332 lines
14 KiB
HTML
332 lines
14 KiB
HTML
<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
|
|
<html>
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
|
|
<meta name="GENERATOR" content="Mozilla/4.73 [en] (WinNT; U) [Netscape]">
|
|
<meta name="Author" content="Sean Cotter">
|
|
<title>Personal Security Manager Release Notes</title>
|
|
</head>
|
|
<body>
|
|
|
|
<center>
|
|
<h1>
|
|
<img SRC="bannerrn.gif" height=32 width=468 align=ABSCENTER></h1></center>
|
|
|
|
<center>
|
|
<h2>
|
|
Netscape Personal Security Manager</h2></center>
|
|
|
|
<center>
|
|
<h2>
|
|
Release 1.3</h2></center>
|
|
|
|
<center>
|
|
<h2>
|
|
8/29/2000</h2></center>
|
|
|
|
<center>
|
|
<hr WIDTH="100%"></center>
|
|
These release notes contain the most recent information about this release
|
|
of Netscape Personal Security Manager. Please read these notes before using
|
|
the software.
|
|
<p>These notes include information for IS professionals who are thoroughly
|
|
familiar with security and public-key infrastructure (PKI) issues.
|
|
<p>Use of this product is subject to the terms detailed in the license
|
|
agreement accompanying Netscape 6 PR3.
|
|
<p>
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
Contents</h2>
|
|
<a href="#Documentation">Documentation</a>
|
|
<br><a href="#Changes Since PSM 1.2">Changes Since Personal Security Manager
|
|
1.2</a>
|
|
<br><a href="#Software/Hardware Requirements">Software/Hardware Requirements</a>
|
|
<br><a href="#unpacking">Installing Personal Security Manager</a>
|
|
<br><a href="#Using the Test Bed">Using Personal Security Manager</a>
|
|
<br><a href="#Known Bugs/Issues for 13 Release">Known Bugs/Issues for Personal
|
|
Security Manager 1.3</a>
|
|
<br><a href="#Feedback">Feedback</a>
|
|
<p>
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="Documentation"></a>Documentation</h2>
|
|
The following documentation is available with Personal Security Manager:
|
|
<ul>
|
|
<li>
|
|
<a href="contents.htm">Personal Security Manager Help</a> -- This online
|
|
help system can also be accessed by clicking the Help button in any personal
|
|
Security Manager window.</li>
|
|
|
|
<li>
|
|
<a href="cmcjavascriptapi.html">JavaScript API for Client Certificate Management</a>
|
|
-- This reference describes a new Javascript API for performing user certificate
|
|
management operations with Personal Security Manager, including one-click
|
|
issuance, forced certificate backup by end users, and automatic archival
|
|
of encryption private keys.</li>
|
|
</ul>
|
|
For the latest release notes, deployment guide, and other information,
|
|
see <a href="http://docs.iPlanet.com/docs/manuals/psm.html">http://docs.iPlanet.com/docs/manuals/psm.html</a><a href="http://developer.iPlanet.com/docs/manuals/psm.html">.</a>
|
|
<p>
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="Changes Since PSM 1.2"></a>Changes Since Personal Security Manager
|
|
1.2</h2>
|
|
Most changes since the Personal Security Manager 1.3 involves minor bug
|
|
fixes and optimizaitons.
|
|
<p>Netscape 6 and Mozilla do not supported signed or encrypted email. For
|
|
this reason, features related to email certifiates are not available in
|
|
this release.
|
|
<p>
|
|
<hr WIDTH="100%">
|
|
<h4>
|
|
<a NAME="Software/Hardware Requirements"></a><font size=+2>Software/Hardware
|
|
Requirements</font></h4>
|
|
<b>Operating systems supported:</b> Windows NT, Windows 95, Windows 98
|
|
Windows 2000; Solaris 2.6, 2.7, 2.8; and Red Hat Linux 6.1.
|
|
<p><b>Other software requirements: </b>This release has been tested with
|
|
Mozilla and Netscape 6. It is not intended for use with Communicator.
