Sun Oracle Crypto Accelerator 6000 Board, User Manual

Page: 127 / 266

Chapter 4 Configuring Centralized Keystores 105
▼
Configure the
scakiod
Service to Use CKS (Linux)
1. Edit the
/etc/opt/sun/sca6000/scakiod.conf
file.
The following example configures the
scakiod
service to communicate with
LDAP host
centks
with password-based (simple) authentication. Below are
examples of entries in
scakiod.conf
that must be modified.
These entries identify
cks-host
as the centralized keystore host and specify that
this system will connect as
agent1
.
2. Start and stop the
sca
daemon to activate these settings.
Configuring the
scakiod
Service to Use SSL With
Simple Authentication
The
scakiod
service can communicate with directory servers using SSL. To enable
this communication, an NSS certificate database must be configured. The CA
certificate that signs the directory server SSL certificate must be imported into that
database. The certificate database must exist in the directory specified in the
certdb
SMF property. This directory is
/var/sca/privat
e by default. You must use the
NSS utility
certutil
to create a database and import the root CA certificate into it.
Note –
The
certutil
utility is located in
/usr/sfw/bin/certutil
on Oracle
Solaris systems. The typical Linux path to
certutil
is
/usr/bin/certutil
.
▼
Configure
scakiod
for Simple Authentication Over
SSL
1. Create a certificate database with the
certutil
utility:
serverlist ldap://cks-host
binddn cn=agent1,ou=Agents,ou=scakeystore,o=SUN,c=US
basedn o=SUN,c=US
# /etc/init.d/sca stop
# /etc/init.d/sca start