Red Hat Certificate System 8.1.1
for administrators
Edition 8.1.1
Legal Notice
Copyright © 2009 Red Hat, Inc..
This document is licensed by Red Hat under the Creative Commons Attribution-ShareAlike 3.0 Unported License. If you distribute this document, or a modified version of it, you must provide attribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hat trademarks must be removed.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
Java® is a registered trademark of Oracle and/or its affiliates.
XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.
MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
Node.js® is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.
The OpenStack® Word Mark and OpenStack Logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.
All other trademarks are the property of their respective owners.
December 20, 2013
Abstract
This manual covers all aspects of installing, configuring, and managing Certificate System subsystems. It also covers management tasks such as adding users; requesting, renewing, and revoking certificates; publishing CRLs; and managing smart cards. This guide is intended for Certificate System administrators.
- About This Guide
- 1. Overview of Red Hat Certificate System Subsystems
- I. Setting up Certificate Services
- 2. Making Rules for Issuing Certificates
- 2.1. About Certificate Profiles
- 2.2. Setting up Certificate Profiles
- 2.3. Configuring Custom Enrollment Profiles to Use with an RA
- 2.4. Configuring Renewal Profiles
- 2.5. Managing Smart Card CA Profiles
- 2.6. Setting the Signing Algorithms for Certificates
- 2.7. Managing CA-Related Profiles
- 2.8. Managing Subject Names and Subject Alternative Names
- 3. Setting up Key Archival and Recovery
- 4. Requesting, Enrolling, and Managing Certificates
- 4.1. About Enrolling and Renewing Certificates
- 4.2. Configuring Internet Explorer to Enroll Certificates
- 4.3. Requesting and Receiving Certificates
- 4.4. Signing Files with Certificates
- 4.5. Performing Bulk Issuance
- 4.6. Enrolling a Certificate on a Cisco Router
- 4.7. Configuring and Using the Auto Enrollment Proxy
- 4.8. Renewing Certificates
- 5. Using and Configuring the Token Management System: TPS, TKS, and Enterprise Security Client
- 5.1. Configuring TPS Smart Card Operation Policies
- 5.2. Mapping Token Types and Policies to Specified Smart Cards
- 5.3. Creating Custom User Token Profiles
- 5.4. Allowing Token Renewal
- 5.5. Changing the Token Policy
- 5.6. Defining Specific Certificates to Add or Recover on a Token
- 5.7. Setting Token Status Transitions
- 5.8. Automating Encryption Key Recovery
- 5.9. Routing Revocation Requests to Different CAs
- 5.10. Managing Shared Keys
- 5.10.1. Generating Master Keys
- 5.10.2. Generating and Transporting Wrapped Master Keys
- 5.10.3. Using HSM for Generating Keys
- 5.10.4. Updating Master Key Versions and Associating the Master Key with Its Version
- 5.10.5. Configuring Symmetric Key Changeover
- 5.10.6. Troubleshooting Master Key and HSM Problems
- 5.11. Configuring the TPS
- 5.11.1. Configuring the TPS Administrative UI
- 5.11.2. Enabling SSL for TPS-Enterprise Security Client Connections
- 5.11.3. Configuring the Channels between the TPS and Tokens
- 5.11.4. Configuring or Disabling LDAP Authentication
- 5.11.5. Configuring the Token Database
- 5.11.6. Configuring Server-Side Key Generation and Archival of Encryption Keys
- 5.11.7. Setting TPS Server Password Lengths
- 5.11.8. Setting TPS Server Search Configuration
- 5.11.9. Configuring IPv6 Support
- 5.12. Configuring Connections to Other Subsystems
- 5.13. Potential Token Operation Errors
- 6. Revoking Certificates and Issuing CRLs
- 6.1. About Revoking Certificates
- 6.2. Performing a CMC Revocation
- 6.3. Issuing CRLs
- 6.4. Setting Full and Delta CRL Schedules
- 6.5. Enabling Revocation Checking
- 6.6. Using the Online Certificate Status Protocol Responder
- 6.6.1. Setting up the OCSP Responder
- 6.6.2. Identifying the CA to the OCSP Responder
- 6.6.3. Setting the Response for Bad Serial Numbers
- 6.6.4. Enabling the Certificate Manager's Internal OCSP Service
- 6.6.5. Submitting OCSP Requests Using the GET Method
- 6.6.6. Setting up a Redirect for Certificates Issued in Certificate System 7.1 and Earlier
- II. Additional Configuration to Manage CA Services
