Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 700 / 840

Common Criteria Deployment Scenarios
700 Red Hat Certificate System Administrator’s Guide • September 2005
CS Administrative Console
In the Common Criteria Environment, you will not be able to start a CS instance using Red
Hat Console and the CS console. You must start the server on the command line because
when you set up the Common Criteria environment, you disable the password plain-text file
used for remote start-up. When you log in on the command line, you will be prompted for
all the passwords you need to provide.
For complete information on the CS console, see “The Administrative Interface” on page
236. For instructions on how to set up SSL client authorization for the CS console, see
Appendix I, “Introduction to SSL.”
Backup and Restore of a CS Subsystem
CS provides a command-line tool to backup a CS subsystem instance. It also provides
another command-line tool to restore a CS subsystem instance to the state of the system
when it was last backed up. In the CS Common Criteria Setup Procedure, you will not be
instructed on how to operate these command-line utilities, however, you should know when
it’s necessary to backup or restore a CS subsystem running in Common Criteria evaluated
environment, you should following the instructions for these utilities in the Backing Up and
Restoring Data chapter of the CS Tools Guide and the instructions on how to sign and
verify the data.
Note: All secure information that needs encryption (component secret keys, component
private keys, and passwords) is cryptographically encrypted with FIPS 140-1 Level 3
certified hardware token. Disclosure is therefore not a concern of the backup utilities.
Common Criteria Deployment Scenarios
As long as the subsystems you install are installed and configured following the Common
Criteria Environment rules and guidelines contained in this chapter, you can deploy CS in
any deployment scenario you wish. You can set up a root CA, for example, a CA
subordinate to a CS CA, a CA subordinate to a public third-party CA, or have any number
of CAs in vertical or horizontal chains as long as they follow the constraints contained in
the CA signing certificate. If you are setting up the FBCA (cross-certification) feature, you
need to cooperate with the administrator of the remote CA to set up the trust between the
two certificates.