Netscape NETSCAPE MANAGEMENT SYSTEM 4.5, Инструкция по установке и настройке

Страница: 389 / 866

Privileged-User Types and Responsibilities
Chapter 13 Managing Privileged Users and Groups 389
Agent’s Certificate for SSL Client Authentication
To make a user an agent for a subsystem, one of the things you must do is store the
user’s client (personal) certificate information in the internal database of the
subsystem. For example, if you set up an agent for a Certificate Manager, you store
the agent’s client certificate in the internal database of that Certificate Manager.
Then, when the subsystem receives a request from the agent, it uses this certificate
to verify the authenticity of the request before servicing it. For details on how the
subsystem verifies the authenticity of a request from an agent, see “Authentication
of Agents” on page 512.
If the user you want to set up as an agent does not own a client certificate, ask the
user to get one. Depending on your company’s PKI policy, the user could get the
client certificate from either an internally deployed CA or any public CA.
Keep in mind that the CA that signs your agents’ certificates must be trusted by the
subsystem that processes requests sent by these agents; for example, if your
subsystems are set up not to trust public CAs, your agents should not get their
certificates signed by public CAs. Make sure that the CA’s certificate exists in the
subsystem’s certificate or trust database and that the certificate is valid and trusted.
To check whether or not the CA’s certificate exists in a subsystem’s trust database,
follow the instructions in “Viewing the Certificate Database Content” on page 502.
• If the CA’s certificate isn’t listed, follow the instructions in “Using the Wizard
to Install a Certificate or Certificate Chain” on page 471 and add the certificate
to the subsystem’s certificate database.
• If the CA’s certificate is listed but untrusted, follow the instructions in
“Changing the Trust Settings of a CA Certificate” on page 505 and change the
setting to trusted.
Getting an Agent’s Certificate from a Public CA
The following general guidelines explain how a user can get a client certificate
from a public CA and how you can copy that certificate (in base-64 encoded form)
to the internal database of the appropriate subsystem:
1.
The user sends a client certificate request to the public CA from the client
machine that he or she will use to access the subsystem from the Agent
Services interface. It is important that the user generate and submit this request
from the machine she or he will use later to access the subsystem, because part
of this request process generates a private key on the local machine.
Alternatively, if location independence is required, the user can use a
hardware token, such as a smart card, to generate and store the key pair (and
the certificate when the user receives it from the public CA).