| |
Novell iChain includes Novell Public Key Infrastructure Services (PKIS 2.0) to provide cryptography and enable certificate services in your iChain infrastructure. A Novell server certificate is installed and configured automatically when you install Novell iChain; however, you may want to use other third-party certificates, such as Baltimore* certificates, in your infrastructure. In order to use third-party certificates in your iChain infrastructure, you must request a certificate from a Certificate Authority (CA), have the CA sign the certificate, collect and export the certificate and its trusted root, and then import the certificate and its trusted root to the iChain Proxy Server. The following procedure describes the process for a Baltimore certificate.
To create a Certificate Signing Request (CSR) for a server certificate for the iChain Proxy Server:
From ConsoleOne, access the tree containing the iChain Proxy Server.
From within the server's OU, click New Object > NDSPKI:KeyMaterial.
Specify a name for the certificate, such as proxy server certificate.
Select Custom > click Next.
Select External Certificate Authority.
Select the key size > click Next.
Click Next to accept the default subject name of the certificate.
Click Finish.
Click Save to save the CSR.
To sign the CSR, perform the following steps:
Copy the CSR onto a diskette.
Insert the diskette with the CSR into the drive of the Baltimore Certificate Authority.
From the Registration Authority Operatory (RAO) menu of the Baltimore CA, click Face to Face Requests > Register a New User.
Select the Baltimore policy you have previously created for the proxy server certificate.
Locate the CSR file on the diskette > select the file > click Open.
Click Accept to process the CSR.
To collect response to the CSR and export the trusted root, perform the following steps:
Click Collect Reply from Last Request.
Click File.
Click DER Encoded Certificate.
Save the response file to the diskette as a .DER file.
Click OK to acknowledge.
Click OK on the yellow back arrow.
From the Certificate Authority Operator (CAO) menu, click Open/Create PKI.
Right-click the CA object > click Export Certificate.
Click DER Encoded Certificate.
Save the Trusted Root file to the diskette as a .DER file.
Select PKI > Done.
To import the new Trusted Root into the server certificate, perform the following steps:
From ConsoleOne, right-click on the server certificate object you created when you made the certificate request and click Properties.
Click Certificates > Trusted Root > Import > Read From File.
Select the Trusted Root file on the diskette > click Open > Next.
Click Read From File.
Select the certificate response file from the diskette > click Open.
Click Finish.
| |