Netscape NETSCAPE MANAGEMENT SYSTEM 4.5, Installation And Setup Manual

Page: 209 / 866

Cloned Certificate Manager Configuration
Chapter 5 Installation Worksheet 209
• Country (C=) ____________________________________________
A DN is a series of name-value pairs that in combination uniquely identify an
entity. The subject DN identifies the Online Certificate Status Manager signing
certificate. For more information about distinguished names, see Apendix A,
“Distinguished Names,” in CMS Plug-ins Guide.
Online Certificate Status Manager Signing
Certificate Issuer
If you are submitting your certificate request to a third-party CA, follow the
instructions provided by that CA.
If you are submitting your certificate request to another Certificate Manager, you
need to know its URL:
• End-entity URL for issuing a Certificate Manager__________________________
Enter the URL for the end-entity gateway of the Certificate Manager that will issue
the Online Certificate Status Manager’s signing certificate. For example,
http://<hostname>:17006
.
Cloned Certificate Manager Configuration
This section summarizes information required to configure a clone of a Certificate
Manager. You must have installed the original Certificate Manager and installed or
created a new CMS instance. You must copy the
key3.db
and
cert7.db
files from
the
config
directory of the original server to the
config
directory of the cloned
server. If you use a hardware token for key and certificate storage, you must copy
any key or certificate data from the original token to a new token accessible to the
cloned Certificate Manager.
You can clone a Certificate Manager instance to have two server processes
perfoming the same CA functions using the same keys and certificates. Each cloned
Certificate Manager, including the original, must only issue certificates with serial
numbers that do not conflict with the serial numbers issued by other clones. Use
the CA serial number range to make sure that the serial numbers used by a clone
do not overlap with the serial number range of another clone (or the original
server).