Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 667 / 874

Cloning the Certificate Manager
Chapter 16 Configuring CMS for High Availability 667
❍
Verify that this master instance is running.
The CA instance automatically starts up once it’s been properly
configured. If you need to start or restart the Certificate Manager
manually, you may do so by invoking the
start-cert
or
restart-cert
commands, which are available in the CA instance directory:
<serverRoot>/cert-<instance_id>/
❍
Make sure that you have already installed the agent certificate for the
master instance. See “Agent Certificates” on page 335 for more information
about getting agent certificates.
Once you have verified these aspects of the master CA, consider the following for
the cloned CA.
❍
CA’s serial number range —Each cloned Certificate Manager must be
configured to issue certificates with unique serial numbers. This means
that when you configure a cloned Certificate Manager, you must specify
upper and lower bounds for the serial numbers and make sure that the
serial-number range does not overlap with the one specified for another
cloned Certificate Manager.
When specifying the serial number range for the first cloned Certificate
Manager, it’s recommended that you start with 0x100, for example, as the
"Starting certificate number." This will ensure that the master Certificate
Manager has sufficient serial numbers for its own certificates, such as the
CA signing certificate, SSL server certificate, agent’s certificate, and so on.
The master Certificate Manager will also need distinct serial numbers
when you renew its certificates in the future. Any subsequent cloned
Certificate Manager does not need such a provision; its serial numbers
only need to not overlap with the ones assigned to the previous clones.
❍
CA’s signing key and certificate —You must use the master Certificate
Manager’s signing key and certificate. If you do not use the master
Certificate Manager’s key and certificate databases, the cloned Certificate
Manager will need to generate a new signing key and certificate;
consequently, it will not be a clone.
❍
CA’s SSL server key and certificate —This depends on the way in which
you have deployed the clone environment. If you are using a load
balancer, regardless of whether or not the host machines are different, you
do not need to generate a new SSL server certificate for the cloned
Certificate Manager, since the SSL server certificate DN should contain the
hostname of the load balancer as the common name (CN) attribute. If the
cloned Certificate Manager uses the same hostname as that of the master
Certificate Manager and you are not using a load balancer, you can use the