Red Hat Certificate System 8.1
preparing for a PKI infrastructure
Edition 8.1.1
Legal Notice
Copyright © 2012 Red Hat, Inc.
This document is licensed by Red Hat under the Creative Commons Attribution-ShareAlike 3.0 Unported License. If you distribute this document, or a modified version of it, you must provide attribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hat trademarks must be removed.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
Java® is a registered trademark of Oracle and/or its affiliates.
XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.
MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
Node.js® is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.
The OpenStack® Word Mark and OpenStack Logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.
All other trademarks are the property of their respective owners.
December 20, 2013
Abstract
This guide covers the major PKI concepts and decisions areas for planning a PKI infrastructure.
This guide was updated for Errata RHSA-2012:1103.
- About This Guide
- I. Planning How to Deploy Red Hat Certificate System
- 1. Introduction to Public-Key Cryptography
- 2. Introduction to Red Hat Certificate System
- 3. Supported Standards and Protocols
- 4. Planning the Certificate System
- 4.1. Deciding on the Required Subsystems
- 4.2. Defining the Certificate Authority Hierarchy
- 4.3. Planning Security Domains
- 4.4. Determining the Requirements for Subsystem Certificates
- 4.4.1. Determining Which Certificates to Install
- 4.4.2. Planning the CA Distinguished Name
- 4.4.3. Setting the CA Signing Certificate Validity Period
- 4.4.4. Choosing the Signing Key Type and Length
- 4.4.5. Using Certificate Extensions
- 4.4.6. Using and Customizing Certificate Profiles
- 4.4.7. Planning Authentication Methods
- 4.4.8. Publishing Certificates and CRLs
- 4.4.9. Renewing or Reissuing CA Signing Certificates
- 4.5. Planning for Network and Physical Security
- 4.6. Tokens for Storing Certificate System Subsystem Keys and Certificates
- 4.7. Implementing a Common Criteria Environment
- 4.8. A Checklist for Planning the PKI
- II. Installing Red Hat Certificate System
- 5. Prerequisites and Preparation for Installation
- 5.1. Supported Platforms, Hardware, and Programs
- 5.2. Packages Installed on Red Hat Enterprise Linux
- 5.3. Before Installation: Setting up the Operating Environment
- 5.3.1. Installing the Required Java Development Kit (JDK)
- 5.3.2. Installing Apache (for the TPS)
- 5.3.3. Installing Red Hat Directory Server
- 5.3.4. Installing Additional Operating System Packages
- 5.3.5. Verifying Firewall Configuration and iptables
- 5.3.6. Enabling SELinux
- 5.3.7. Setting up Operating System Users and Groups
- 5.3.8. Using a Java Security Manager
- 6. Installing and Configuring Certificate System
- 7. Installing Red Hat Certificate System with SSL Connections to Red Hat Directory Server
- 8. Using Hardware Security Modules for Subsystem Security Databases
- 9. Installing an Instance with ECC Enabled
- 10. Cloning Subsystems
- 10.1. About Cloning
- 10.2. Exporting Keys from a Software Database
- 10.3. Cloning a CA
- 10.4. Updating CA-DRM Connector Information After Cloning
- 10.5. Cloning OCSP Subsystems
- 10.6. Cloning DRM Subsystems
- 10.7. Cloning TKS Subsystems
- 10.8. Converting Masters and Clones
- 10.9. Cloning a CA That Has Been Re-Keyed
- 10.10. Updating CA Clones
- 11. Silently Configuring Instances
- 12. Additional Installation Options
- 13. Updating and Removing Subsystem Packages
- 14. Troubleshooting Installation, Cloning, and Upgrade
- III. After Installing Red Hat Certificate System
- 15. After Configuration: Checklist of Configuration Areas for Deploying Certificate System
- 16. Basic Information for Using Certificate System
- A. Supported Algorithms and Curves
- B. Defining the Common Criteria Environment
- B.1. Common Criteria: Setup and Operations
- B.1.1. PKI Overview
- B.1.2. Security Objectives
- B.1.3. Security Requirements
- B.1.4. Target of Evaluation Security Environment Assumptions
- B.1.5. IT Environment Assumptions
- B.1.6. Red Hat Certificate System 8.1 Privileged Users and Groups (Roles)
- B.1.7. Understanding Setup of Common Criteria Evaluated Red Hat Certificate System 8.1
- B.1.8. Common Criteria Deployment Scenarios
- B.1.9. Understanding Subsystem Setup
- B.1.10. Reporting Security Flaws
- B.1.11. Relevant Links
- B.2. Example Common Criteria Installations
- B.3. Common Criteria: Security Environment Assumptions
- B.4. Common Criteria: Security Objectives
- B.5. Common Criteria: Security Requirements
- Glossary
- Index