Netscape Certificate Management System 6.0 Release Notes

Netscape Certificate Management System Release Notes

Version: 6.0

Updated on: March 28, 2002
These release notes contain important information available at the time of the version 6.0 release of Netscape Certificate Management System (CMS). Installation requirements, known problems, and other late-breaking issues are addressed here. Read this document before you begin installing and using Certificate Management System.

Check the Red Hat Certificate System site prior to installing and setting up your software and then periodically thereafter to obtain the latest release notes and manuals.

These release notes contain the following sections:

What's New in This Release
Software/Hardware Requirements
CMS Documentation
Installation Procedure
Important Notes and Known Problems
For More Information

What's New in This Release

This release of Certificate Management System contains many enhancements and includes fixes to some of the problems noticed in earlier releases. This section summarizes the enhancements/changes made in the product.

This release of Certificate Management System

Includes a new HTTP engine, built with the Netscape Enterprise Server 6.0 core, exposing many new features for customizing and fine tuning your HTTP interface to suit your deployment. For example, integration of the new engine enables improved scalability and access control. For more information about Enterprise Server, check the http://enterprise.netscape.com/products/contentsvcs/enterprise_ds.html site.

Includes a new face-to-face enrollment form in the Registration Manager's agent interface, which enables end users to enroll for certificates in person by going to an agent (see Agent and End-Entity Interface ).

Includes performance and scalability improvements.

Includes many bug fixes.

Uses Netscape Directory Server 6.01, Netscape Administration Server 6.01, and NSS 3.3.4. These products/components include many new and enhanced features and bug fixes. For details about Directory Server and Administration Server, check the corresponding documentation at the http://enterprise.netscape.com/docs/ site. For NSS, check the http://www.mozilla.org/projects/security/pki/nss/ site.

If you are familiar with previous releases of Certificate Management System, you will also notice these changes in the product:

A CMS instance can only contain one of the four CMS subsystems; you cannot install two subsystems, for example, a Certificate Manager and Data Recovery Manager in the same CMS instance.

Network settings cannot be managed from the CMS Console. The new HTTP engine provides much more flexibility in configuring network parameters and this configuration must be done via the web server's configuration files, instead of CMS configuration files.

The cryptographic token password is also used for single sign on, eliminating the need to create and maintain two separate passwords.

To enable remote starting/stopping/restarting of server, certain passwords are stored in a text file named password.conf file on the host machine. During installation, you are given the option to retain or remove the file. If you opt to keep the file, protect it adequately.

The CMS certificate database does not contain public or third-party CA certificates. If required, you should add these certificates.

CMS SDK and samples no longer get installed with the product (see Documentation).

Software/Hardware Requirements

This section contains the following information:

Supported Platforms
Other Required Software

Supported Platforms

This release of Certificate Management System is supported on the following operating-system platforms:

Sun Solaris
Microsoft Windows NT
Microsoft Windows 2000


Solaris Platform Requirements
OS Version	Solaris 8 with relevant Java 2 patches for JDK 1.3.1_02 (check the http://java.sun.com/j2se/1.3/install-solaris-patches.html site)
Machine	Ultra 10 or faster
RAM	256 MB (required)
Hard disk storage space requirements	Total required is approximately 400 MB, as follows: Total transient space required during installation: 100 MB Hard disk storage space required for installation: Space required for setup, configuration, and running the server: approximately 250 MB Additional space to allow for database growth in pilot deployment: approximately 50 MB Total disk storage space for installation: approximately 300 MB
Other Requirements	You must install as `root` in order to use well-known port numbers (such as 443) that are less than 1024. If you do not plan to use port numbers less than 1024, you do not need to install as `root.` If you plan to run as `root` , you should also install as `root` and specify `nobody` as the default run-as user and group.
Windows Platform Requirements
OS Version	Windows NT 4.0 with Service Pack 6a or Windows 2000 Server SP2
Machine	Pentium 350 or faster
RAM	256 MB of RAM (recommended)
File System	NTFS
Hard disk storage space requirements	Total required is approximately 350 MB, as follows: Total transient space required during installation: 100 MB Hard disk storage space required for installation: Space required for setup, configuration, and running the server: approximately 200 MB Additional space to allow for database growth in pilot deployment: approximately 50 MB Total disk storage space for installation: approximately 250 MB
Other Requirements	On a Windows system, you must install as `Administrator` or a user with `Administrator` privileges (that is, the user must be in the `Administrators` group).

Other Required Software

Netscape Administration Server 6.01 (included)

Netscape Directory Server 6.01 (included)
Check the Directory Server 6.01 release notes available at http://enterprise.netscape.com/docs/directory/index.html for the latest information about this server.

