Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 391 / 578

Using Certificate-Based Authentication
Chapter 11 Managing SSL 391
In order to continue using the Netscape Console with SSL, you must select at least
one of the following ciphers:
• RC4 cipher with 40-bit encryption and MD5 message authentication.
• No encryption, only MD5 message authentication.
• DES with 56-bit encryption and SHA message authentication.
• RC4 cipher with 128-bit encryption and MD5 message authentication.
• Triple DES with 168-bit encryption and SHA message authentication.
Using Certificate-Based Authentication
Directory Server allows you to use certificate-based authentication for the
command-line tools (which are LDAP clients) and for replication communications.
Certificate-based authentication can occur between:
• An LDAP client connecting to the Directory Server
• A Directory Server connecting to another Directory Server (replication or
chaining)
Setting up Certificate-Based Authentication
To set up certificate-based authentication, you must:
1.
Create a certificate database for the client and the server, or for both servers
involved in replication.
On the Directory Server, the certificate database creation automatically takes
place when you install a certificate. For information on creating a certificate
database for a client, see “Configuring LDAP Clients to Use SSL,” on page 393.
2.
Obtain and install a certificate on both the client and the server, or on both
servers involved in replication.
CAUTION
Avoid selecting the
none,MD5
cipher because the server will use this
option if no other ciphers are available on the client. It is not secure
because encryption doesn’t occur.