Netscape Certificate Management System 6.2, Руководство администратора

Страница: 121 / 874

Configuring the Certificate Manager
Chapter 3 Certificate Manager 121
Also note that when a CA exhausts all its serial numbers, you can revive it by
changing the values in the “Next serial number” and “Ending serial number”
fields, followed by restarting the Certificate Manager.
Default Signing Algorithm section. Specifies the signing algorithm the
Certificate Manager should use for signing certificates. The choices are “MD2
with RSA”, “MD5 with RSA”, and “SHA1 with RSA”, if the CA’s signing key
type is RSA and “SHA1 with DSA”, if the CA’s signing key type is DSA.
Note that the signing algorithm specified in the Certificate Manager’s policy
configuration or certificate profile configuration overrides the algorithm you
select here.
4.
To save your changes, click Save.
Setting Up Authentication
The first step in configuring enrollment is setting up authentication. You can set up
more than one type of authentication. Each type you set up must be associated with
a particular form in the interface. If you are using the certificate profile feature for
enrollments, the forms are dynamically generated with the content being
determined by the inputs you set for a particular certificate profile. You can even
set up the same method of authentication and associated more than one form with
it. You might do this if you wanted to change other aspects of the enrollment.
For example, you might want to create an automated enrollment that requires
LDAP authentication. You have two classes of employees, permanent and
temporary. You want to issue both classes of employees certificates using LDAP
authentication, but you want to issue each of these classes certificates with different
validity periods and different extensions. You can create two different forms, both
using LDAP authentication, but each having different policies associated with the
form.
You can configure the enrollment method to be agent-approved or automated.
The agent-approved enrollment and CMC enroll methods are enabled and
configured when you install the Certificate Manager. In order to enable and
configure one of the automated enrollment methods, you need to enable and
configure that authentication instance. You can also provide certificate based
authentication for either agent-approved or automated enrollments. For detailed
information on setting up authentication, see Chapter 9, “Authentication.”