Novell IFOLDER 3.7 - SECURITY ADMINISTRATION, Administration Manual

Page: 81 / 216

Installing and Configuring iFolder Services 81
no
vd
ocx
(e
n)
13
Ma
y 20
09
YaST displays the current settings for confirmation.
6
Click Create .
The root CA is created then appears in the overview.
6.6.3 Creating Self-Signed Certificates Using YaST
iFolder key recovery mechanism uses the X509 certificates to manage the keys. You can either get a
certificate from an external Certified Authority, for instance Verisign* or generate a self-signed
certificate if deployed in a trusted environment, where a trusted user-admin relationship exists.
NOTE: In certificates intended for e-mail signature, the e-mail address of the sender (the private
key owner) should be contained in the certificate to enable the e-mail program to assign the correct
certificate. For certificate assignment during encryption, it is necessary for the e-mail address of the
recipient (the public key owner) to be included in the certificate. In the case of server and client
certificates, the hostname of the server must be entered in the Common Name field. The default
validity period for certificates is 365 days.
This section discusses creating self-signed certificates for encryption and self-signed key certificate
for key recovery using YaST.
1 Start YaST and go to Security and Users > CA Management .
2 Select the required CA and click Enter CA .
3 Enter the password for the CA if asked for.
YaST displays the CA key information in the Description tab.
4 Click Certificates tab.
Valid Period (days) The Valid Period in the case of a CA defaults to
3650 days (roughly ten years). This long period
makes sense because the replacement of a
deleted CA involves an enormous administrative
effort.
Advanced Options Advanced Options are very special options.
WARNING: If you change these options, iFolder
cannot guarantee that the generated certificate
works correctly. Clicking Advanced Options
opens a dialog for setting different attributes from
the X.509 extensions. These values have
rational default settings and should only be
changed if you are really sure of what you are
doing.
CA Settings Descriptions