|
|
<br>
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="unpacking"></a>Installing Personal Security Manager</h2>
|
|
Personal Security Manager 1.3 comes installed with Netscape 6 PR3. To install
|
|
Netscape 1.3 with Mozilla, see <a href="http://docs.iplanet.com/docs/manuals/psm/psm-mozilla/index.html">http://docs.iplanet.com/docs/manuals/psm/psm-mozilla/index.html</a>.
|
|
<p>The instructions that follow describe how the Personal Security Manager
|
|
files are installed on each platform.
|
|
<h3>
|
|
Installing on Windows 95/98/2000/NT</h3>
|
|
Personal Security Manager is installed in a directory called <tt>psm</tt>
|
|
in the same directory where the Netscape or Mozilla executable resides.
|
|
<p><b>Windows NT users:</b> On Windows NT, you must have administrator
|
|
privileges to install Personal Security Manager.
|
|
<p><b>All Windows users:</b> Personal Security Manager 1.3 works with Mozilla
|
|
and Netscape 6, and Personal Security Manager 1.2 works with Mozilla, Netscape
|
|
6, and Communicator 4.7x--but not when any of these browsers are running
|
|
at the same time. For example, you must exit Netscape 6 PR3 before launching
|
|
Communicator with Personal Security Manager 1.2 enabled.
|
|
<h3>
|
|
Installing on Unix</h3>
|
|
Personal Security Manager must be installed locally, either in the default
|
|
location (<tt>/opt/netscape/security</tt>) or in some other local location.
|
|
However, if you install Personal Security Manager anywhere other than the
|
|
default location, Netscape 6 must also be installed locally.
|
|
<p>To run Personal Security Manager on Unix, you must be logged in as the
|
|
same Unix user you were logged in as when you installed it.
|
|
<h3>
|
|
Disabling Personal Security Manager</h3>
|
|
To <b>disable</b> Personal Security Manager temporarily, remove the directory
|
|
<tt>psm</tt> from the directory where the Netscape or Mozilla executable
|
|
resides.
|
|
<p>
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="Using the Test Bed"></a>Using Personal Security Manager</h2>
|
|
The sections that follow describe how to test some of the features of Personal
|
|
Security Manager that are available with this release:
|
|
<ul>
|
|
<li>
|
|
<a href="#Start Up Personal Security Manager with">Start Up Personal Security
|
|
Manager with Netscape 6</a></li>
|
|
|
|
<li>
|
|
<a href="#Use SSL with Server Authentication">Test Basic SSL</a></li>
|
|
|
|
<li>
|
|
<a href="#Get a Certificate">Get an SSL Client Certificate</a></li>
|
|
|
|
<li>
|
|
<a href="#View Your Personal Certificate">View Your Certificate</a></li>
|
|
|
|
<li>
|
|
<a href="#Using Your Personal Certificate for Client">Test Client Authentication</a></li>
|
|
|
|
<li>
|
|
<a href="#Validate Certificates Using OSCP">Validate Certificates Using
|
|
OCSP</a></li>
|
|
|
|
<li>
|
|
<a href="#Fetch Certificates Automatically from a Directory">Fetch Certificates
|
|
Automatically from a Directory</a></li>
|
|
</ul>
|
|
The sections that follow briefly describe how to test some of the features
|
|
listed above.
|
|
<p>For information on the JavaScript API supported by Personal Security
|
|
Manager, see <a href="cmcjavascriptapi.html">JavaScript API for Client
|
|
Certificate Management</a> and the Personal Security Manager Deployment
|
|
Guide. For the latest versions of these documents, see <a href="http://docs.iPlanet.com/docs/manuals/psm.html">http://docs.iPlanet.com/docs/manuals/psm.html</a>.
|
|
<h3>
|
|
<a NAME="Start Up Personal Security Manager with"></a>Use Personal Security
|
|
Manager with Netscape 6</h3>
|
|
Personal Security Manager starts automatically the first time Netscape
|
|
6 needs to perform some action involving security, such as handling an
|
|
SSL session.
