Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 292 / 840

Managing the Certificate Database
292 Red Hat Certificate System Administrator’s Guide • September 2005
❍
The names of external tokens vary, matching the names specified when the tokens
were installed. You should choose this option if the key pair for the certificate you
chose in the previous step is in an external cryptographic device. If you don’t see
the token you want to use, exit from the wizard, make sure the token is installed
properly, restart the server, and repeat the process. For information on using or
installing external tokens, see “External Token” on page 306.
• The key pair for generating the certificate request—you can choose to generate the
certificate request based on an existing or a new key pair.
❍
If you want to renew the certificate you selected in the previous step, use the
existing key pair for generating the request. For example, you can extend the
validity period of a certificate by renewing it.
To generate a certificate request based on an existing key pair, select the token that
contains the key pair you want to use for generating the request. The wizard
automatically selects the key pair that corresponds to the certificate you chose in
the previous step.
❍
If you want a new certificate, use a new key pair for generating the request. For
example, you may want to get a new SSL server certificate or may want to replace
an existing certificate whose private key has been compromised.
To generate a certificate request based on a new key pair, select the token that can
generate the key pair you want to use for generating the request. For example, if
you want to generate the key pair using an external cryptographic device, such as a
smart card, select that as the token. In addition, you will be required to indicate
details, such as the key algorithm and size for the key pair.
• The type and length of the key pair—you are required to provide this information only
if you chose to generate the certificate request based on a new key pair. For key type,
you can choose RSA or DSA. Be sure to select a key type that the CA (to which you
will later submit the request for signing) can certify.
For key length, enter the size in bits.
❍
If the key type is RSA, the key size can be 512, 768, 1024, 2048, 4096, or Custom.
❍
If the key type is DSA, the key size can be 512, 1024, or Custom (which must be in
increments of 64 bit).
Keep in mind that generating a new key pair takes time—the longer the key length the
longer the time the wizard takes to generate it.