Index

A

accelerators, Tokens for Storing Certificate System Subsystem Keys and Certificates
active logs
default file location, Logs
message categories, Services That Are Logged
adding new directory attributes, Adding New or Custom Attributes
agent certificate, User Certificates
agents
authorizing key recovery, Recovering Keys
port used for operations, Planning Ports
algorithm
cryptographic, Encryption and Decryption
archiving
rotated log files, Log File Rotation
Audit log
defined, Transactions Log
authentication
certificate-based, Certificate-Based Authentication
client and server, Authentication Confirms an Identity
password-based, Password-Based Authentication
See also client authentication, Certificate-Based Authentication
See also server authentication, Certificate-Based Authentication
automatic revocation checking, Enabling Automatic Revocation Checking on the CA

B

buffered logging, Buffered and Unbuffered Logging

C

CA
certificate, Types of Certificates
defined, A Certificate Identifies Someone or Something
hierarchies and root, CA Hierarchies
trusted, How CA Certificates Establish Trust
CA chaining, Linked CA
CA decisions for deployment
CA renewal, Renewing or Reissuing CA Signing Certificates
distinguished name, Planning the CA Distinguished Name
root versus subordinate, Defining the Certificate Authority Hierarchy
signing certificate, Setting the CA Signing Certificate Validity Period
signing key, Choosing the Signing Key Type and Length
CA hierarchy, Subordination to a Certificate System CA
root CA, Subordination to a Certificate System CA
subordinate CA, Subordination to a Certificate System CA
CA scalability, CA Cloning
CA signing certificate, CA Signing Certificates, Setting the CA Signing Certificate Validity Period
Certificate Manager
as root CA, Subordination to a Certificate System CA
as subordinate CA, Subordination to a Certificate System CA
CA hierarchy, Subordination to a Certificate System CA
CA signing certificate, CA Signing Certificates
chaining to third-party CAs, Linked CA
cloning, CA Cloning
KRA and, Planning for Lost Keys: Key Archival and Recovery
certificate profiles
Windows smart card login, Using the Windows Smart Card Logon Profile
certificate-based authentication
defined, Authentication Confirms an Identity
certificates
authentication using, Certificate-Based Authentication
CA certificate, Types of Certificates
chains, Certificate Chains
contents of, Contents of a Certificate
issuing of, Certificate Issuance
renewing, Certificate Expiration and Renewal
revoking, Certificate Expiration and Renewal
S/MIME, Types of Certificates
self-signed, CA Hierarchies
verifying a certificate chain, Verifying a Certificate Chain
changing
DER-encoding order of DirectoryString, Changing the DER-Encoding Order
ciphers
defined, Encryption and Decryption
client authentication
SSL/TLS client certificates defined, Types of Certificates
cloning, CA Cloning
configuration file, CS.cfg Files
CS.cfg, Overview of the CS.cfg Configuration File
format, Overview of the CS.cfg Configuration File
CRL signing certificate, Other Signing Certificates
CRLs
Certificate Manager support for, CRLs
publishing to online validation authority, OCSP Services
CS.cfg, CS.cfg Files
comments and TPS, Overview of the CS.cfg Configuration File

D

deployment planning
CA decisions
distinguished name, Planning the CA Distinguished Name
root versus subordinate, Defining the Certificate Authority Hierarchy
signing certificate, Setting the CA Signing Certificate Validity Period
signing key, Choosing the Signing Key Type and Length
token management, Smart Card Token Management with Certificate System
DER-encoding order of DirectoryString, Changing the DER-Encoding Order
digital signatures
defined, Digital Signatures
directory attributes
adding new, Adding New or Custom Attributes
supported in CS, Changing DN Attributes in CA-Issued Certificates
distinguished name (DN)
extending attribute support, Changing DN Attributes in CA-Issued Certificates
for CA, Planning the CA Distinguished Name

E

email, signed and encrypted, Signed and Encrypted Email
encryption
defined, Encryption and Decryption
public-key, Public-Key Encryption
symmetric-key, Symmetric-Key Encryption
Error log
defined, Tomcat Error and Access Logs
extending directory-attribute support in CS, Changing DN Attributes in CA-Issued Certificates
extensions
structure of, Structure of Certificate Extensions
external tokens
defined, Tokens for Storing Certificate System Subsystem Keys and Certificates

F

flush interval for logs, Buffered and Unbuffered Logging

H

hardware accelerators, Tokens for Storing Certificate System Subsystem Keys and Certificates
hardware tokens, Tokens for Storing Certificate System Subsystem Keys and Certificates
See external tokens, Tokens for Storing Certificate System Subsystem Keys and Certificates
how to search for keys, Archiving Keys

