Netscape Certificate Management System 6.2, Руководство администратора

Страница: 230 / 874

Configuring Key Archival and Recovery Process
230 Netscape Certificate Management System Administrator’s Guide • June 2003
• The key archival option—this must be included in the certificate enrollment
form that your users use to request certificates.
• The Data Recovery Manager’s transport certificate—this must also be included
in the certificate enrollment form (ProfileSelect.template). The Data Recovery
Manager uses it to encrypt the end-entity’s encryption private key with the
public key in the transport certificate before sending the end-entity’s key to its
key repository. For information about the key repository, see “Where the Keys
are Stored” on page 200.
Make sure that the transport certificate, in its base-64 encoded format, is
embedded in the form. Otherwise, the Data Recovery Manager will fail to
archive end-entity’s keys.
Note that the JavaScript method includes parameters for specifying various things.
You are required to update the following information only:
• The Data Recovery Manager’s transport certificate.
• The algorithm, length, type, and usage for end-entity’s key pairs. When you
update this information, the key archival option is automatically set. For
information on specifying the key type, length, and algorithm, see
generateCRMFRequest()
in Javascript API for Client Certificate Management.
This document is located where you extracted Personal Security Manager files
after downloading it from the web site.
The steps that follow explain how to do this.
1.
Copy the transport certificate in its base-64 encoded format.
The transport certificate is stored in the Data Recovery Manager’s certificate
database. If the transport certificate is signed by a Certificate Manager, then a
copy of the certificate is also available with the Certificate Manager. Follow the
instructions as appropriate.
To copy the transport certificate information from a Certificate Manager’s
database:
a.
Open a web browser window.
b.
Go to the end-entity page hosted by the Certificate Manager.
c.
Click the Retrieval tab.
d.
List or search for the transport certificate.