- 7. Publishing Certificates and CRLs
- 7.1. About Publishing
- 7.2. Configuring Publishing to a File
- 7.3. Configuring Publishing to an OCSP
- 7.4. Configuring Publishing to an LDAP Directory
- 7.5. Creating Rules
- 7.6. Enabling Publishing
- 7.7. Enabling a Publishing Queue
- 7.8. Setting up Resumable CRL Downloads
- 7.9. Publishing Cross-Pair Certificates
- 7.10. Testing Publishing to Files
- 7.11. Viewing Certificates and CRLs Published to File
- 7.12. Updating Certificates and CRLs in a Directory
- 7.13. Registering Custom Mapper and Publisher Plug-in Modules
- 8. Authentication for Enrolling Certificates
- 9. Using Automated Notifications
- 10. Setting Automated Jobs
- 10.1. About Automated Jobs
- 10.2. Setting up the Job Scheduler
- 10.3. Setting up Specific Jobs
- 10.3.1. Configuring Specific Jobs Using the Certificate Manager Console
- 10.3.2. Configuring Jobs by Editing the Configuration File
- 10.3.3. Configuration Parameters of certRenewalNotifier
- 10.3.4. Configuration Parameters of requestInQueueNotifier
- 10.3.5. Configuration Parameters of publishCerts
- 10.3.6. Configuration Parameters of unpublishExpiredCerts
- 10.3.7. Frequency Settings for Automated Jobs
- 10.4. Registering a Job Module
- III. Managing the Subsystem Instances
- 11. The Certificate System Configuration Files
- 12. Basic Subsystem Management
- 12.1. Starting and Stopping Subsystem Instances
- 12.2. Opening Subsystem Consoles and Services
- 12.3. Customizing Web Services
- 12.4. Running Subsystems under a Java Security Manager
- 12.5. Configuring Ports
- 12.6. Configuring the LDAP Database
- 12.7. Searching the SQLite Database
- 12.8. Viewing Security Domain Configuration
- 12.9. Managing the SELinux Policies for Subsystems
- 12.10. Backing up and Restoring Certificate System
- 12.11. Running Self-Tests
- 12.12. Configuring POSIX System ACLs
- 13. Managing Certificate System Users and Groups
- 13.1. About Authorization
- 13.2. Default Groups
- 13.3. Disabling Multi-Roles Support
- 13.4. Managing Users and Groups for a CA, OCSP, DRM, or TKS
- 13.5. Creating and Managing Users and Groups for an RA
- 13.6. Creating and Managing Users for a TPS
- 13.7. Configuring Access Control for Users for the CA, OCSP, DRM, and TKS
- 14. Configuring Subsystem Logs
- 15. Managing Subsystem Certificates
- 15.1. Required Subsystem Certificates
- 15.1.1. Certificate Manager Certificates
- 15.1.2. RA Certificates
- 15.1.3. Online Certificate Status Manager Certificates
- 15.1.4. Data Recovery Manager Certificates
- 15.1.5. TKS Certificates
- 15.1.6. TPS Certificates
- 15.1.7. About Subsystem Certificate Key Types
- 15.1.8. Using an HSM to Store Subsystem Certificates
- 15.2. Requesting Certificates through the Console
- 15.3. Renewing Subsystem Certificates
- 15.4. Changing the Names of Subsystem Certificates
- 15.5. Using Cross-Pair Certificates
- 15.6. Managing the Certificate Database
- 15.7. Changing the Trust Settings of a CA Certificate
- 15.8. Managing Tokens Used by the Subsystems
- IV. References
- A. Certificate Profile Input and Output Reference
- A.1. Input Reference
- A.1.1. Certificate Request Input
- A.1.2. CMC Certificate Request Input
- A.1.3. Dual Key Generation Input
- A.1.4. File-Signing Input
- A.1.5. Image Input
- A.1.6. Key Generation Input
- A.1.7. nsHKeyCertRequest (Token Key) Input
- A.1.8. nsNKeyCertRequest (Token User Key) Input
- A.1.9. Serial Number Renewal Input
- A.1.10. Subject DN Input
- A.1.11. Subject Name Input
- A.1.12. Submitter Information Input
- A.2. Output Reference
- B. Defaults, Constraints, and Extensions for Certificates and CRLs
- B.1. Defaults Reference
- B.1.1. Authority Info Access Extension Default
- B.1.2. Authority Key Identifier Extension Default
- B.1.3. Authentication Token Subject Name Default
- B.1.4. Basic Constraints Extension Default
- B.1.5. CA Validity Default
- B.1.6. Certificate Policies Extension Default
- B.1.7. CRL Distribution Points Extension Default
- B.1.8. Extended Key Usage Extension Default
- B.1.9. Freshest CRL Extension Default
- B.1.10. Generic Extension Default
- B.1.11. Inhibit Any-Policy Extension Default
- B.1.12. Issuer Alternative Name Extension Default
- B.1.13. Key Usage Extension Default
- B.1.14. Name Constraints Extension Default
- B.1.15. Netscape Certificate Type Extension Default
