mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-12-03 02:25:34 +00:00
Added changes re PSM 1.4 for Communicator.
This commit is contained in:
cotter%netscape.com
parent
0ed89a88d2
commit
1550d26a70
@ -1,360 +1,296 @@
|
||||
<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
|
||||
<!DOCTYPE html PUBLIC "-//w3c//dtd html 4.0 transitional//en">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
|
||||
<meta name="GENERATOR" content="Mozilla/4.75 [en] (WinNT; U) [Netscape]">
|
||||
<meta name="Author" content="Sean Cotter">
|
||||
<title>Personal Security Manager Release Notes</title>
|
||||
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
|
||||
|
||||
<meta name="GENERATOR" content="Mozilla/4.75 [en] (WinNT; U) [Netscape]">
|
||||
|
||||
<meta name="Author" content="Sean Cotter">
|
||||
<title>Personal Security Manager Release Notes</title>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
<center>
|
||||
<h1>
|
||||
<img SRC="bannerrn.gif" height=32 width=468 align=ABSCENTER></h1></center>
|
||||
|
||||
<h1><img src="bannerrn.gif" height="32" width="468" align="Center"></h1>
|
||||
</center>
|
||||
<center>
|
||||
<h2>
|
||||
Netscape Personal Security Manager</h2></center>
|
||||
|
||||
<h2>Netscape Personal Security Manager</h2>
|
||||
</center>
|
||||
<center>
|
||||
<h2>
|
||||
Release 1.4</h2></center>
|
||||
|
||||
<h2>Release 1.4</h2>
|
||||
</center>
|
||||
<center>
|
||||
<h2>
|
||||
10/13/2000</h2></center>
|
||||
|
||||
<h2>12/18/2000</h2>
|
||||
</center>
|
||||
<center>
|
||||
<hr WIDTH="100%"></center>
|
||||
<hr width="100%"></center>
|
||||
These release notes contain the most recent information about this release
|
||||
of Netscape Personal Security Manager. Please read these notes before using
|
||||
the software.
|
||||
<p>These notes include information for IS professionals who are thoroughly
|
||||
familiar with security and public-key infrastructure (PKI) issues.
|
||||
<p>Use of this product is subject to the terms detailed in the license
|
||||
agreement accompanying Netscape 6.
|
||||
<p>
|
||||
<hr WIDTH="100%">
|
||||
<h2>
|
||||
Contents</h2>
|
||||
<a href="#Documentation">Documentation</a>
|
||||
<br><a href="#Changes Since PSM 1.3">Changes Since Personal Security Manager
|
||||
1.3</a>
|
||||
<br><a href="#Software/Hardware Requirements">Software/Hardware Requirements</a>
|
||||
<br><a href="#unpacking">Installing Personal Security Manager</a>
|
||||
<br><a href="#Using the Test Bed">Using Personal Security Manager</a>
|
||||
<br><a href="#Known Bugs/Issues for 14 Release">Known Bugs/Issues for Personal
|
||||
Security Manager 1.4</a>
|
||||
<br><a href="#Feedback">Feedback</a>
|
||||
<p>
|
||||
<hr WIDTH="100%">
|
||||
<h2>
|
||||
<a NAME="Documentation"></a>Documentation</h2>
|
||||
familiar with security and public-key infrastructure (PKI) issues.</p>
|
||||
<p>Use of this product is subject to the terms detailed in the license agreement
|
||||
at <a href="http://docs.iplanet.com/docs/manuals/psm/14/license.txt.">http://docs.iplanet.com/docs/manuals/psm/14/license.txt.</a></p>
|
||||
<p></p>
|
||||
<hr width="100%">
|
||||
<h2>Contents</h2>
|
||||
<a href="#Documentation">Documentation</a><br>
|
||||
<a href="#Changes Since PSM 1.3">Changes Since Personal Security Manager 1.3</a>
|
||||
<br>
|
||||
<a href="#Software/Hardware Requirements">Software/Hardware Requirements</a>
|
||||
<br>
|
||||
<a href="#unpacking">Installing Personal Security Manager</a><br>
|
||||
<a href="#Using the Test Bed">Using Personal Security Manager</a><br>
|
||||
<a href="#Known Bugs/Issues for 14 Release">Known Bugs/Issues for Personal
|
||||
Security Manager 1.4</a><br>
|
||||
<a href="#Feedback">Feedback</a>
|
||||
<p></p>
|
||||
<hr width="100%">
|
||||
<h2><a name="Documentation"></a>Documentation</h2>
|
||||
The following documentation is available with Personal Security Manager:
|
||||
<ul>
|
||||
<li>
|
||||
<a href="contents.htm">Personal Security Manager Help</a> -- This online
|
||||
<li><a href="contents.htm">Personal Security Manager Help</a> -- This online
|
||||
help system can also be accessed by clicking the Help button in any personal
|
||||
Security Manager window.</li>
|
||||
|
||||
<li>
|
||||
<a href="cmcjavascriptapi.html">JavaScript API for Client Certificate Management</a>
|
||||
-- This reference describes a new Javascript API for performing user certificate
|
||||
management operations with Personal Security Manager, including one-click
|
||||
issuance, forced certificate backup by end users, and automatic archival
|
||||
of encryption private keys.</li>
|
||||
<li><a href="cmcjavascriptapi.html">JavaScript API for Client Certificate
|
||||
Management</a> -- This reference describes a new Javascript API for performing
|
||||
user certificate management operations with Personal Security Manager, including
|
||||
one-click issuance, forced certificate backup by end users, and automatic
|
||||
archival of encryption private keys.</li>
|
||||
</ul>
|
||||
For the latest release notes, deployment guide, and other information,
|
||||
see <a href="http://docs.iPlanet.com/docs/manuals/psm.html">http://docs.iPlanet.com/docs/manuals/psm.html</a><a href="http://developer.iPlanet.com/docs/manuals/psm.html">.</a>
|
||||
<p>
|
||||
<hr WIDTH="100%">
|
||||
<h2>
|
||||
<a NAME="Changes Since PSM 1.3"></a>Changes Since Personal Security Manager
|
||||
For the latest release notes, deployment guide, and other information,see
|
||||
<a href="http://docs.iPlanet.com/docs/manuals/psm.html">http://docs.iPlanet.com/docs/manuals/psm.html</a><a href="http://developer.iPlanet.com/docs/manuals/psm.html">
|
||||
.</a>
|
||||
<p></p>
|
||||
<hr width="100%">
|
||||
<h2><a name="Changes Since PSM 1.3"></a>Changes Since Personal Security Manager
|
||||
1.3</h2>
|
||||
The <a href="http://www.ietf.org/rfc/rfc2246.txt">Transport Layer Security
|
||||
(TLS)</a> protocol is turned on by default in Personal Security Manager
|
||||
1.4. To turn TLS off, open Personal Security Manager, click the Advanced
|
||||
tab, click Options in the left frame, then deselect the checkbox labeled
|
||||
"Enable TLS."
|
||||
(TLS)</a> protocol is turned on by default in Personal Security Manager1.4.
|
||||
To turn TLS off, open Personal Security Manager, click the Advanced tab, click
|
||||
Options in the left frame, then deselect the checkbox labeled "Enable TLS."
|
||||
<p>TLS is an IETF standard based on the Secure Sockets Layer (SSL) protocol.
|
||||
It can be thought of as SSL version 3.1. Some servers that do not implement
|
||||
SSL correctly cannot negotiate the SSL handshake with client software (such
|
||||
as Personal Security Manager) that supports TLS. To allow Personal Security
|
||||
Manager to use SSL with such TLS-intolerant servers, you must disable TLS
|
||||
as described above.
|
||||
<p>Most other changes since Personal Security Manager 1.3 involve minor
|
||||
bug fixes and optimizations.
|
||||
<p>Netscape 6 and Mozilla do not supported signed or encrypted email. For
|
||||
this reason, features related to email certificates are not available in
|
||||
this release.
|
||||
<p>
|
||||
<hr WIDTH="100%">
|
||||
<h4>
|
||||
<a NAME="Software/Hardware Requirements"></a><font size=+2>Software/Hardware
|
||||
as described above.</p>
|
||||
<p>Most other changes since Personal Security Manager 1.3 involve minor bug
|
||||
fixes and optimizations.</p>
|
||||
<p>This version of Netscape Personal Security Manager ships with Netscape
|
||||
6 and also works with Mozilla and Communicator 4.7x. </p>
|
||||
<p></p>
|
||||
<hr width="100%">
|
||||
<h4><a name="Software/Hardware Requirements"></a><font size="+2">Software/Hardware
|
||||
Requirements</font></h4>
|
||||
<b>Operating systems supported:</b> Windows NT, Windows 95, Windows 98
|
||||
Windows 2000; Solaris 2.6, 2.7, 2.8; and Red Hat Linux 6.1.
|
||||
<p><b>Other software requirements: </b>This release has been tested with
|
||||
Mozilla and Netscape 6. It is not intended for use with Communicator.
|
||||
<br>
|
||||
<hr WIDTH="100%">
|
||||
<h2>
|
||||
<a NAME="unpacking"></a>Installing Personal Security Manager</h2>
|
||||
Personal Security Manager 1.4 is installed with Netscape 6. To install
|
||||
Personal Security Manager 1.4 with Mozilla, see <a href="http://docs.iplanet.com/docs/manuals/psm/psm-mozilla/index.html">http://docs.iplanet.com/docs/manuals/psm/psm-mozilla/index.html</a>.
|
||||
<p>The sections that follow describe how the Personal Security Manager
|
||||
files are installed with Netscape 6.
|
||||
<h3>
|
||||
Installing on Windows 95/98/2000/NT</h3>
|
||||
When you install Netscape 6 on Windows, Personal Security Manager is installed
|
||||
in the directory <tt>C:\Program Files\Common Files\Netscape Shared\Security\</tt>.
|
||||
<p><b>All Windows users:</b> Personal Security Manager 1.4 works with Mozilla
|
||||
and Netscape 6, but it is not currently supported for Communicator 4.x.
|
||||
Therefore, you should not attempt to run Personal Security Manager 1.4
|
||||
with Communicator 4.x.
|
||||
<p>If you have Personal Security Manager 1.3 installed for use with Communicator
|
||||
4.x and you want to install Netscape 6, you should first exit Communicator,
|
||||
then rename the directory <tt>C:\Program Files\Common Files\Netscape Shared\Security\</tt>
|
||||
to something else, such as <tt>SecurityC47</tt>. When you install Netscape
|
||||
6, a new <tt>Security</tt> directory will be created during the installation
|
||||
process.
|
||||
<p>If you want to run Communicator 4.x with Personal Security Manager 1.3
|
||||
after Netscape 6 has been installed, you should first exit Netscape 6,
|
||||
then rename the <tt>Security</tt> directory (which now contains the Personal
|
||||
Security Manager 1.4 files) to something else (such as <tt>SecurityN6</tt>)
|
||||
and rename your <tt>SecurityC47</tt> directory (which contains the Personal
|
||||
Security Manager 1.3 files) to Security. You can then launch Communicator
|
||||
as usual.
|
||||
<h3>
|
||||
Installing on Unix</h3>
|
||||
When you install Netscape 6 on Unix, Personal Security Manager is installed
|
||||
in a directory called <tt>psm</tt> in the same directory where the <tt>netscape</tt>
|
||||
executable resides.
|
||||
<br>
|
||||
<h3>
|
||||
Disabling Personal Security Manager</h3>
|
||||
To <b>disable</b> Personal Security Manager temporarily, exit Netscape
|
||||
6, then:
|
||||
<ul>
|
||||
<li>
|
||||
on Unix, remove the directory
|
||||
<tt>psm</tt> from the directory where the
|
||||
<tt>netscape</tt>
|
||||
executable resides.</li>
|
||||
<b>Operating systems supported:</b> Windows NT, Windows 95, Windows 98, Windows
|
||||
2000; Solaris 2.6, 2.7, 2.8; and Red Hat Linux 6.1.
|
||||
<p></p>
|
||||
<hr width="100%">
|
||||
<h2><a name="unpacking"></a>Installing Personal Security Manager</h2>
|
||||
Netscape Personal Security Manager 1.4 is installed with Netscape 6 and recent versions
|
||||
of Mozilla.
|
||||
|
||||
<li>
|
||||
on Windows, rename the directory <tt>C:\Program Files\Common Files\Netscape
|
||||
<p>When you install Netscape 6 on Windows, Personal Security Manager is installed
|
||||
in the directory <tt>C:\Program Files\Common Files\Netscape Shared\Security\</tt>.
|
||||
|
||||
<p>When you install Netscape 6 on Unix, Personal Security Manager is installed
|
||||
in a directory called <tt>psm</tt> in the same directory where the <tt>netscape</tt>
|
||||
executable resides.<br>
|
||||
|
||||
<p>The sections that follow describe how to install the Personal Security Manager
|
||||
files for use with Communicator 4.7x.</p>
|
||||
<h3>Installing on Windows 95/98/2000/NT for Use With Communicator 4.7x</h3>
|
||||
|
||||
To install Netscape Personal Security Manager on Windows 95/98/2000/NT for use with
|
||||
Communicator 4.7 or later, save the file in a convenient location with the
|
||||
specified filename, then drag the file's icon into a Navigator window (that
|
||||
is, a browser window displayed by Communicator). Dropping the file's icon
|
||||
over the browser window initiates SmartUpdate, which automatically installs
|
||||
Personal Security Manager. Afterinstallation is complete, exit Communicator
|
||||
and relaunch it. If your copy of Communicator is installed in the default
|
||||
location, SmartUpdate installs the Personal Security Manager files in the
|
||||
directory<tt>C:\Program Files\CommonFiles\Netscape Shared\Security\</tt>
|
||||
and adds the file <tt>cmnav.dll</tt>in the directory <tt>C:\Program Files\Netscape\Communicator\Program</tt>.<br>
|
||||
<h3>Installing on Unix for Use With Communicator 4.7x</h3>
|
||||
|
||||
To install Personal Security Manager for use with Communicator 4.7 or later on Unix, you
|
||||
must be logged in as the same Unix user you will be logged in as when you
|
||||
run Communicator. For the Unix installation to succeed, you must have write
|
||||
privileges for both the directory where the Netscape executable resides and
|
||||
the directory where the installation script creates the directory containing
|
||||
the Personal Security Manager files. To install Personal Security Manager for
|
||||
use with Communicator 4.7x, download the tar file for the version of the product
|
||||
that you want to install and follow these steps:<br>
|
||||
<ol>
|
||||
<li>Exit Communicator, if it is running.</li>
|
||||
<li>Decompress the downloaded file to some convenient location.</li>
|
||||
<li>Run the psm-install program.</li>
|
||||
</ol>
|
||||
The psm-install program allows you to specify the directory in which Personal
|
||||
Security Manager will be installed. In this release, you must install Personal
|
||||
Security Manager locally. To do so, you can either install it in the default
|
||||
location (<tt>/opt/netscape/security</tt>) or in some other local location. However,
|
||||
if you install Personal Security Manager anywhere other than the default
|
||||
location, Communicator must also be installed locally. To run Personal Security
|
||||
Manager on Unix, you must be logged in as the same Unix user you were logged
|
||||
in as when you installed it.<br>
|
||||
<h3>Disabling Personal Security Manager</h3>
|
||||
To <b>disable</b> Personal Security Manager temporarily, exit the browser,
|
||||
then:
|
||||
<ul>
|
||||
<li>on Unix, remove the directory<tt>psm</tt> from the directory where
|
||||
the<tt>netscape</tt>executable resides.</li>
|
||||
<li>on Windows, rename the directory <tt>C:\Program Files\Common Files\Netscape
|
||||
Shared\Security</tt> to something else.</li>
|
||||
</ul>
|
||||
|
||||
<hr WIDTH="100%">
|
||||
<h2>
|
||||
<a NAME="Using the Test Bed"></a>Using Personal Security Manager</h2>
|
||||
<hr width="100%">
|
||||
<h2><a name="Using the Test Bed"></a>Using Personal Security Manager</h2>
|
||||
The sections that follow describe how to test some of the features of Personal
|
||||
Security Manager that are available with this release:
|
||||
<ul>
|
||||
<li>
|
||||
<a href="#Start Up Personal Security Manager with">Start Up Personal Security
|
||||
Manager with Netscape 6</a></li>
|
||||
|
||||
<li>
|
||||
<a href="#Use SSL with Server Authentication">Test Basic SSL</a></li>
|
||||
|
||||
<li>
|
||||
<a href="#Get a Certificate">Get an SSL Client Certificate</a></li>
|
||||
|
||||
<li>
|
||||
<a href="#View Your Personal Certificate">View Your Certificate</a></li>
|
||||
|
||||
<li>
|
||||
<a href="#Using Your Personal Certificate for Client">Test Client Authentication</a></li>
|
||||
|
||||
<li>
|
||||
<a href="#Validate Certificates Using OSCP">Validate Certificates Using
|
||||
<li><a href="#Start Up Personal Security Manager with">Start Up Personal
|
||||
SecurityManager with Netscape 6</a></li>
|
||||
<li><a href="#Use SSL with Server Authentication">Test Basic SSL</a></li>
|
||||
<li><a href="#Get a Certificate">Get an SSL Client Certificate</a></li>
|
||||
<li><a href="#View Your Personal Certificate">View Your Certificate</a></li>
|
||||
<li><a href="#Using Your Personal Certificate for Client">Test Client Authentication</a></li>
|
||||
<li><a href="#Validate Certificates Using OSCP">Validate Certificates Using
|
||||
OCSP</a></li>
|
||||
</ul>
|
||||
The sections that follow briefly describe how to test some of the features
|
||||
listed above.
|
||||
<p>For information on the JavaScript API supported by Personal Security
|
||||
Manager, see <a href="cmcjavascriptapi.html">JavaScript API for Client
|
||||
Certificate Management</a> and the Personal Security Manager Deployment
|
||||
Guide. For the latest versions of these documents, see <a href="http://docs.iPlanet.com/docs/manuals/psm.html">http://docs.iPlanet.com/docs/manuals/psm.html</a>.
|
||||
<h3>
|
||||
<a NAME="Start Up Personal Security Manager with"></a>Use Personal Security
|
||||
<p>For information on the JavaScript API supported by Personal SecurityManager,
|
||||
see <a href="cmcjavascriptapi.html">JavaScript API for ClientCertificate
|
||||
Management</a> and the Personal Security Manager DeploymentGuide. For the
|
||||
latest versions of these documents, see <a href="http://docs.iPlanet.com/docs/manuals/psm.html">
|
||||
http://docs.iPlanet.com/docs/manuals/psm.html</a>.</p>
|
||||
<h3><a name="Start Up Personal Security Manager with"></a>Use Personal Security
|
||||
Manager with Netscape 6</h3>
|
||||
Personal Security Manager starts automatically the first time Netscape
|
||||
6 needs to perform some action involving security, such as handling an
|
||||
SSL session.
|
||||
Personal Security Manager starts automatically the first time Netscape 6
|
||||
needs to perform some action involving security, such as handling anSSL session.
|
||||
<p>Follow these steps to view your security settings and confirm that
|
||||
Personal Security Manager is running:
|
||||
Personal Security Manager is running:</p>
|
||||
<ol>
|
||||
<li>
|
||||
Launch Netscape 6.</li>
|
||||
|
||||
<li>
|
||||
Choose Security & Privacy from the Tasks menu, then choose Security
|
||||
<li>Launch Netscape 6.</li>
|
||||
<li>Choose Security & Privacy from the Tasks menu, then choose Security
|
||||
Manager to view your Personal Security Manager settings.</li>
|
||||
|
||||
<li>
|
||||
Close the Personal Security Manager window.</li>
|
||||
|
||||
<li>
|
||||
Go to the page <a href="psmtest.html">psmtest.html</a> (in the same directory
|
||||
as these release notes), then choose Page Source from the View menu to
|
||||
see the JavaScript code that a web programmer can use to detect Personal
|
||||
<li>Close the Personal Security Manager window.</li>
|
||||
<li>Go to the page <a href="psmtest.html">psmtest.html</a> (in the same
|
||||
directoryas these release notes), then choose Page Source from the View menu
|
||||
tosee the JavaScript code that a web programmer can use to detect Personal
|
||||
Security Manager and its version number.</li>
|
||||
</ol>
|
||||
Note that the version number has two parts. The first is the version of
|
||||
the PSM client library, and the second is the version of the PSM server
|
||||
library.
|
||||
<br>
|
||||
<h3>
|
||||
<a NAME="Use SSL with Server Authentication"></a>Test Basic SSL</h3>
|
||||
Go to any online store, banking service, brokerage account, or other web
|
||||
site that supports SSL. Verify that the lock in the lower-left corner of
|
||||
the browser window is closed when you reach the pages for which SSL should
|
||||
be enabled, for example a page where you are asked to give your credit
|
||||
card number.
|
||||
<h3>
|
||||
<a NAME="Get a Certificate"></a>Get an SSL Client Certificate</h3>
|
||||
Note that the version number has two parts. The first is the version ofthe
|
||||
PSM client library, and the second is the version of the PSM serverlibrary.
|
||||
<br>
|
||||
|
||||
<h3><a name="Use SSL with Server Authentication"></a>Test Basic SSL</h3>
|
||||
Go to any online store, banking service, brokerage account, or other website
|
||||
that supports SSL. Verify that the lock in the lower-left corner ofthe browser
|
||||
window is closed when you reach the pages for which SSL shouldbe enabled,
|
||||
for example a page where you are asked to give your creditcard number.
