Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 90 / 874

Certificate Manager Deployment Considerations
90 Netscape Certificate Management System Administrator’s Guide • June 2003
If you configure the Certificate Manager to function as a trusted manager to a Data
Recovery Manager, the Certificate Manager also uses its SSL server certificate for
SSL client authentication to the Data Recovery Manager. For details on trusted
managers, see “Trusted Managers” on page 327. You can also configure the
Certificate Manager to use an alternate certificate for this purpose. See “Managing
Certificates and the Certificate Database” on page 114 for more details.
Certificate Considerations
This section explains some of the decisions you need to make about the certificates
you get for the Certificate Manager when you install the subsystem.
CA’s Distinguished Name
The core elements of a CA consist of a signing unit and the Certificate Manager’s
own identity. The signing unit digitally signs certificates requested by end-entities
that use a specified enrollment process to establish their identities. Regardless of
how related Registration Managers or Data Recovery Managers are configured,
any Certificate Manager must have its own distinguished name (DN), which is
listed in every certificate it issues.
Like any other X.509 version 3 certificate, a CA certificate binds a DN to a public
key. A DN is a series of name-value pairs that in combination uniquely identify an
entity. For example, the following DN might be used to identify a hypothetical
Certificate Manager for the Engineering department of a corporation named
Example Corporation:
cn=demoCA, o=Example Corporation, ou=Engineering,
c=US
Many combinations of name-value pairs are possible for the Certificate Manager’s
DN. The DN must be unique and readily identifiable, since any end entity can
examine it. For more information about DNs, see Managing Servers with Netscape
Console.
CA Signing Certificate’s Validity Period
Every certificate, including a Certificate Manager signing certificate, must have a
validity period. CMS does not restrict the validity period you can specify. In
general it’s a good idea to specify as long a validity period as possible, depending
on your plans for certificate renewal, the place of the CA in the certificate
hierarchy, and the requirements of any public CAs that you may want to include in
your PKI.