Browser software that supports SSL (not included)
We strongly recommend that users who will interact with Certificate Management System as agents or end entities using Netscape browsers should use Communicator version 4.7x or Netscape 6.2. Earlier versions, such as 4.5x, may not work properly. Netscape 6 and 6.1 has not been fully tested with this release of Certificate Management System.

CMS Documentation

The complete set of CMS documentation for this release includes the following:

CMS Release Notes (this document) -- The release notes contain information on software/hardware requirements for installing the product, important notes and known bugs, last-minute product information, and how to send feedback.

CMS Installation and Setup Guide -- This guide describes how to plan for, install, and configure Certificate Management System. Read this guide first, after you have read these release notes.

CMS Plug-Ins Guide -- This guide contains reference information on CMS plug-in modules, such as the ones provided for authentication, policy, publishing, and so on.

CMS Command-Line Tools Guide -- This guide contains reference information on command-line tools.

CMS Customization Guide -- This guide contains reference information on customizing the HTML-based agent and end-entity interfaces.

CMS Agent's Guide -- This guide provides an overview of the CMS Agent Service interface and explains how to use the interface to perform agent tasks.

CMS End-Entity Help -- This document is the online help provided for the End-Entity Services interfaces; this interface contains HTML-based forms for certificate enrollments, renewals, revocations, and so on.

If you obtained product on a CD, you can find the documentation in the directory named Docs at the top level of the CD. For a list of documentation, open the index.html file.

If you are working with files you have downloaded from the web site, as opposed to the files on the CD, the Docs directory mentioned above will not be present. Instead, you must use either of these options:

Download the CMS documentation from this site: http://enterprise.netscape.com/docs/cms/index.html

Run the setup script as described under Installation Procedure, then check the <server_root>/manual/en/cert/index.htm file for a complete list of documentation installed with the product, where <server_root> is your installation directory. The index file also contains a link to the Netscape Console/Netscape Administration Server documentation that gets installed along with the CMS documentation.

For the latest information about Certificate Management System, including current release notes, technical notes, and deployment information, always check this site:
http://enterprise.netscape.com/docs/cms/index.html

Installation Procedure

Before installing the product, be sure to read these release notes and the installation instructions in CMS Installation and Setup Guide.

If you are using the product CD for installation, this book is available as a PDF file in the Docs directory.
If you downloaded the software from the web site, be sure to download the PDF version of the book.

If you do not have any previous installation of Certificate Management System, follow the instructions for installing the software. It involves the following stages:

Stage 1: Run the installation script (setup or setup.exe) to install administration and directory servers as necessary, and perform the initial phase of CMS installation.
Stage 2: Run the Installation Wizard to set up the initial configuration of the CMS instance. This is where you specify which subsystems are to be part of this instance.
Stage 3: Use Netscape Console to further configure the new CMS instance as needed. For example, you must provide it with information about the LDAP publishing and authentication directories.
Stage 4: If you wish, use Netscape Console to create additional instances of the Certificate Management System in the same server root directory, and use the Installation Wizard to configure them.

Important Notes and Known Problems

This section lists important notes, bugs, and known issues, and provides workarounds for some of the problems that you may encounter with the product. (The problems are identified by bug numbers to help you refer to them if you need to contact technical support.)

Agent and End-Entity_Interface	Documentation
Authentication/Enrollment	Installation
Certificate Revocation List (CRL)	Revocation of Certificates
CMS Console	Policy
Command-Line Tools	Publishing of Certificates

Agent and End-Entity Interface

The Registration Manager Agent interface includes a new enrollment form for face-to-face or in-person certificate enrollment. This new feature enables end users to enroll for certificates in person by going to an agent. The enrollment form works in conjunction with an authentication plug-in named HashAuth, a new plug-in provided for the Registration Manager. That is, the enrollment form works only if an instance of the HashAuth authentication plug-in is enabled in the Registration Manager's configuration, giving administrators the control over agents from performing face-to-face certificate enrollment for end users. This feature is not documented. (603215)

Some of the Help buttons in the Data Recovery Manager's agent interface may not work. (524107)
If you run into this problem, check the Agent's Guide for instructions on using this interface.

Authentication/Enrollment

As a part of configuring an authentication plug-in, you are required to provide the base DN of the authentication directory. If your authentication directory is based on Netscape Directory Server 6.x, be sure to enter the value in the domain-component format (for example, dc=domain, dc=com).

The certificate-based enrollment/authentication method does not work. (602205)

The CEP enrollment method (provided for routers) does not work.

See also Agent and End-Entity Interface.

