Novell OPEN ENTERPRISE SERVER 2 SP2 - ADMINISTRATION, Руководство по внедрению, Страница: 226 / 288

226 OES 2 SP2: Planning and Implementation Guide
n
ov
do
cx (e
n)
22
Ju
n
e 20
09
22.1.2 OES 2 Certificate Management
OES 2 enhances certificate management as follows:
Š
“Installation of eDirectory Certificates” on page 226
Š “What Is Installed Where” on page 226
Š
“Novell Certificate Server” on page 227
Š “Server Self-Provisioning” on page 227
Š
“PKI Health Check” on page 227
Installation of eDirectory Certificates
As you install eDirectory
TM
and OES 2, by default all HTTPS services are configured to use
eDirectory certificates. This means that eDirectory is established as the Certificate Authority for the
tree you are installing into, and it will generate keys and certificates for the server and replace the
installed SLES certificates with the eDirectory certificates.
What Is Installed Where
Key and certificate files are installed in the following locations:
Table 22-1
File Locations
Location Details
/etc/ssl/certs
This is the default location of trusted root certificates for clients
on the server.
Most of the applications on the server are configured to use
this directory. For example, the LDAP client uses one or more
of the trusted certificates in this directory when establishing a
secure LDAP connection.
The OES 2 installation copies the eDirectory tree CA’s
certificate (
eDirCACert.pem ) here, thereby establishing the
CA as a trusted root.
Everyone (other) has rights to read the contents of this
directory.
/etc/ssl/servercerts The standard location for the server’s raw private key
(
serverkey.pem
) and certificates (
servercert.pem
).
Applications on the server, including OES 2 applications, are
configured to point to the files in this directory.
Only root and some specific groups can read the files in this
directory.