Chapter 20 Introduction to End-Entity and Agent Interfaces

Netscape Certificate Management System (CMS) provides HTML forms-based interfaces for agents and end entities to use in performing certificate- and key-related operations. This chapter introduces these forms and explains how they work. You can use the forms as they are provided out of the box or customize them to meet your organization's requirements.

• End-Entity Services
• Configuring End-Entity Interaction with Subsystems
• Agent Services

Each type of end-entity form provided by Certificate Management System is served by a servlet. This servlet determines which version of the form to present based on information about the end entity (the type, version, language, and so on), information in the form itself, and other factors.

• An authentication manager is a configured instance of an authentication plug-in module. When Certificate Management System receives a request from an end entity, it uses the authentication manager specified by the request to determine how to authenticate the end entity. For more information, see "Adding an Authentication Instance".
• The output template is an HTML page with embedded JavaScript used to return information from the end entity to the servlet. For more information, see "Responses and Output Templates".

Table 20.1 lists the forms provided by the Certificate Manager and Registration Manager for certificate issuance and life-cycle management operations, and indicates supported authentication mechanisms and request formats.

To enable end-entity interaction with a Certificate Manager:

1. Access the CMS window (see "Accessing the CMS Window").
2. Click the Configuration tab.
3. In the navigation tree, click Certificate Manager.

The General Setting tab appears.



4. In the Web Access section, check the "Enable end-entity interaction" option if you want end entities to be able to interact with the selected Certificate Manager via the HTTPS port; leave it unchecked to disable end-entity interaction with the server. Note that if you disable end-entity interaction, the Network tab still shows the HTTPS port and allows you to configure it (see "Configuring Port Numbers"). However, you should know that the server ignores this port.
5. In the Default Signing Algorithm section, select the signing algorithm the Certificate Manager should use for signing certificates. The choices are "MD2 with RSA," "MD5 with RSA," and "SHA1 with RSA," if the CA's signing key type is RSA and "SHA1 with DSA," if the CA's signing key type is DSA. Note that the signing algorithm specified in the Certificate Manager's policy configuration overrides the algorithm you select here. For information on a Certificate Manager's policy configuration, see "Policies".
6. To save your changes, click Save.

The CMS configuration is modified. If the changes you made require you to restart the server, you will be prompted accordingly. In that case, restart the server.

To enable end-entity interaction with a Registration Manager:

1. Access the CMS window (see "Accessing the CMS Window").
2. Click the Configuration tab.
3. In the navigation tree, click Registration Manager.

The General Setting tab appears.



4. In the Web Access section, check the "Enable end-entity interaction" option if you want end entities to be able to interact with the selected Registration Manager via the HTTPS port; leave it unchecked to disable end-entity interaction with the server. Note that if you disable end-entity interaction, the Network tab still shows the HTTPS port and allows you to configure it (see "Configuring Port Numbers"). However, you should know that the server ignores this port.
5. To save your changes, click Save.

The CMS configuration is modified. If the changes you made require you to restart the server, you will be prompted accordingly. In that case, restart the server.

• Certificate Manager Agent Services
• Registration Manager Agent Services
• Data Recovery Manager Agent Services

The Certificate Manager Agent Services interface enables a Certificate Manager agent to interact with the Certificate Manager (the server). Figure 20.2 shows the Certificate Manager Agent Services interface.

• Listing deferred certificate requests from end entities and process them
• Listing certificates issued by the server
• Searching for certificates issued by the server
• Revoking certificates issued by the server
• Updating certificates and certificate revocation lists (CRLs) maintained in the publishing directory

The Registration Manager Agent Services interface enables a Registration Manager agent to interact with the Registration Manager (the server). Figure 20.3 shows the Registration Manager Agent Services interface.

The Data Recovery Manager Agent Services interface enables a Data Recovery Manager agent to interact with the Data Recovery Manager (the server). Figure 20.4 shows the Data Recovery Manager Agent Services interface.

Access to the Agent Services interface is restricted to authorized agents only. For details, see "Agents".

1. Open a web browser.
2. Go to the page where the Agent Services interface for Certificate Management System is installed.

The default URL for this page is:

https://<host_name>:<agent_port>

<host_name> is in the form <machine_name>.<your_domain>.<domain>

If you have customized Certificate Management System, go to the page containing the agent forms that you would use to submit a request.

3. In the Agent Services menu, choose the agent services you require:
• To access the agent services for the Certificate Manager, click the Certificate Manager Agent Services link.
• To access the agent services for the Registration Manager, click the Registration Manager Agent Services link.
• To access the agent services for the Data Recovery Manager, click the Data Recovery Manager Agent Services link.

The appropriate interface appears.