Certificate Revocation List (CRL)

The default limitation on the size of CRL is 2M. (603303)
Certificate Management System uses Netscape Directory Server as its internal database and uses the same to store all data, including the CRL. By default, the Directory Server is configured to handle attributes up to a size of 2M. The size is determined by the value assigned to the Maximum Message Size (nsslapd-maxbersize) parameter. (Check the Directory Server documentation at the http://enterprise.netscape.com/docs/directory/601/cli/config.htm#14685 site.) If the size of your CRL reaches the 2M limit, adjust the value of the nsslapd-maxbersize parameter accordingly.

CMS Console

You cannot delete public root CA certificates from the CMS Console. (603125)
For example, if you add public root CA certificates to the CMS database and then try to delete one of those certificates from the Certificate Database Management window (CMS Console > Configuration > Encryption > Manage Certificates), the operation fails with no error.

Command-Line Tools

Many of the command-line tools (for example, cmsutil , certutil, setpin, and ssltap) that get installed in the <server_root>/bin/cert/tools directory require LD_LIBRARY_PATH set to point to the <server_root>/bin/cert/lib directory. If LD_LIBRARY_PATH is not set correctly, you will not be able to run these tools. (601377)

Documentation

The CMS Customization Guide included with this release does not reflect the changes made to the HTTP interface of the product. An updated version of this book will be posted to the web site on a future date. (603265)

The documentation contains references to files in the CMS SDK and samples area (the <server_root>/cms_sdk/... directory). Some of these files are no longer bundled with the product. Instead, they will be made available on a future date. Javadocs for CMS interfaces and plug-ins do get installed with the product in a new location, the <server_root>/bin/javadocs directory.

Unlike in the previous releases, a CMS instance can now contain only one subsystem, a Certificate Manager, Registration Manager, Data Recovery Manager, or Online Certificate Status Manager. The documentation has been updated to reflect this change. However, in the Agent's Guide there are some screen shots that show two subsystems installed together. This error has been corrected in the version of the documentation included on the CD and published to the web site. (603265)

The documentation included on the CD and published to the web site contains many corrections.

Installation

The CMS Installation Wizard sometimes fails to start at the first attempt, especially when you run the wizard on a slow machine. (602048)

During the installation of a Certificate Manager, in one of the wizard screens, you are asked to enable or disable the internal OCSP feature of the Certificate Manager. Be noted that irrespective of the choice you make, the Certificate Manager is installed with this feature. The status of the Enable checkbox has no effect on installation. (603323)

You cannot install a Certificate Manager with a DSA key of size 1024 bits for the CA Signing Certificate and an RSA key of size 1024 bits for the SSL Server Certificate. (603274)
To workaround the problem, install the Certificate Manager with a DSA key of size 512 bits for the CA Signing Certificate and an RSA key of size 1024 bits for SSL Server Certificate and, post installation, renew the CA Signing Certificate with a key of size 1024 bits.

Solaris only. If you create multiple CMS instances based on a CMS instance that has been installed with root privileges, be sure to manually adjust the file permission on the new instances. (602987)

Upgrading of Certificate Management System from a previous version is not supported. An upgrade procedure will be made available on a future date.

Revocation of Certificates

The secure (HTTPS) end-entity port requires users to present the certificate multiple times during revocation of a certificate. (603025)

Policy

The IssuerConstraints policy plug-in, which checks for certificates that have been issued by a particular CA, does not work. (602205)
To workaround the problem, edit the default value assigned to the predicate parameter as indicate below:
Default value: HTTP_PARAMS.certType==client AND certauthEnroll==on
Correct value: HTTP_PARAMS.certType==client AND HTTP_PARAMS. certauthEnroll==on

Publishing of Certificates

If Cerificate Management System is enabled for publishing certificates and if more than 10 clients concurrently submit requests to the server, some of the certificates may not get published. (603337)

For More Information

Your feedback is welcome and extremely helpful for improving the product. Before contacting us to request assistance, please check the documentation for this release. If you need further assistance or information about Certificate Management System or if you need to report problems with this product, contact technical support. You may also contact us through our newsgroup for support, questions, answers, and the latest information:

snews://secnews.netscape.com/netscape.dev.certificate

You might also find it useful to subscribe to the following newsgroups, where topics related to security, certificate, and directory are discussed:

snews://secnews.netscape.com/netscape.dev.ssl
snews://secnews.netscape.com/netscape.dev.security
snews://secnews.netscape.com/netscape.dev.directory

So that we can best assist you in resolving problems, please be sure to include the following information:

Description of the problem, including the situation where the problem occurs and its impact on your operation
Machine type, operating system version, and product version, including any patches and other software that might be affecting the problem
Detailed steps on the methods you have used to reproduce the problem
Any error logs or core dumps

For problems involving the use of directory with other products, include the product name (for example, Netscape 6.2), the release number, and platform information for those products as well.