Novell Certificate Server allows you to create certificates for both servers and end users. Server Certificates can be signed by either the Organizational CA or by an external or third-party CA. User certificates can only be signed by the Organizational CA.
During the Server Certificate object creation process, you are asked which type of Certificate Authority will sign the Server Certificate object.
The Organizational Certificate Authority is specific to your organization and uses an organizational-specific public key for signing operations. The private key is created when you create the Organizational Certificate Authority.
An external Certificate Authority is managed by a third party outside of the eDirectory tree. An example of an external Certificate Authority is VeriSign*.
Both types of Certificate Authorities can be used simultaneously. Using one type of Certificate Authority does not preclude the use of the other.
Compatibility. The Organizational Certificate Authority is compatible with Novell applications such as LDAP services, Portal Services, and the Novonyx Web Server. Certificates issued by the Organizational CA are X.509 v3 compliant and can also be used by third-party applications.
Cost savings. The Organizational Certificate Authority lets you create an unlimited number of public key certificates at no cost; obtaining a single public key certificate through an external Certificate Authority might cost a significant amount of money.
Component of a complete and compatible solution. By using the Organizational Certificate Authority, you can use the complete cryptographic system built into Novell eDirectoryTM without relying on any external services. In addition, Novell Certificate Server is compatible with a wide range of Novell products.
Certificate attribute and content control. An Organizational Certificate Authority is managed by the network administrator, who decides on public key certificate attributes such as certificate life span, key size, and signature algorithm.
Simplified management. The Organizational Certificate Authority performs a function similar to external certificate authorities but without the added cost and complexity.
Liability. An external Certificate Authority might offer some liability protection if, through the fault of the Certificate Authority, your private key was exposed or your public key certificate was misrepresented.
Availability. An external Certificate Authority's certificate might be more widely available and more widely trusted by applications outside of eDirectory.