Netscape Certificate Management System 6.2, Руководство администратора

Страница: 101 / 874

Installing a Certificate Manager
Chapter 3 Certificate Manager 101
9.
CA’s serial number range. Specify range for the serial numbers for the
certificates that this CA will issue. In the “Starting serial number” field, type
the lowest serial number the CA should assign to a certificate. If you only use
one CA server, you can leave the “Ending serial number” field blank to
indicate no upper limit. If you plan to clone the CA to distribute load, you must
specify an upper limit. (For cloned CAs, you must make sure that the range of
serial numbers does not overlap with any other CA server.)
Click Next to continue.
10.
Internal OCSP Services. Select to enable the internal OCSP services.
See “Setting Up a Certificate Manager with OCSP Service,” on page 169 for
more information.
11.
Network Configuration. Type the port numbers for the ports to be used by the
CMS instance.
See “Certificate Manager Interfaces,” on page 91 for more information.
Click Next to continue.
12.
CA Signing Certificate. Select the “Create subordinate CA certificate request”
option.
Click Next to continue.
13.
Key-Pair Information for Certificate Manager CA signing certificate.
❍
Token. Enter either
internal
(if you plan to use the internal/software
token) or the name of an external token to store the Certificate Manager
signing certificate and key pair. If you have not previously initialized the
token’s password, you must do so in this screen. See “Tokens,” on page 93
for more information.
❍
Key Type. Choose RSA or DSA.
❍
Key Length. Available key sizes for RSA are 512, 768, 1024, 2048, 4096, or
Custom. Available key sizes for DSA are 512, 1024, or Custom (which must
be in increments of 64 bits only).
See “Signing Key Type and Length” on page 91 for more information.
Click Next to continue.
14.
Message Digest Algorithm. Select the algorithm to use for computing the
certificate signature. The choices are: MD2, MD5, or SHA-1.
Click Next to continue.