Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 59 / 874

System Architecture
Chapter 1 Overview 59
To create a cloned Certificate Manager, you must first install and configure at least
one Certificate Manager and specify a definite upper, but no lower bound for the
serial numbers it will use. You then install or create a new instance of a Certificate
Manager (but do not configure it). Before configuring the clone, you copy the CMS
certificate and key database files from the master Certificate Manager to the new
Certificate Manager (
<server_root>/alias
directory). If these databases are
present, the Configuration Wizard will recognize that you are creating a clone and
confirm that you want to reuse the CA’s signing key and certificate (if the clone is
on the same server, you can also reuse the SSL server certificate).
If you store the CA key material on a hardware token, you will have to follow the
hardware vendor’s instructions for copying the key material to a hardware device
accessible to the clone.
A cloned Certificate Manager will have all the same features, for example, agent
gateway functions and end entity gateway functions, that a normal Certificate
Manager has. You can then configure Registration Managers that point to different
Certificate Manager servers but that appear to be serviced by the same CA.
System Architecture
This section describes the architecture of CMS. Figure 1-5 on page 60 shows a
graphical representation of that architecture.