Netscape Certificate Management System 6.1, Руководство администратора

Страница: 203 / 840

Key Archival Process
Chapter 6 Data Recovery Manager 203
How Key Archival Works
When a Certificate Manager or Registration Manager receives a certificate request
that contains the key archival option, it automatically forwards the request to the
Data Recovery Manager to archive the end-entity’s encryption private key. The
Data Recovery Manager receives an encrypted copy of the end-entity’s private key
and stores the key in its key repository. To archive the key, the Data Recovery
Manager uses two special key pairs:
• A transport key pair and corresponding certificate
• A storage key pair
Figure 6-1 illustrates how the key archival process occurs when an end-entity’s
requests a certificate. The deployment scenario shown in this figure has a
Registration Manager acting as the trusted enrollment authority to a Certificate
Manager and Data Recovery Manager.
Figure 6-1
How the key archival process works
These are the steps shown in Figure 6-1:
1.
A end entity uses a client capable of generating dual key pairs to access the
certificate enrollment form served by the Registration Manager, fills in all the
information, and submits the request.