- B.1.16. Netscape Comment Extension Default
- B.1.17. No Default Extension
- B.1.18. OCSP No Check Extension Default
- B.1.19. Policy Constraints Extension Default
- B.1.20. Policy Mappers Extension Default
- B.1.21. Private Key Usage Period Extension Default
- B.1.22. Signing Algorithm Default
- B.1.23. Subject Alternative Name Extension Default
- B.1.24. Subject Directory Attributes Extension Default
- B.1.25. Subject Info Access Extension Default
- B.1.26. Subject Key Identifier Extension Default
- B.1.27. Subject Name Default
- B.1.28. User Key Default
- B.1.29. User Signing Algorithm Default
- B.1.30. User Subject Name Default
- B.1.31. User Validity Default
- B.1.32. User Supplied Extension Default
- B.1.33. Validity Default
- B.2. Constraints Reference
- B.2.1. Basic Constraints Extension Constraint
- B.2.2. CA Validity Constraint
- B.2.3. Extended Key Usage Extension Constraint
- B.2.4. Extension Constraint
- B.2.5. Key Constraint
- B.2.6. Key Usage Extension Constraint
- B.2.7. Netscape Certificate Type Extension Constraint
- B.2.8. No Constraint
- B.2.9. Renewal Grace Period Constraint
- B.2.10. Signing Algorithm Constraint
- B.2.11. Subject Name Constraint
- B.2.12. Unique Key Constraint
- B.2.13. Unique Subject Name Constraint
- B.2.14. Validity Constraint
- B.3. Standard X.509 v3 Certificate Extension Reference
- B.3.1. authorityInfoAccess
- B.3.2. authorityKeyIdentifier
- B.3.3. basicConstraints
- B.3.4. certificatePoliciesExt
- B.3.5. CRLDistributionPoints
- B.3.6. extKeyUsage
- B.3.7. issuerAltName Extension
- B.3.8. keyUsage
- B.3.9. nameConstraints
- B.3.10. OCSPNocheck
- B.3.11. policyConstraints
- B.3.12. policyMappings
- B.3.13. privateKeyUsagePeriod
- B.3.14. subjectAltName
- B.3.15. subjectDirectoryAttributes
- B.3.16. subjectKeyIdentifier
- B.4. CRL Extensions
- C. Publishing Module Reference
- D. ACL Reference
- D.1. About ACL Configuration Files
- D.2. Common ACLs
- D.2.1. certServer.acl.configuration
- D.2.2. certServer.admin.certificate
- D.2.3. certServer.auth.configuration
- D.2.4. certServer.clone.configuration.GetConfigEntries
- D.2.5. certServer.clone.configuration.UpdateNumberRange
- D.2.6. certServer.general.configuration
- D.2.7. certServer.log.configuration
- D.2.8. certServer.log.configuration.fileName
- D.2.9. certServer.log.content.system
- D.2.10. certServer.log.content.transactions
- D.2.11. certServer.log.content.signedAudit
- D.2.12. certServer.registry.configuration
- D.3. Certificate Manager-Specific ACLs
- D.3.1. certServer.admin.ocsp
- D.3.2. certServer.ca.certificate
- D.3.3. certServer.ca.certificates
- D.3.4. certServer.ca.configuration
- D.3.5. certServer.ca.connector
- D.3.6. certServer.ca.connectorInfo
- D.3.7. certServer.ca.crl
- D.3.8. certServer.ca.directory
- D.3.9. certServer.ca.group
- D.3.10. certServer.ca.ocsp
- D.3.11. certServer.ca.profile
- D.3.12. certServer.ca.profiles
- D.3.13. certServer.ca.registerUser
- D.3.14. certServer.ca.request.enrollment
- D.3.15. certServer.ca.request.profile
- D.3.16. certServer.ca.requests
- D.3.17. certServer.ca.systemstatus
- D.3.18. certServer.ee.certchain
- D.3.19. certServer.ee.certificate
- D.3.20. certServer.ee.certificates
- D.3.21. certServer.ee.crl
- D.3.22. certServer.ee.profile
- D.3.23. certServer.ee.profiles
- D.3.24. certServer.ee.request.ocsp
- D.3.25. certServer.ee.request.revocation
- D.3.26. certServer.ee.requestStatus
- D.3.27. certServer.job.configuration
- D.3.28. certServer.profile.configuration
- D.3.29. certServer.publisher.configuration
- D.3.30. certServer.securitydomain.domainxml
- D.4. Data Recovery Manager-Specific ACLs
- D.4.1. certServer.job.configuration
- D.4.2. certServer.kra.certificate.transport
- D.4.3. certServer.kra.configuration
- D.4.4. certServer.kra.connector
- D.4.5. certServer.kra.GenerateKeyPair
- D.4.6. certServer.kra.getTransportCert
- D.4.7. certServer.kra.group
- D.4.8. certServer.kra.key
- D.4.9. certServer.kra.keys
- D.4.10. certServer.kra.registerUser
- D.4.11. certServer.kra.request
- D.4.12. certServer.kra.request.status
- D.4.13. certServer.kra.requests
- D.4.14. certServer.kra.systemstatus
- D.4.15. certServer.kra.TokenKeyRecovery
- D.5. Online Certificate Status Manager-Specific ACLs
- D.6. Token Key Service-Specific ACLs
- 16. Troubleshooting
- Glossary
- Index