Sun Microsystems Netscape Enterprise Server, Administrator'S Manual

Page: 134 / 532

Using Client Certificates
134 Netscape Enterprise Server Administrator’s Guide
Syntax SSLSessionTimeout seconds
seconds
is the number of seconds until a cached SSL2 session becomes
invalid. The default value is 100. If the
SSLSessionTimeout
directive is
specified, the value of seconds is silently constrained to be between 5 and 100
seconds.
Using Client Certificates
If you have enabled the Enterprise Administration Server Preferences “Require
client certificates” option, the server asks the client to send its certificate before
the server will grant the request. The server doesn’t care who the user is as long
as that user has a valid certificate from a trusted CA. However, you can
combine client certificates with access control so that in addition to being from
a trusted CA, the user associated with the certificate must match the access-
control rules. For more information, see “Access Control Files,” on page 331 in
Chapter 14, “Controlling Access to Your Server.” In addition, you can process
information from client certificates. For more information, see the
NSAPI
Programmer’s Guide
for Enterprise Server 4.0.
Mapping Client Certificates to LDAP
This section describes the process Netscape Enterprise Server uses to map a
client certificate to an entry in an LDAP directory.
When the server gets a request from a client, it asks for the client’s certificate
before proceeding. Netscape clients, such as Netscape Navigator and Netscape
Communicator, send the client certificate to the server (with or without
prompting the end user, depending on the browser’s security configuration).
(Note that you also need to set up the required ACLs; for more information, see
“ACL File Syntax,” in Appendix B, “ACL File Syntax,” on page 456).
The server then takes the CA listed in the certificate and tries to match it to a
trusted CA listed in the Enterprise Administration Server. If there isn’t a match,
some servers end the connection and some perform a different operation based
on the failed match. Enterprise Server ends the connection. If there is a match,
the server continues processing the request.