Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 826 / 874

Managing Certificates
826 Netscape Certificate Manager System Administrator’s Guide • June 2003
Keys can be generated by client software or generated centrally by the CA and
distributed to users via an LDAP directory. There are trade-offs involved in
choosing between local and centralized key generation. For example, local key
generation provides maximum nonrepudiation, but may involve more
participation by the user in the issuing process. Flexible key management
capabilities are essential for most organizations.
Key recovery, or the ability to retrieve backups of encryption keys under carefully
defined conditions, can be a crucial part of certificate management (depending on
how an organization uses certificates). Key recovery schemes usually involve an m
of n mechanism: for example,
m
of
n
managers within an organization might have
to agree, and each contribute a special code or key of their own, before a particular
person’s encryption key can be recovered. This kind of mechanism ensures that
several authorized personnel must agree before an encryption key can be
recovered.
Renewing and Revoking Certificates
Like a driver’s license, a certificate specifies a period of time during which it is
valid. Attempts to use a certificate for authentication before or after its validity
period will fail. Therefore, mechanisms for managing certificate renewal are
essential for any certificate management strategy. For example, an administrator
may wish to be notified automatically when a certificate is about to expire, so that
an appropriate renewal process can be completed in plenty of time without causing
the certificate’s subject any inconvenience. The renewal process may involve
reusing the same public-private key pair or issuing a new one.
A driver’s license can be suspended even if it has not expired—for example, as
punishment for a serious driving offense. Similarly, it’s sometimes necessary to
revoke a certificate before it has expired—for example, if an employee leaves a
company or moves to a new job within the company.
Certificate revocation can be handled in several different ways. For some
organizations, it may be sufficient to set up servers so that the authentication
process includes checking the directory for the presence of the certificate being
presented. When an administrator revokes a certificate, the certificate can be
automatically removed from the directory, and subsequent authentication
attempts with that certificate will fail even though the certificate remains valid in
every other respect. Another approach involves publishing a certificate revocation
list (CRL)—that is, a list of revoked certificates—to the directory at regular