Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 392 / 578

Using Certificate-Based Authentication
392 Netscape Directory Server Administrator’s Guide • August 2002
3.
Enable SSL on the server, or on both servers involved in replication.
For information on enabling SSL, refer to “Activating SSL,” on page 387.
4.
Map the certificate’s distinguished name to a distinguished name known by
your directory.
This allows you to set access control for the client when it binds using this
certificate. This mapping process is described in Managing Servers with
Netscape Console.
Allowing/Requiring Client Authentication
If you have configured Netscape Console to connect to your Directory Server using
SSL and your Directory Server requires client authentication, you can no longer use
Netscape Console to manage any of your Netscape servers. You will have to use
the appropriate command-line utilities instead.
However, if at a later date you wish to change your directory configuration to no
longer require but allow client authentication, so that you can use Netscape Console,
you must follow these steps:
1.
Stop Directory Server.
For information on stopping and starting the server from the command line,
see “Starting/Stopping the Server From the Command Line,” on page 37.
2.
Modify the
cn=encryption,cn=config
entry by changing the value of the
nsSSLClientAuth attribute from
required
to
allowed
.
For information on modifying entries from the command line, see Chapter 2,
“Creating Directory Entries.”
3.
Start Directory Server.
You can now start Netscape Console.
NOTE If Netscape Console connects to Directory Server over SSL,
selecting “Require client authentication” disables communication.
This is because although Netscape Console supports SSL, it does
not have a certificate to use for client authentication.