I

installation, Installing and Configuring Certificate System
planning, A Checklist for Planning the PKI
internal tokens, Tokens for Storing Certificate System Subsystem Keys and Certificates

K

key archival, Archiving Keys
how it works, Archiving Keys
how keys are stored, Archiving Keys
how to set up, Manually Setting up Key Archival
where keys are stored, Archiving Keys
key length, Choosing the Signing Key Type and Length
key recovery, Recovering Keys
how to set up, Setting up Agent-Approved Key Recovery Schemes
Key Recovery Authority
setting up
key archival, Manually Setting up Key Archival
key recovery, Setting up Agent-Approved Key Recovery Schemes
keys
defined, Encryption and Decryption
management and recovery, Key Management
KRA
Certificate Manager and, Planning for Lost Keys: Key Archival and Recovery

L

linked CA, Linked CA
location of
active log files, Logs
logging
buffered vs. unbuffered, Buffered and Unbuffered Logging
log files
archiving rotated files, Log File Rotation
default location, Logs
timing of rotation, Log File Rotation
log levels, Log Levels (Message Categories)
default selection, Log Levels (Message Categories)
how they relate to message categories, Log Levels (Message Categories)
significance of choosing the right level, Log Levels (Message Categories)
services that are logged, Services That Are Logged
types of logs, Logs
Audit, Transactions Log
Error, Tomcat Error and Access Logs

O

OCSP responder, OCSP Services
OCSP server, OCSP Services
OCSP signing certificate, Other Signing Certificates

P

password
using for authentication, Authentication Confirms an Identity
password-based authentication, defined, Password-Based Authentication
password.conf
configuring contents, Configuring the password.conf File
configuring location, Configuring the password.conf File
contents, Configuring the password.conf File
passwords
configuring the password.conf file, Configuring the password.conf File
for subsystem instances, Managing System Passwords
used by subsystem instances, Configuring the password.conf File
PKCS #11 support, Tokens for Storing Certificate System Subsystem Keys and Certificates
planning installation, A Checklist for Planning the PKI
ports
for agent operations, Planning Ports
how to choose numbers, Planning Ports
private key, defined, Public-Key Encryption
public key
defined, Public-Key Encryption
management, Key Management
publishing
of CRLs
to online validation authority, OCSP Services
queue, Enabling and Configuring a Publishing Queue
(see also publishing queue)
publishing queue, Enabling and Configuring a Publishing Queue
enabling, Enabling and Configuring a Publishing Queue

R

recovering users' private keys, Recovering Keys
root CA, Subordination to a Certificate System CA
root versus subordinate CA, Defining the Certificate Authority Hierarchy
rotating log files
archiving files, Log File Rotation
how to set the time, Log File Rotation
RSA, Choosing the Signing Key Type and Length

S

S/MIME certificate, Types of Certificates
self-signed certificate, CA Hierarchies
setting up
key archival, Manually Setting up Key Archival
key recovery, Setting up Agent-Approved Key Recovery Schemes
signing certificate
CA, Setting the CA Signing Certificate Validity Period
signing key, for CA, Choosing the Signing Key Type and Length
smart cards
Windows login, Using the Windows Smart Card Logon Profile
SSL/TLS
client certificates, Types of Certificates
SSL/TLS client certificate, SSL/TLS Server and Client Certificates
SSL/TLS server certificate, SSL/TLS Server and Client Certificates
subordinate CA, Subordination to a Certificate System CA
subsystems
configuring password file, Configuring the password.conf File

T

timing log rotation, Log File Rotation
Token Key Service, Smart Card Token Management with Certificate System
Token Processing System and, Smart Card Token Management with Certificate System
Token Processing System, Smart Card Token Management with Certificate System
scalability, Using Smart Cards
Token Key Service and, Smart Card Token Management with Certificate System
tokens
defined, Tokens for Storing Certificate System Subsystem Keys and Certificates
external, Tokens for Storing Certificate System Subsystem Keys and Certificates
internal, Tokens for Storing Certificate System Subsystem Keys and Certificates
viewing which tokens are installed, Viewing Tokens
Windows login, Using the Windows Smart Card Logon Profile
topology decisions, for deployment, Smart Card Token Management with Certificate System
TPS
comments in the CS.cfg file, Overview of the CS.cfg Configuration File
Windows smart card login, Using the Windows Smart Card Logon Profile
trusted CA, defined, How CA Certificates Establish Trust

U

unbuffered logging, Buffered and Unbuffered Logging
user certificate, User Certificates

W

Windows smart card login, Using the Windows Smart Card Logon Profile