|
|
<p>Follow these steps to view your security settings and confirm that
|
|
Personal Security Manager is running:
|
|
<ol>
|
|
<li>
|
|
Launch Netscape 6.</li>
|
|
|
|
<li>
|
|
Choose Security & Privacy from the Tasks menu, then choose Security
|
|
Manager to view your Personal Security Manager settings.</li>
|
|
|
|
<li>
|
|
Close the Personal Security Manager window.</li>
|
|
|
|
<li>
|
|
Go to the page <a href="psmtest.html">psmtest.html</a> (in the same directory
|
|
as these release notes), then choose Page Source from the View menu to
|
|
see the JavaScript code that a web programmer can use to detect Personal
|
|
Security Manager and its version number.</li>
|
|
</ol>
|
|
Note that the version number has two parts. The first is the version of
|
|
the PSM client library, and the second is the version of the PSM server
|
|
library.
|
|
<br>
|
|
<h3>
|
|
<a NAME="Use SSL with Server Authentication"></a>Test Basic SSL</h3>
|
|
Go to any online store, banking service, brokerage account, or other web
|
|
site that supports SSL. Verify that the lock in the lower-left corner of
|
|
the browser window is closed when you reach the pages for which SSL should
|
|
be enabled, for example a page where you are asked to give your credit
|
|
card number.
|
|
<h3>
|
|
<a NAME="Get a Certificate"></a>Get an SSL Client Certificate</h3>
|
|
Go to any public or private CA and apply for an SSL client certificate.
|
|
<p>To test one-click certificate issuance, dual key-pair certificates,
|
|
and other Personal Security Manager features, system administrators should
|
|
download, install, and configure Netscape Certificate Management System.
|
|
For complete CMS documentation and other information, see <a href="http://docs.iPlanet.com/docs/manuals/cms.html">http://docs.iPlanet.com/docs/manuals/cms.html</a>.
|
|
To download the latest version of CMS, see <a href="http://www.iplanet.com/downloads/download/">http://www.iplanet.com/downloads/download/</a>.
|
|
<h3>
|
|
<a NAME="View Your Personal Certificate"></a>View Your Certificate</h3>
|
|
After you have obtained a certificate, follow these steps to view it:
|
|
<ol>
|
|
<li>
|
|
Click the Security icon in the Navigator toolbar.</li>
|
|
|
|
<li>
|
|
Click the Certificates tab.</li>
|
|
|
|
<li>
|
|
Click to select your certificate.</li>
|
|
|
|
<li>
|
|
Click View.</li>
|
|
</ol>
|
|
You should see information about your new certificate.
|
|
<h3>
|
|
<a NAME="Using Your Personal Certificate for Client"></a><font size=+1>Test
|
|
Client Authentication</font></h3>
|
|
Personal Security Manager allows the SSL server and client to negotiate
|
|
which certificate to use, and in most cases they can agree on a single
|
|
correct certificate for the client to present. When this happens, the user
|
|
can access an SSL site that requires client authentication with zero additional
|
|
clicks.
|
|
<p>To test client authentication with Netscape Enterprise Server, system
|
|
administrators should follow these steps:
|
|
<ul>
|
|
<li>
|
|
Install an Enterprise Server and configure it for client authentication
|
|
as described in <a href="http://docs.iplanet.com/docs/manuals/cms/41/dep_gide/entsrv.htm">Appendix
|
|
D, Using SSL with Enterprise Server 3.x</a>, of <i>Netscape Certificate
|
|
Management System Installation and Deployment Guide</i>.</li>
|
|
|
|
<li>
|
|
Test the Enterprise Server installation as described at the end of Appendix
|
|
D using Personal Security Manager.</li>
|
|
</ul>
|
|
|
|
<h3>
|
|
<a NAME="Validate Certificates Using OSCP"></a>Validate Certificates Using
|
|
OSCP</h3>
|
|
Personal Security Manager supports the use of the On-Line Certificate Status
|
|
Protocol (OSCP) to check the validity of certificates in real time. Information
|
|
about this protocol and how configure Personal Security Manager 1.2 and
|
|
a forthcoming version of Certificate Management System to support it will
|
|
be available from <a href="http://docs.iPlanet.com/docs/manuals/psm.html">http://docs.iPlanet.com/docs/manuals/psm.html</a>.
