing, revoking, and publishing certificates and
creating and publishing CRLs. See Chapter 3, “Certificate Manager” for
complete details.
• The Registration Manager is an optional subsystem that provides Registration
Authority functionality. It establishes a trusted relationship with a Certificate
Manager where its signed requests are processed by the Certificate Manager.
See Chapter 4, “Registration Manager” for complete details.
• The Online Certificate Status Manager is an optional subsystem that provides
stand-alone OCSP responder services. See Chapter 5, “OCSP Responder” for
complete details.
• The Data Recovery Manager is an optional subsystem that provides private
encryption key storage and retrieval. See Chapter 6, “Data Recovery Manager”
for complete details.
Interfaces
Each of the subsystems contains interfaces allowing interaction with various
portions of the subsystem. All four subsystems share a common administrative
interface. All four subsystems have an agent interface specific to that subsystem
allowing agents to perform the tasks assigned to them. A Certificate Manager and a
Registration Manager have an end-entity services interface allowing end-entities to
enroll in the PKI.
• Administrative Interface—The administrative interface is a java application,
called Netscape Console, that provides a GUI interface for performing
administrative tasks and configuring plug-in modules and instances of plug-in
modules. The area of Netscape Console that is specific to CMS tasks is called
the CMS console. This interface is similar for all four subsystem. It contains
some common configurable features, but also contains different plug-in types
that can be configured depending on the kind of subsystem installed. The
administrative interface is configured for user ID and password authentication.
You can configure it for SSL authentication.
• Agent Services Interface—The agent services interface is a customizable HTML
interface that can be used to perform agent tasks, such as editing and
approving requests for certificate approval, certificate renewal, and certificate
revocation. The agent services interface is almost identical for a Certificate
Manager and a Registration Manager. The agent services interface for a Data
Recovery Manager and an Online Certificate Status Manager are specific to
those subsystem.