Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Admin Manual

Page: 432 / 564

Chapter 16. Managing Subsystem Certificates
410
NOTE
If the Certificate System instance's certificates and keys are stored on an HSM, then
specify the token name using the
-h
option.
For example:
certutil -A -n "ServerCert cert-example" -t u,u,u -d . -a -i /tmp/example.cert
For information about using the
certutil
command, see
http://www.mozilla.org/projects/security/pki/
nss/tools/certutil.html
.
16.5.1.3. About CA Certificate Chains
Any client or server software that supports certificates maintains a collection of trusted CA certificates
in its certificate database. These CA certificates determine which other certificates the software can
validate. In the simplest case, the software can validate only certificates issued by one of the CAs
for which it has a certificate. It is also possible for a trusted CA certificate to be part of a chain of CA
certificates, each issued by the CA above it in a certificate hierarchy.
The first certificate in the chain is processed in a context-specific manner, which varies according to
how it is being imported. For Mozilla Firefox, this handling depends upon the MIME content type used
on the object being downloaded. For Red Hat servers, it depends upon the options selected in the
server administration interface.
Subsequent certificates are all treated the same. If the certificates contain the SSL-CA bit in the
Netscape Certificate Type certificate extension and do not already exist in the local certificate
database, they are added as untrusted CAs. They can be used for certificate chain validation as long
as there is a trusted CA somewhere in the chain.
16.5.2. Viewing Database Content
The certificates stored in the subsystem certificates database,
cert8.db
, can be viewed through the
subsystem administrative console. Alternatively, the certificates can be listed using the
certutil
utility.
certutil
must be used to view the TPS certificates because the TPS subsystem does not use
an administrative console.
•
Section 16.5.2.1, “Viewing Database Content through the Console”
•
Section 16.5.2.2, “Viewing Database Content Using certutil”
NOTE
The certificates listed in the
cert8.db
database are the subsystem certificates used
for subsystem operations. User certificates are stored with the user entries in the LDAP
internal database.
16.5.2.1. Viewing Database Content through the Console
To view the contents of the database through the administrative console, do the following: