mirror of
https://github.com/mozilla/gecko-dev.git
synced 2025-02-06 14:44:26 +00:00
362 lines
15 KiB
HTML
362 lines
15 KiB
HTML
<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
|
|
<html>
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
|
|
<meta name="GENERATOR" content="Mozilla/4.75 [en] (WinNT; U) [Netscape]">
|
|
<meta name="Author" content="Sean Cotter">
|
|
<title>Personal Security Manager Release Notes</title>
|
|
</head>
|
|
<body>
|
|
|
|
<center>
|
|
<h1>
|
|
<img SRC="bannerrn.gif" height=32 width=468 align=ABSCENTER></h1></center>
|
|
|
|
<center>
|
|
<h2>
|
|
Netscape Personal Security Manager</h2></center>
|
|
|
|
<center>
|
|
<h2>
|
|
Release 1.4</h2></center>
|
|
|
|
<center>
|
|
<h2>
|
|
10/13/2000</h2></center>
|
|
|
|
<center>
|
|
<hr WIDTH="100%"></center>
|
|
These release notes contain the most recent information about this release
|
|
of Netscape Personal Security Manager. Please read these notes before using
|
|
the software.
|
|
<p>These notes include information for IS professionals who are thoroughly
|
|
familiar with security and public-key infrastructure (PKI) issues.
|
|
<p>Use of this product is subject to the terms detailed in the license
|
|
agreement accompanying Netscape 6.
|
|
<p>
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
Contents</h2>
|
|
<a href="#Documentation">Documentation</a>
|
|
<br><a href="#Changes Since PSM 1.3">Changes Since Personal Security Manager
|
|
1.3</a>
|
|
<br><a href="#Software/Hardware Requirements">Software/Hardware Requirements</a>
|
|
<br><a href="#unpacking">Installing Personal Security Manager</a>
|
|
<br><a href="#Using the Test Bed">Using Personal Security Manager</a>
|
|
<br><a href="#Known Bugs/Issues for 14 Release">Known Bugs/Issues for Personal
|
|
Security Manager 1.4</a>
|
|
<br><a href="#Feedback">Feedback</a>
|
|
<p>
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="Documentation"></a>Documentation</h2>
|
|
The following documentation is available with Personal Security Manager:
|
|
<ul>
|
|
<li>
|
|
<a href="contents.htm">Personal Security Manager Help</a> -- This online
|
|
help system can also be accessed by clicking the Help button in any personal
|
|
Security Manager window.</li>
|
|
|
|
<li>
|
|
<a href="cmcjavascriptapi.html">JavaScript API for Client Certificate Management</a>
|
|
-- This reference describes a new Javascript API for performing user certificate
|
|
management operations with Personal Security Manager, including one-click
|
|
issuance, forced certificate backup by end users, and automatic archival
|
|
of encryption private keys.</li>
|
|
</ul>
|
|
For the latest release notes, deployment guide, and other information,
|
|
see <a href="http://docs.iPlanet.com/docs/manuals/psm.html">http://docs.iPlanet.com/docs/manuals/psm.html</a><a href="http://developer.iPlanet.com/docs/manuals/psm.html">.</a>
|
|
<p>
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="Changes Since PSM 1.3"></a>Changes Since Personal Security Manager
|
|
1.3</h2>
|
|
The <a href="http://www.ietf.org/rfc/rfc2246.txt">Transport Layer Security
|
|
(TLS)</a> protocol is turned on by default in Personal Security Manager
|
|
1.4. To turn TLS off, open Personal Security Manager, click the Advanced
|
|
tab, click Options in the left frame, then deselect the checkbox labeled
|
|
"Enable TLS."
|
|
<p>TLS is an IETF standard based on the Secure Sockets Layer (SSL) protocol.
|
|
It can be thought of as SSL version 3.1. Some servers that do not implement
|
|
SSL correctly cannot negotiate the SSL handshake with client software (such
|
|
as Personal Security Manager) that supports TLS. To allow Personal Security
|
|
Manager to use SSL with such TLS-intolerant servers, you must disable TLS
|
|
as described above.
|
|
<p>Most other changes since Personal Security Manager 1.3 involve minor
|
|
bug fixes and optimizations.
|
|
<p>Netscape 6 and Mozilla do not supported signed or encrypted email. For
|
|
this reason, features related to email certificates are not available in
|
|
this release.
|
|
<p>
|
|
<hr WIDTH="100%">
|
|
<h4>
|
|
<a NAME="Software/Hardware Requirements"></a><font size=+2>Software/Hardware
|
|
Requirements</font></h4>
|
|
<b>Operating systems supported:</b> Windows NT, Windows 95, Windows 98
|
|
Windows 2000; Solaris 2.6, 2.7, 2.8; and Red Hat Linux 6.1.
|
|
<p><b>Other software requirements: </b>This release has been tested with
|
|
Mozilla and Netscape 6. It is not intended for use with Communicator.
|
|
<br>
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="unpacking"></a>Installing Personal Security Manager</h2>
|
|
Personal Security Manager 1.4 is installed with Netscape 6. To install
|
|
Personal Security Manager 1.4 with Mozilla, see <a href="http://docs.iplanet.com/docs/manuals/psm/psm-mozilla/index.html">http://docs.iplanet.com/docs/manuals/psm/psm-mozilla/index.html</a>.
|
|
<p>The sections that follow describe how the Personal Security Manager
|
|
files are installed with Netscape 6.
|
|
<h3>
|
|
Installing on Windows 95/98/2000/NT</h3>
|
|
When you install Netscape 6 on Windows, Personal Security Manager is installed
|
|
in the directory <tt>C:\Program Files\Common Files\Netscape Shared\Security\</tt>.
|
|
<p><b>All Windows users:</b> Personal Security Manager 1.4 works with Mozilla
|
|
and Netscape 6, but it is not currently supported for Communicator 4.x.
|
|
Therefore, you should not attempt to run Personal Security Manager 1.4
|
|
with Communicator 4.x.
|
|
<p>If you have Personal Security Manager 1.3 installed for use with Communicator
|
|
4.x and you want to install Netscape 6, you should first exit Communicator,
|
|
then rename the directory <tt>C:\Program Files\Common Files\Netscape Shared\Security\</tt>
|
|
to something else, such as <tt>SecurityC47</tt>. When you install Netscape
|
|
6, a new <tt>Security</tt> directory will be created during the installation
|
|
process.
|
|
<p>If you want to run Communicator 4.x with Personal Security Manager 1.3
|
|
after Netscape 6 has been installed, you should first exit Netscape 6,
|
|
then rename the <tt>Security</tt> directory (which now contains the Personal
|
|
Security Manager 1.4 files) to something else (such as <tt>SecurityN6</tt>)
|
|
and rename your <tt>SecurityC47</tt> directory (which contains the Personal
|
|
Security Manager 1.3 files) to Security. You can then launch Communicator
|
|
as usual.
|
|
<h3>
|
|
Installing on Unix</h3>
|
|
When you install Netscape 6 on Unix, Personal Security Manager is installed
|
|
in a directory called <tt>psm</tt> in the same directory where the <tt>netscape</tt>
|
|
executable resides.
|
|
<br>
|
|
<h3>
|
|
Disabling Personal Security Manager</h3>
|
|
To <b>disable</b> Personal Security Manager temporarily, exit Netscape
|
|
6, then:
|
|
<ul>
|
|
<li>
|
|
on Unix, remove the directory
|
|
<tt>psm</tt> from the directory where the
|
|
<tt>netscape</tt>
|
|
executable resides.</li>
|
|
|
|
<li>
|
|
on Windows, rename the directory <tt>C:\Program Files\Common Files\Netscape
|
|
Shared\Security</tt> to something else.</li>
|
|
</ul>
|
|
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="Using the Test Bed"></a>Using Personal Security Manager</h2>
|
|
The sections that follow describe how to test some of the features of Personal
|
|
Security Manager that are available with this release:
|
|
<ul>
|
|
<li>
|
|
<a href="#Start Up Personal Security Manager with">Start Up Personal Security
|
|
Manager with Netscape 6</a></li>
|
|
|
|
<li>
|
|
<a href="#Use SSL with Server Authentication">Test Basic SSL</a></li>
|
|
|
|
<li>
|
|
<a href="#Get a Certificate">Get an SSL Client Certificate</a></li>
|
|
|
|
<li>
|
|
<a href="#View Your Personal Certificate">View Your Certificate</a></li>
|
|
|
|
<li>
|
|
<a href="#Using Your Personal Certificate for Client">Test Client Authentication</a></li>
|
|
|
|
<li>
|
|
<a href="#Validate Certificates Using OSCP">Validate Certificates Using
|
|
OCSP</a></li>
|
|
</ul>
|
|
The sections that follow briefly describe how to test some of the features
|
|
listed above.