|
||||
<h3><a name="Get a Certificate"></a>Get an SSL Client Certificate</h3>
|
||||
Go to any public or private CA and apply for an SSL client certificate.
|
||||
<p>To test one-click certificate issuance, dual key-pair certificates,
|
||||
and other Personal Security Manager features, system administrators should
|
||||
download, install, and configure Netscape Certificate Management System.
|
||||
For complete CMS documentation and other information, see <a href="http://docs.iPlanet.com/docs/manuals/cms.html">http://docs.iPlanet.com/docs/manuals/cms.html</a>.
|
||||
To download the latest version of CMS, see <a href="http://www.iplanet.com/downloads/download/">http://www.iplanet.com/downloads/download/</a>.
|
||||
<h3>
|
||||
<a NAME="View Your Personal Certificate"></a>View Your Certificate</h3>
|
||||
<p>To test one-click certificate issuance, dual key-pair certificates,and
|
||||
other Personal Security Manager features, system administrators shoulddownload,
|
||||
install, and configure Netscape Certificate Management System.For complete
|
||||
CMS documentation and other information, see <a href="http://docs.iPlanet.com/docs/manuals/cms.html">
|
||||
http://docs.iPlanet.com/docs/manuals/cms.html</a>.To download the latest
|
||||
version of CMS, see <a href="http://www.iplanet.com/downloads/download/">
|
||||
http://www.iplanet.com/downloads/download/</a>.</p>
|
||||
<h3><a name="View Your Personal Certificate"></a>View Your Certificate</h3>
|
||||
After you have obtained a certificate, follow these steps to view it:
|
||||
<ol>
|
||||
<li>
|
||||
Click the Security icon in the Navigator toolbar.</li>
|
||||
|
||||
<li>
|
||||
Click the Certificates tab.</li>
|
||||
|
||||
<li>
|
||||
Click to select your certificate.</li>
|
||||
|
||||
<li>
|
||||
Click View.</li>
|
||||
<li>Click the Security icon in the Navigator toolbar.</li>
|
||||
<li>Click the Certificates tab.</li>
|
||||
<li>Click to select your certificate.</li>
|
||||
<li>Click View.</li>
|
||||
</ol>
|
||||
You should see information about your new certificate.
|
||||
<h3>
|
||||
<a NAME="Using Your Personal Certificate for Client"></a><font size=+1>Test
|
||||
Client Authentication</font></h3>
|
||||
Personal Security Manager allows the SSL server and client to negotiate
|
||||
which certificate to use, and in most cases they can agree on a single
|
||||
correct certificate for the client to present. When this happens, the user
|
||||
can access an SSL site that requires client authentication with zero additional
|
||||
clicks.
|
||||
<p>To test client authentication with Netscape Enterprise Server, system
|
||||
administrators should follow these steps:
|
||||
<h3><a name="Using Your Personal Certificate for Client"></a><font size="+1">
|
||||
TestClient Authentication</font></h3>
|
||||
Personal Security Manager allows the SSL server and client to negotiatewhich
|
||||
certificate to use, and in most cases they can agree on a singlecorrect certificate
|
||||
for the client to present. When this happens, the usercan access an SSL site
|
||||
that requires client authentication with zero additionalclicks.
