Novell EDIRECTORY 8.8 SP3, Administration Manual, Page: 87 / 634

Designing Your Novell eDirectory Network 87
n
ov
do
cx (e
n)
11
Ju
ly 20
08
The root administrator can also delegate the authority to use the Organizational CA by assigning the
following rights to subcontainer administrators. Subcontainer administrators require the following
rights to install Novell eDirectory SP3 with SSL security:
Š
Read right to the NDSPKI:Private Key attribute on the Organizational CA’s object, located in
the Security container.
Š
Supervisor right to the W0 object located in the Security container, inside the KAP object.
These rights are assigned to a group or a role, where all the administrative users are defined. For a
complete list of required rights to perform specific tasks associated with Novell Certificate Server,
refer to the
Novell Certificate Server (http://www.novell.com/documentation/beta/crt30/index.html)
online documentation.
2.7.2 Ensuring Secure eDirectory Operations on Linux, Solaris,
and AIX Systems
eDirectory includes Public Key Cryptography Services (PKCS), which contains the Novell
Certificate Server that provides Public Key Infrastructure (PKI) services, Novell International
Cryptographic Infrastructure (NICI), and SAS*-SSL server.
The following sections provide information about performing secure eDirectory operations:
Š
“Verifying Whether NICI Is Installed and Initialized on the Server” on page 87
Š
“Initializing the NICI Module on the Server” on page 88
Š
“Starting the Certificate Server (PKI Services)” on page 88
Š
“Stopping the Certificate Server (PKI Services)” on page 89
Š
“Creating an Organizational Certificate Authority Object” on page 89
Š
“Creating a Server Certificate Object” on page 89
Š
“Exporting an Organizational CA's Self-Signed Certificate” on page 89
For information about using external certificate authority, refer to the Novell Certificate Server
Administration Guide (http://www.novell.com/documentation/beta/crt30/index.html) .
Verifying Whether NICI Is Installed and Initialized on the Server
Verify the following conditions, which indicate that the NICI module has been properly installed and
initialized:
Š
The file
/etc/nici.cfg
exists
Š
The directory
/var/novell/nici
exists
Š
The file
/var/novell/nici/primenici
exists
Creating Server Certificate objects Supervisor right on the server’s container
Read right to the NDSPKI:Private Key attribute
on the Organizational CA’s object
Novell Certificate Server Task Rights Required