Netscape Certificate Management System 6.2, Руководство администратора

Страница: 102 / 874

Installing a Certificate Manager
102 Netscape Certificate Management System Administrator’s Guide • June 2003
15.
Subject Name for Certificate Manager CA Signing Certificate. Type values
for the subject DN components; these values identify the subordinate CA
signing certificate.
A DN is a series of name-value pairs that in combination uniquely identify an
entity. The subject DN identifies the CA signing certificate. You are not
required to enter all the values.
See “CA’s Distinguished Name” on page 90 for more information.
Click Next to continue.
16.
Validity Period for Certificate Manager CA Signing Certificate. Select the
validity period for the subordinate CA signing certificate. The default validity
is two years. The validity period determines how soon you will have to renew
the certificate, which can be a complex procedure.
See “CA Signing Certificate’s Validity Period” on page 90 for more
information.
Click Next to continue.
17.
Certificate Extensions for Certificate Manager CA Signing Certificate. Select
the required extensions. The default settings should work for most
deployments. If necessary, you can add an additional extension by pasting its
base-64 encoding in the space provided on this screen.
CMS provides command-line tools for generating extensions to include in CA
and other certificate requests. For details about these tools, check this directory:
<server_root>/bin/cert/tools
Note that the certificate extension text field accepts a single extension blob. If
you want to add multiple extensions, you should use the
ExtJoiner
program,
which is also provided in the
tools
directory. For details about using the
ExtJoiner
program, see Chapter 5, “Extension Joiner Tool” of CMS
Command-Line Tools Guide.
For more information about extensions, see Appendix G, “Certificate and CRL
Extensions.”
Click Next to continue.
18.
Certificate Manager CA Signing Certificate Creation. This is an informational
screen that tells you that the wizard has all the information required to
generate the key pair and certificate request. In the previous screen, if you
chose to include the Subject Key Identifier extension in the certificate, you’ll be
given the choice to select the format for the certificate request. Otherwise, the
request format will be PKCS #10.