|
||||
<p>To test client authentication with Netscape Enterprise Server, systemadministrators
|
||||
should follow these steps:</p>
|
||||
<ul>
|
||||
<li>
|
||||
Install an Enterprise Server and configure it for client authentication
|
||||
as described in <a href="http://docs.iplanet.com/docs/manuals/cms/41/dep_gide/entsrv.htm">Appendix
|
||||
D, Using SSL with Enterprise Server 3.x</a>, of <i>Netscape Certificate
|
||||
<li>Install an Enterprise Server and configure it for client authentication
|
||||
as described in <a href="http://docs.iplanet.com/docs/manuals/cms/41/dep_gide/entsrv.htm">
|
||||
AppendixD, Using SSL with Enterprise Server 3.x</a>, of <i>Netscape Certificate
|
||||
Management System Installation and Deployment Guide</i>.</li>
|
||||
|
||||
<li>
|
||||
Test the Enterprise Server installation as described at the end of Appendix
|
||||
D using Personal Security Manager.</li>
|
||||
<li>Test the Enterprise Server installation as described at the end of
|
||||
AppendixD using Personal Security Manager.</li>
|
||||
</ul>
|
||||
|
||||
<h3>
|
||||
<a NAME="Validate Certificates Using OSCP"></a>Validate Certificates Using
|
||||
OSCP</h3>
|
||||
<h3><a name="Validate Certificates Using OSCP"></a>Validate Certificates
|
||||
UsingOSCP</h3>
|
||||
Personal Security Manager supports the use of the On-Line Certificate Status
|
||||
Protocol (OSCP) to check the validity of certificates in real time. Information
|
||||
about this protocol and how configure Personal Security Manager 1.3 and
|
||||
Netscape Certificate Management System 4.2 to support it is available from
|
||||
<a href="http://docs.iPlanet.com/docs/manuals/psm/12/psmdply.htm">http://docs.iPlanet.com/docs/manuals/psm/12/psmdply.htm</a>
|
||||
about this protocol and how configure Personal Security Manager 1.3 andNetscape
|
||||
Certificate Management System 4.2 to support it is available from<a href="http://docs.iPlanet.com/docs/manuals/psm/12/psmdply.htm">
|
||||
http://docs.iPlanet.com/docs/manuals/psm/12/psmdply.htm</a>
|
||||
<p>It's important to note that Personal Security Manager will accept signatures
|
||||
from responders only under the following conditions:
|
||||
from responders only under the following conditions:</p>
|
||||
<ul>
|
||||
<li>
|
||||
The response was signed by a delegated responder--that is, the responder's
|
||||
<li>The response was signed by a delegated responder--that is, the responder's
|
||||
certificate was signed by the same CA as the certificate you're trying
|
||||
to verify and has the <tt>extendedKeyUsage</tt> bit set indicating that
|
||||
the certificate is an OCSP response signer. The certificate should be the
|
||||
same as a CA certificate with the addition of the <tt>extendedKeyUsage</tt>
|
||||
bit.</li>
|
||||
|
||||
<li>
|
||||
The user has designated a default responder in the OCSP Settings dialog
|
||||
to verify and has the <tt>extendedKeyUsage</tt> bit set indicating thatthe
|
||||
certificate is an OCSP response signer. The certificate should be thesame
|
||||
as a CA certificate with the addition of the <tt>extendedKeyUsage</tt>bit.</li>
|
||||
<li>The user has designated a default responder in the OCSP Settings dialog
|
||||
box (available from the Advanced tab under Options).</li>
|
||||
</ul>
|
||||
Common problems include the following:
|
||||
<ul>
|
||||
<li>
|
||||
Time drift between the client and server machine. Personal Security Manager
|
||||
expects the time of the response to be within the past 24 hours. If there
|
||||
is a difference in the clocks between the machine used to sign the response,
|
||||
so the response looks to Personal Security Manager like it was signed in
|
||||
the future, Personal Security Manager interprets this as an error. Run
|
||||
ntp on both machines to fix this problem.</li>
|
||||
|
||||
<li>
|
||||
The response doesn't include the certificates required to complete the
|
||||
chain needed to verify the signer's certificate. The client frequently
|
||||
<li>Time drift between the client and server machine. Personal Security
|
||||
Managerexpects the time of the response to be within the past 24 hours. If
|
||||
thereis a difference in the clocks between the machine used to sign the response,
|
||||
so the response looks to Personal Security Manager like it was signed inthe
|
||||
future, Personal Security Manager interprets this as an error. Runntp on
|
||||
both machines to fix this problem.</li>
|
||||
<li>The response doesn't include the certificates required to complete
|
||||
thechain needed to verify the signer's certificate. The client frequently
|
||||
doesn't have all the certificates in the database that are needed to verify
|
||||
the signer's certificate, in which case Personal Security Manager can't
|
||||
