These notes include information for IS professionals who are thoroughly familiar with security and public-key infrastructure (PKI) issues.

Use of this product is subject to the terms detailed in the license agreement accompanying Netscape 6 PR3.

Contents

Documentation

• Personal Security Manager Help -- This online help system can also be accessed by clicking the Help button in any personal Security Manager window.
• JavaScript API for Client Certificate Management -- This reference describes a new Javascript API for performing user certificate management operations with Personal Security Manager, including one-click issuance, forced certificate backup by end users, and automatic archival of encryption private keys.

Changes Since Personal Security Manager 1.2

Netscape 6 and Mozilla do not supported signed or encrypted email. For this reason, features related to email certifiates are not available in this release.

Software/Hardware Requirements

Other software requirements: This release has been tested with Mozilla and Netscape 6. It is not intended for use with Communicator.

Installing Personal Security Manager

The instructions that follow describe how the Personal Security Manager files are installed on each platform.

Installing on Windows 95/98/2000/NT

Windows NT users: On Windows NT, you must have administrator privileges to install Personal Security Manager.

All Windows users: Personal Security Manager 1.3 works with Mozilla and Netscape 6, and Personal Security Manager 1.2 works with Mozilla, Netscape 6, and Communicator 4.7x--but not when any of these browsers are running at the same time. For example, you must exit Netscape 6 PR3 before launching Communicator with Personal Security Manager 1.2 enabled.

Installing on Unix

To run Personal Security Manager on Unix, you must be logged in as the same Unix user you were logged in as when you installed it.

Disabling Personal Security Manager

Using Personal Security Manager

• Start Up Personal Security Manager with Netscape 6
• Test Basic SSL
• Get an SSL Client Certificate
• View Your Certificate
• Test Client Authentication
• Validate Certificates Using OCSP
• Fetch Certificates Automatically from a Directory

For information on the JavaScript API supported by Personal Security Manager, see JavaScript API for Client Certificate Management and the Personal Security Manager Deployment Guide. For the latest versions of these documents, see http://docs.iPlanet.com/docs/manuals/psm.html.

Use Personal Security Manager with Netscape 6

Follow these steps to view your security settings and confirm that  Personal Security Manager is running:

1. Launch Netscape 6.
2. Choose Security & Privacy from the Tasks menu, then choose Security Manager to view your Personal Security Manager settings.
3. Close the Personal Security Manager window.
4. Go to the page psmtest.html (in the same directory as these release notes), then choose Page Source from the View menu to see the JavaScript code that a web programmer can use to detect Personal Security Manager and its version number.

Test Basic SSL

Get an SSL Client Certificate

To test one-click certificate issuance, dual key-pair certificates, and other Personal Security Manager features, system administrators should download, install, and configure Netscape Certificate Management System. For complete CMS documentation and other information, see http://docs.iPlanet.com/docs/manuals/cms.html. To download the latest version of CMS, see http://www.iplanet.com/downloads/download/.

View Your Certificate

1. Click the Security icon in the Navigator toolbar.
2. Click the Certificates tab.
3. Click to select your certificate.
4. Click View.

Test Client Authentication

To test client authentication with Netscape Enterprise Server, system administrators should follow these steps:

• Install an Enterprise Server and configure it for client authentication as described in Appendix D, Using SSL with Enterprise Server 3.x, of Netscape Certificate Management System Installation and Deployment Guide.
• Test the Enterprise Server installation as described at the end of Appendix D using Personal Security Manager.

Validate Certificates Using OSCP

It's important to note that Personal Security Manager will accept signatures from responders only under the following conditions:

• The response was signed by a delegated responder--that is, the responder's certificate was signed by the same CA as the certificate  you're trying to verify and has the extendedKeyUsage bit set indicating that the certificate is an OCSP response signer. The certificate should be the same as a CA certificate with the addition of the extendedKeyUsage bit.
• The user has designated a default responder in the OCSP Settings dialog box (available from the Advanced tab under Options).

• Time drift between the client and server machine. Personal Security Manager expects the time of the response to be within the past 24 hours. If there is a difference in the clocks between the machine used to sign the response, so the response looks to Personal Security Manager like it was signed in the future, Personal Security Manager interprets this as an error. Run ntp on both machines to fix this problem.
• The response doesn't include the certificates required to complete the chain needed to verify the signer's certificate. The client frequently doesn't have all the certificates in the database that are needed to verify the signer's certificate, in which case Personal Security Manager can't verify the signer's certificate and OCSP fails. Make sure the entire chain is included with every response. This is the safest way to avoid this problem.
• If you are using ValiCert, misconfiguration may cause the Validation Authority not to send the certificate chain (including the CA root certificate and the OCSP responder's certificate) correctly.

Known Bugs/Issues for Personal Security Manager 1.3

• FORTEZZA is not guaranteed to work with this release. [# 94220]
• In some unusual circumstances you may encounter problems such as valid certificates not being verified or Netscape 6 freezing up. If you encounter a problem that doesn't appear to have a logical explanation, try the following as a last resort:
1. Exit Netscape 6, then relaunch it. If necessary, use Control-Alt-Delete on Windows 95/98/2000/NT to bring up the Task Manager and click End Process for both psm.exe and netscp6.exe.
2. Warning: Before taking this step, back up your own certificates stored internally by Personal Security Manager. If exiting and relaunching Netscape 6 doesn't take care of the problem, in some rare cases it may work to exit Netscape 6, then delete or rename your cert7.db and key3.db files (located in your user profile directory on Windows 95/98/2000/NT, or in the directory in which the Netscape or Mozilla executable resides on Unix) and relaunch the Netscape 6. You should also look for all other files in the same directory that begin with cert or key and end in .db and delete those files as well before relaunching Netscape 6.

Feedback