Red Hat Certificate System 8.1

Managing Smart Cards with the Enterprise Security Client

for smart cards and single sign-on

Edition 1

Jack Magne Engineering

Ella Deon Lackey

Legal Notice

Copyright © 2012 Red Hat, Inc..
This document is licensed by Red Hat under the Creative Commons Attribution-ShareAlike 3.0 Unported License. If you distribute this document, or a modified version of it, you must provide attribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hat trademarks must be removed.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
Java® is a registered trademark of Oracle and/or its affiliates.
XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.
MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
Node.js® is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.
The OpenStack® Word Mark and OpenStack Logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.
All other trademarks are the property of their respective owners.
January 31, 2012

Abstract

This guide is for regular users of Certificate System subsystems. It explains how to manage personal certificates and keys using the Enterprise Security Client, a simple interface which formats and manages smart cards.
About This Guide
1. What Is in This Guide
2. Additional Reading
3. Examples and Formatting
3.1. Formatting for Examples and Commands
3.2. Tool Locations
3.3. Guide Formatting
4. Giving Feedback
5. Document History
1. Introduction to the Enterprise Security Client
1.1. Red Hat Enterprise Linux, Single Sign-On, and Authentication
1.2. Red Hat Certificate System and the Enterprise Security Client
1.3. The Enterprise Security Client and the Windows Cryptographic Service Provider
1.4. About the Mac TokenD Component
2. Installing the Enterprise Security Client
2.1. Supported Platforms for the Client
2.2. Supported Smart Cards
2.3. Installing and Uninstalling the Enterprise Security Client on Red Hat Enterprise Linux
2.3.1. Installing the Client
2.3.2. Uninstalling on Red Hat Enterprise Linux
2.4. Installing and Uninstalling on Windows
2.4.1. Installing the Client
2.4.2. Installing on Windows with User-Defined Preferences
2.4.3. Uninstalling the Client
2.5. Installing and Uninstalling the Enterprise Security Client on Mac OS X
2.5.1. Installing the Client
2.5.2. Uninstalling the Client
3. Using the Enterprise Security Client
3.1. Tray Icons for the Enterprise Security Client
3.2. Launching Enterprise Security Client
3.2.1. Opening the Enterprise Security Client on Red Hat Enterprise Linux
3.2.2. Opening the Enterprise Security Client on Microsoft Windows
3.2.3. Opening the Enterprise Security Client on Mac OS X
3.3. Configuring Phone Home
3.3.1. About Phone Home Profiles
3.3.2. Setting Global Phone Home Information
3.3.3. Adding Phone Home Information to a Token Manually
3.3.4. Configuring the TPS to Use Phone Home
3.4. Setting up Users to Be Enrolled
3.5. Enrolling a Smart Card Automatically
3.6. Managing Smart Cards
3.6.1. Formatting the Smart Card
3.6.2. Resetting a Smart Card Password
3.6.3. Viewing Certificates
3.6.4. Importing CA Certificates
3.6.5. Adding Exceptions for Servers
3.6.6. Enrolling Smart Cards
3.7. Verifying That the Mac TokenD Is Working Properly
3.8. Diagnosing Problems
3.8.1. Errors
3.8.2. Events
4. Using Security Officer Mode
4.1. Enabling Security Officer Mode
4.2. Enrolling a New Security Officer
4.3. Using Security Officers to Manage Users
4.3.1. Enrolling a New User
4.3.2. Performing Other Security Officer Tasks
4.3.3. Formatting an Existing Security Officer Smart Card
5. Using Smart Cards for Web and Mail Clients
5.1. Setting up Browsers to Support SSL for Tokens
5.2. Using the Certificates on Tokens for Mail Clients
5.3. Setting up Mail and Browser Clients on Mac OS X
6. Setting up Enterprise Security Client
6.1. Overview of Enterprise Security Client Configuration
6.1.1. About the Preferences Configuration Files
6.1.2. About the XUL and JavaScript Files in the Enterprise Security Client
6.1.3. Enterprise Security Client File Locations
6.2. Configuring SSL Connections with the TPS
6.3. Using Shared Security Databases
6.4. Customizing the Smart Card Enrollment User Interface
6.5. Disabling LDAP Authentication for Token Operations