Netscape NETSCAPE MANAGEMENT SYSTEM 4.5, Installation And Setup Manual

Page: 441 / 866

Keys and Certificates for the Main Subsystems
Chapter 14 Managing CMS Keys and Certificates 441
2.
After you’ve installed the certificate successfully, go to the Tasks tab and stop
the Certificate Manager.
3.
Update the Certificate Manager’s configuration to recognize the new key pair
and certificate.
a.
In the Certificate Manager host machine, go to this directory:
<server_root>/cert-<instance_id>/config
b.
Open the configuration file (
CMS.cfg
) in a text editor.
c.
Add the following lines to the configuration file:
ca.crl_signing.cacertnickname=<nickname> cert-<instance_id>
ca.crl_signing.defaultSigningAlgorithm=<signing_algorithm>
ca.crl_signing.tokenname=<token_name>
d.
Edit the lines as below. Replace
<nickname>
with the name assigned to the CRL signing certificate.
<instance_id>
with the name assigned to the Certificate Manager
instance.
<signing_algorithm>
with
MD5withRSA
,
MD2withRSA
, or
SHA1withRSA
, if
the key type is RSA, or
SHA1withDSA
, if the key type is DSA.
<token_name>
with the name of the token used for generating the key pair
and the certificate. If you used the internal/software token, use
Internal
Key Storage Token
as the value.
For example, your edited entries might look like this:
ca.crl_signing.cacertnickname=crlSigningCert cert-demoCA
ca.crl_signing.defaultSigningAlgorithm=MD5withRSA
ca.crl_signing.tokenname=Internal Key Storage Token
e.
Save your changes and close the file.
4.
Restart the Certificate Manager. Now the Certificate Manager is ready to use
the CRL signing certificate to sign the CRLs it generates.
SSL Server Key Pair and Certificate
Every Certificate Manager you have installed has at least one SSL server certificate.
The first time you generated this certificate is when you installed the Certificate
Manager. The default nickname for the certificate is
Server-Cert cert-<instance_id>
, where
<instance_id>
identifies the CMS
instance in which the Certificate Manager is installed.