|
|
<p>It's important to note that Personal Security Manager will accept signatures
|
|
from responders only under the following conditions:
|
|
<ul>
|
|
<li>
|
|
The response was signed by a delegated responder--that is, the responder's
|
|
certificate was signed by the same CA as the certificate you're trying
|
|
to verify and has the <tt>extendedKeyUsage</tt> bit set indicating that
|
|
the certificate is an OCSP response signer. The certificate should be the
|
|
same as a CA certificate with the addition of the <tt>extendedKeyUsage</tt>
|
|
bit.</li>
|
|
|
|
<li>
|
|
The user has designated a default responder in the OCSP Settings dialog
|
|
box (available from the Advanced tab under Options).</li>
|
|
</ul>
|
|
Common problems include the following:
|
|
<ul>
|
|
<li>
|
|
Time drift between the client and server machine. Personal Security Manager
|
|
expects the time of the response to be within the past 24 hours. If there
|
|
is a difference in the clocks between the machine used to sign the response,
|
|
so the response looks to Personal Security Manager like it was signed in
|
|
the future, Personal Security Manager interprets this as an error. Run
|
|
ntp on both machines to fix this problem.</li>
|
|
|
|
<li>
|
|
The response doesn't include the certificates required to complete the
|
|
chain needed to verify the signer's certificate. The client frequently
|
|
doesn't have all the certificates in the database that are needed to verify
|
|
the signer's certificate, in which case Personal Security Manager can't
|
|
verify the signer's certificate and OCSP fails. Make sure the entire chain
|
|
is included with every response. This is the safest way to avoid this problem.</li>
|
|
|
|
<li>
|
|
If you are using ValiCert, misconfiguration may cause the Validation Authority
|
|
not to send the certificate chain (including the CA root certificate and
|
|
the OCSP responder's certificate) correctly.</li>
|
|
</ul>
|
|
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="Known Bugs/Issues for 13 Release"></a>Known Bugs/Issues for Personal
|
|
Security Manager 1.3</h2>
|
|
|
|
<ul>
|
|
<li>
|
|
FORTEZZA is not guaranteed to work with this release. [# 94220]</li>
|
|
|
|
<li>
|
|
In some unusual circumstances you may encounter problems such as valid
|
|
certificates not being verified or Netscape 6 freezing up. If you encounter
|
|
a problem that doesn't appear to have a logical explanation, try the following
|
|
as a last resort:</li>
|
|
|
|
<ol>
|
|
<li>
|
|
Exit Netscape 6, then relaunch it. If necessary, use Control-Alt-Delete
|
|
on Windows 95/98/2000/NT to bring up the Task Manager and click End Process
|
|
for both <tt>psm.exe</tt> and <tt>netscp6.exe</tt>.</li>
|
|
|
|
<li>
|
|
<b>Warning:</b> <b>Before taking this step, back up your own certificates
|
|
stored internally by Personal Security Manager.</b> If exiting and relaunching
|
|
Netscape 6 doesn't take care of the problem, in some rare cases it may
|
|
work to exit Netscape 6, then delete or rename your <tt>cert7.db</tt> and
|
|
<tt>key3.db</tt> files (located in your user profile directory on Windows
|
|
95/98/2000/NT, or in the directory in which the Netscape or Mozilla executable
|
|
resides on Unix) and relaunch the Netscape 6. You should also look for
|
|
all other files in the same directory that begin with <tt>cert</tt> or
|
|
<tt>key</tt>
|
|
and end in <tt>.db</tt> and delete those files as well before relaunching
|
|
Netscape 6.</li>
|
|
</ol>
|
|
</ul>
|
|
|
|
<hr WIDTH="100%">
|
|
<h2>
|
|
<a NAME="Feedback"></a>Feedback</h2>
|
|
To send feedback to the Personal Security Manager development team, send
|
|
email to <a href="mailto:psmfeedback@netscape.com">psmfeedback@netscape.com</a>.
|
|
Feedback back sent to this address will be read by the team, but you will
|
|
not receive a personal response.
|
|
</body>
|
|
</html>
|