Netscape NETSCAPE MANAGEMENT SYSTEM 4.5, Installation And Setup Manual

Page: 711 / 866

Setting Up a Remote OCSP Responder
Chapter 21 Setting Up an OCSP Responder 711
Step 3. Identify the CA to the OCSP Responder
Before you configure a Certificate Manager to publish CRLs to the Online
Certificate Status Manager, you must identify the Certificate Manager to the Online
Certificate Status Manager. You do this by storing the Certificate Manager’s CA
signing certificate in the internal database of the Online Certificate Status Manager.
To locate the Certificate Manager’s CA signing certificate, it might be useful to
know whether it’s self-signed or signed by another CA.
• If the certificate is self-signed, you can locate the certificate by searching for it
in the Retrieval tab of Certificate Manager’s end-entity interface.
• If the Certificate Manager is a subordinate CA, you can locate its signing
certificate by listing the certificates in the CA certificate chain; you can
download the CA chain from the Retrieval tab of a Certificate Manager’s
end-entity interface.
The steps below explain how to store the Certificate Manager’s CA signing certificate
in the internal database of the Online Certificate Status Manager:
1.
Locate the Certificate Manager’s CA signing certificate.
If the certificate is self-signed:
a.
Open a web browser window.
b.
Go the Certificate Manager’s end-entity interface. The URL is in
h
ttps://<hostname>:<SSL_port>
or h
ttp://<hostname>:<port>
format.
c.
Select the Retrieval tab, and in the left frame, click List Certificates.
d.
In the resulting form, click List.
A list of certificates appear.
e.
Locate the Certificate Manager’s CA signing certificate by looking at the
subject name of the certificate.
Typically, the CA signing certificate is the first certificate the Certificate
Manager issues.
f.
Click Details.
g.
In the resulting page, scroll to the section that says “Base 64 encoded
certificate” and shows the CA signing certificate in its base-64 encoded
format.