|
|
<p>For information on the JavaScript API supported by Personal Security
|
|
Manager, see <a href="cmcjavascriptapi.html">JavaScript API for Client
|
|
Certificate Management</a> and the Personal Security Manager Deployment
|
|
Guide. For the latest versions of these documents, see <a href="http://docs.iPlanet.com/docs/manuals/psm.html">http://docs.iPlanet.com/docs/manuals/psm.html</a>.
|
|
<h3>
|
|
<a NAME="Start Up Personal Security Manager with"></a>Use Personal Security
|
|
Manager with Netscape 6</h3>
|
|
Personal Security Manager starts automatically the first time Netscape
|
|
6 needs to perform some action involving security, such as handling an
|
|
SSL session.
|
|
<p>Follow these steps to view your security settings and confirm that
|
|
Personal Security Manager is running:
|
|
<ol>
|
|
<li>
|
|
Launch Netscape 6.</li>
|
|
|
|
<li>
|
|
Choose Security & Privacy from the Tasks menu, then choose Security
|
|
Manager to view your Personal Security Manager settings.</li>
|
|
|
|
<li>
|
|
Close the Personal Security Manager window.</li>
|
|
|
|
<li>
|
|
Go to the page <a href="psmtest.html">psmtest.html</a> (in the same directory
|
|
as these release notes), then choose Page Source from the View menu to
|
|
see the JavaScript code that a web programmer can use to detect Personal
|
|
Security Manager and its version number.</li>
|
|
</ol>
|
|
Note that the version number has two parts. The first is the version of
|
|
the PSM client library, and the second is the version of the PSM server
|
|
library.
|
|
<br>
|
|
<h3>
|
|
<a NAME="Use SSL with Server Authentication"></a>Test Basic SSL</h3>
|
|
Go to any online store, banking service, brokerage account, or other web
|
|
site that supports SSL. Verify that the lock in the lower-left corner of
|
|
the browser window is closed when you reach the pages for which SSL should
|
|
be enabled, for example a page where you are asked to give your credit
|
|
card number.
|
|
<h3>
|
|
<a NAME="Get a Certificate"></a>Get an SSL Client Certificate</h3>
|
|
Go to any public or private CA and apply for an SSL client certificate.
|
|
<p>To test one-click certificate issuance, dual key-pair certificates,
|
|
and other Personal Security Manager features, system administrators should
|
|
download, install, and configure Netscape Certificate Management System.
|
|
For complete CMS documentation and other information, see <a href="http://docs.iPlanet.com/docs/manuals/cms.html">http://docs.iPlanet.com/docs/manuals/cms.html</a>.
|
|
To download the latest version of CMS, see <a href="http://www.iplanet.com/downloads/download/">http://www.iplanet.com/downloads/download/</a>.
|
|
<h3>
|
|
<a NAME="View Your Personal Certificate"></a>View Your Certificate</h3>
|
|
After you have obtained a certificate, follow these steps to view it:
|
|
<ol>
|
|
<li>
|
|
Click the Security icon in the Navigator toolbar.</li>
|
|
|
|
<li>
|
|
Click the Certificates tab.</li>
|
|
|
|
<li>
|
|
Click to select your certificate.</li>
|
|
|
|
<li>
|
|
Click View.</li>
|
|
</ol>
|
|
You should see information about your new certificate.
|
|
<h3>
|
|
<a NAME="Using Your Personal Certificate for Client"></a><font size=+1>Test
|
|
Client Authentication</font></h3>
|
|
Personal Security Manager allows the SSL server and client to negotiate
|
|
which certificate to use, and in most cases they can agree on a single
|
|
correct certificate for the client to present. When this happens, the user
|
|
can access an SSL site that requires client authentication with zero additional
|
|
clicks.