verify the signer's certificate and OCSP fails. Make sure the entire chain
|
||||
is included with every response. This is the safest way to avoid this problem.</li>
|
||||
|
||||
<li>
|
||||
If you are using ValiCert, misconfiguration may cause the Validation Authority
|
||||
not to send the certificate chain (including the CA root certificate and
|
||||
the OCSP responder's certificate) correctly.</li>
|
||||
the signer's certificate, in which case Personal Security Manager can'tverify
|
||||
the signer's certificate and OCSP fails. Make sure the entire chainis included
|
||||
with every response. This is the safest way to avoid this problem.</li>
|
||||
<li>If you are using ValiCert, misconfiguration may cause the Validation
|
||||
Authoritynot to send the certificate chain (including the CA root certificate
|
||||
andthe OCSP responder's certificate) correctly.</li>
|
||||
</ul>
|
||||
|
||||
<hr WIDTH="100%">
|
||||
<h2>
|
||||
<a NAME="Known Bugs/Issues for 14 Release"></a>Known Bugs/Issues for Personal
|
||||
Security Manager 1.4</h2>
|
||||
|
||||
<hr width="100%">
|
||||
<h2><a name="Known Bugs/Issues for 14 Release"></a>Known Bugs/Issues for
|
||||
Personal Security Manager 1.4</h2>
|
||||
<ul>
|
||||
<li>
|
||||
To run Personal Security Manager on Unix, you must be logged in as the
|
||||
same Unix user you were logged in as when Netscape 6 was installed.</li>
|
||||
|
||||
<li>
|
||||
FORTEZZA is not guaranteed to work with this release. [# 94220]</li>
|
||||
|
||||
<li>
|
||||
In some unusual circumstances you may encounter problems such as valid
|
||||
certificates not being verified or Netscape 6 freezing up. If you encounter
|
||||
<li>To run Personal Security Manager on Unix with Netscape 6 or Communicator,
|
||||
you must be logged in as thesame Unix user you were logged in as when the
|
||||
browser was installed.</li>
|
||||
<li>FORTEZZA is not guaranteed to work with this release. [# 94220]</li>
|
||||
<li>In some unusual circumstances you may encounter problems such as valid
|
||||
certificates not being verified or the browser freezing up. If you encounter
|
||||
a problem that doesn't appear to have a logical explanation, try the following
|
||||
as a last resort:</li>
|
||||
|
||||
<ol>
|
||||
<li>
|
||||
Exit Netscape 6, then relaunch it. If necessary, use Control-Alt-Delete
|
||||
<ol>
|
||||
<li>Exit the browser, then relaunch it. If necessary, use Control-Alt-Delete
|
||||
on Windows 95/98/2000/NT to bring up the Task Manager and click End Process
|
||||
for both <tt>psm.exe</tt> and <tt>netscp6.exe</tt>.</li>
|
||||
|
||||
<li>
|
||||
<b>Warning:</b> <b>Before taking this step, back up your own certificates
|
||||
<li><b>Warning:</b> <b>Before taking this step, back up your own certificates
|
||||
stored internally by Personal Security Manager.</b> If exiting and relaunching
|
||||
Netscape 6 doesn't take care of the problem, in some rare cases it may
|
||||
work to exit Netscape 6, then delete or rename your <tt>cert7.db</tt> and
|
||||
<tt>key3.db</tt>
|
||||
files (located in your user profile directory on Windows 95/98/2000/NT,
|
||||
or in the directory in which the Netscape or Mozilla executable resides
|
||||
on Unix) and relaunch the Netscape 6. You should also look for all other
|
||||
files in the same directory that begin with <tt>cert</tt> or
|
||||
<tt>key</tt>
|
||||
and end in <tt>.db</tt> and delete those files as well before relaunching
|
||||
Netscape 6.</li>
|
||||
</ol>
|
||||
the browser doesn't take care of the problem, in some rare cases it maywork
|
||||
to exit the browser, then delete or rename your <tt>cert7.db</tt> and<tt>
|
||||
key3.db</tt>files (located in your user profile directory on Windows 95/98/2000/NT,
|
||||
or in the directory in which the Netscape or Mozilla executable resideson
|
||||
Unix) and relaunch the browser. You should also look for all otherfiles in
|
||||
the same directory that begin with <tt>cert</tt> or<tt>key</tt>and end in
|
||||
<tt>.db</tt> and delete those files as well before relaunchingthe browser.</li>
|
||||
</ol>
|
||||
</ul>
|
||||
|
||||
<hr WIDTH="100%">
|
||||
<h2>
|
||||
<a NAME="Feedback"></a>Feedback</h2>
|
||||
To send feedback to the Personal Security Manager development team, send
|
||||
email to <a href="mailto:psmfeedback@netscape.com">psmfeedback@netscape.com</a>.
|
||||
<hr width="100%">
|
||||
<h2><a name="Feedback"></a>Feedback</h2>
|
||||
To send feedback to the Personal Security Manager development team, send email
|
||||
to <a href="mailto:psmfeedback@netscape.com">psmfeedback@netscape.com</a>.
|
||||
Feedback back sent to this address will be read by the team, but you will
|
||||
not receive a personal response.
|
||||
</body>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user