|
|
<p>To test client authentication with Netscape Enterprise Server, system
|
|
administrators should follow these steps:
|
|
<ul>
|
|
<li>
|
|
Install an Enterprise Server and configure it for client authentication
|
|
as described in <a href="http://docs.iplanet.com/docs/manuals/cms/41/dep_gide/entsrv.htm">Appendix
|
|
D, Using SSL with Enterprise Server 3.x</a>, of <i>Netscape Certificate
|
|
Management System Installation and Deployment Guide</i>.</li>
|
|
|
|
<li>
|
|
Test the Enterprise Server installation as described at the end of Appendix
|
|
D using Personal Security Manager.</li>
|
|
</ul>
|
|
|
|
<h3>
|
|
<a NAME="Validate Certificates Using OSCP"></a>Validate Certificates Using
|
|
OSCP</h3>
|
|
Personal Security Manager supports the use of the On-Line Certificate Status
|
|
Protocol (OSCP) to check the validity of certificates in real time. Information
|
|
about this protocol and how configure Personal Security Manager 1.3 and
|
|
Netscape Certificate Management System 4.2 to support it is available from
|
|
<a href="http://docs.iPlanet.com/docs/manuals/psm/12/psmdply.htm">http://docs.iPlanet.com/docs/manuals/psm/12/psmdply.htm</a>
|
|
<p>It's important to note that Personal Security Manager will accept signatures
|
|
from responders only under the following conditions:
|
|
<ul>
|
|
<li>
|
|
The response was signed by a delegated responder--that is, the responder's
|
|
certificate was signed by the same CA as the certificate you're trying
|
|
to verify and has the <tt>extendedKeyUsage</tt> bit set indicating that
|
|
the certificate is an OCSP response signer. The certificate should be the
|
|
same as a CA certificate with the addition of the <tt>extendedKeyUsage</tt>
|
|
bit.</li>
|
|
|
|
<li>
|
|
The user has designated a default responder in the OCSP Settings dialog
|
|
box (available from the Advanced tab under Options).</li>
|
|
</ul>
|
|
Common problems include the following:
|
|
<ul>
|
|
<li>
|
|
Time drift between the client and server machine. Personal Security Manager
|
|
expects the time of the response to be within the past 24 hours. If there
|
|
is a difference in the clocks between the machine used to sign the response,
|
|
so the response looks to Personal Security Manager like it was signed in
|
|
the future, Personal Security Manager interprets this as an error. Run
|
|
ntp on both machines to fix this problem.</li>
|
|
|
|
<li>
|
|
The response doesn't include the certificates required to complete the
|
|
chain needed to verify the signer's certificate. The client frequently
|
|
doesn't have all the certificates in the database that are needed to verify
|
|
the signer's certificate, in which case Personal Security Manager can't
|
|
verify the signer's certificate and OCSP fails. Make sure the entire chain
|
|
is included with every response. This is the safest way to avoid this problem.</li>
|
|
|
|
<li>
|
|
If you are using ValiCert, misconfiguration may cause the Validation Authority
|
|
not to send the certificate chain (including the CA root certificate and
|
|
the OCSP responder's certificate) correctly.</li>
|
|
</ul>
|
|
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="Known Bugs/Issues for 14 Release"></a>Known Bugs/Issues for Personal
|
|
Security Manager 1.4</h2>
|
|
|
|
<ul>
|
|
<li>
|
|
To run Personal Security Manager on Unix, you must be logged in as the
|
|
same Unix user you were logged in as when Netscape 6 was installed.</li>
|
|
|
|
<li>
|
|
FORTEZZA is not guaranteed to work with this release. [# 94220]</li>
|
|
|
|
<li>
|
|
In some unusual circumstances you may encounter problems such as valid
|
|
certificates not being verified or Netscape 6 freezing up. If you encounter
|
|
a problem that doesn't appear to have a logical explanation, try the following
|
|
as a last resort:</li>
|
|
|
|
<ol>
|
|
<li>
|
|
Exit Netscape 6, then relaunch it. If necessary, use Control-Alt-Delete
|
|
on Windows 95/98/2000/NT to bring up the Task Manager and click End Process
|
|
for both <tt>psm.exe</tt> and <tt>netscp6.exe</tt>.</li>
|
|
|
|
<li>
|
|
<b>Warning:</b> <b>Before taking this step, back up your own certificates
|
|
stored internally by Personal Security Manager.</b> If exiting and relaunching
|
|
Netscape 6 doesn't take care of the problem, in some rare cases it may
|
|
work to exit Netscape 6, then delete or rename your <tt>cert7.db</tt> and
|
|
<tt>key3.db</tt>
|
|
files (located in your user profile directory on Windows 95/98/2000/NT,
|
|
or in the directory in which the Netscape or Mozilla executable resides
|
|
on Unix) and relaunch the Netscape 6. You should also look for all other
|
|
files in the same directory that begin with <tt>cert</tt> or
|
|
<tt>key</tt>
|
|
and end in <tt>.db</tt> and delete those files as well before relaunching
|
|
Netscape 6.</li>
|
|
</ol>
|
|
</ul>
|
|
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="Feedback"></a>Feedback</h2>
|
|
To send feedback to the Personal Security Manager development team, send
|
|
email to <a href="mailto:psmfeedback@netscape.com">psmfeedback@netscape.com</a>.
|
|
Feedback back sent to this address will be read by the team, but you will
|
|
not receive a personal response.
|
|
</body>
|
|
</html>
|