298 lines
16 KiB
HTML
298 lines
16 KiB
HTML
<!DOCTYPE html PUBLIC "-//w3c//dtd html 4.0 transitional//en">
|
|
<html>
|
|
<head>
|
|
|
|
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
|
|
|
|
<meta name="GENERATOR" content="Mozilla/4.75 [en] (WinNT; U) [Netscape]">
|
|
|
|
<meta name="Author" content="Sean Cotter">
|
|
<title>Personal Security Manager Release Notes</title>
|
|
</head>
|
|
<body>
|
|
<center>
|
|
<h1><img src="bannerrn.gif" height="32" width="468" align="Center"></h1>
|
|
</center>
|
|
<center>
|
|
<h2>Netscape Personal Security Manager</h2>
|
|
</center>
|
|
<center>
|
|
<h2>Release 1.4</h2>
|
|
</center>
|
|
<center>
|
|
<h2>12/18/2000</h2>
|
|
</center>
|
|
<center>
|
|
<hr width="100%"></center>
|
|
These release notes contain the most recent information about this release
|
|
of Netscape Personal Security Manager. Please read these notes before using
|
|
the software.
|
|
<p>These notes include information for IS professionals who are thoroughly
|
|
familiar with security and public-key infrastructure (PKI) issues.</p>
|
|
<p>Use of this product is subject to the terms detailed in the license agreement
|
|
at <a href="http://docs.iplanet.com/docs/manuals/psm/14/license.txt.">http://docs.iplanet.com/docs/manuals/psm/14/license.txt.</a></p>
|
|
<p></p>
|
|
<hr width="100%">
|
|
<h2>Contents</h2>
|
|
<a href="#Documentation">Documentation</a><br>
|
|
<a href="#Changes Since PSM 1.3">Changes Since Personal Security Manager 1.3</a>
|
|
<br>
|
|
<a href="#Software/Hardware Requirements">Software/Hardware Requirements</a>
|
|
<br>
|
|
<a href="#unpacking">Installing Personal Security Manager</a><br>
|
|
<a href="#Using the Test Bed">Using Personal Security Manager</a><br>
|
|
<a href="#Known Bugs/Issues for 14 Release">Known Bugs/Issues for Personal
|
|
Security Manager 1.4</a><br>
|
|
<a href="#Feedback">Feedback</a>
|
|
<p></p>
|
|
<hr width="100%">
|
|
<h2><a name="Documentation"></a>Documentation</h2>
|
|
The following documentation is available with Personal Security Manager:
|
|
<ul>
|
|
<li><a href="contents.htm">Personal Security Manager Help</a> -- This online
|
|
help system can also be accessed by clicking the Help button in any personal
|
|
Security Manager window.</li>
|
|
<li><a href="cmcjavascriptapi.html">JavaScript API for Client Certificate
|
|
Management</a> -- This reference describes a new Javascript API for performing
|
|
user certificate management operations with Personal Security Manager, including
|
|
one-click issuance, forced certificate backup by end users, and automatic
|
|
archival of encryption private keys.</li>
|
|
</ul>
|
|
For the latest release notes, deployment guide, and other information,see
|
|
<a href="http://docs.iPlanet.com/docs/manuals/psm.html">http://docs.iPlanet.com/docs/manuals/psm.html</a><a href="http://developer.iPlanet.com/docs/manuals/psm.html">
|
|
.</a>
|
|
<p></p>
|
|
<hr width="100%">
|
|
<h2><a name="Changes Since PSM 1.3"></a>Changes Since Personal Security Manager
|
|
1.3</h2>
|
|
The <a href="http://www.ietf.org/rfc/rfc2246.txt">Transport Layer Security
|
|
(TLS)</a> protocol is turned on by default in Personal Security Manager1.4.
|
|
To turn TLS off, open Personal Security Manager, click the Advanced tab, click
|
|
Options in the left frame, then deselect the checkbox labeled "Enable TLS."
|
|
<p>TLS is an IETF standard based on the Secure Sockets Layer (SSL) protocol.
|
|
It can be thought of as SSL version 3.1. Some servers that do not implement
|
|
SSL correctly cannot negotiate the SSL handshake with client software (such
|
|
as Personal Security Manager) that supports TLS. To allow Personal Security
|
|
Manager to use SSL with such TLS-intolerant servers, you must disable TLS
|
|
as described above.</p>
|
|
<p>Most other changes since Personal Security Manager 1.3 involve minor bug
|
|
fixes and optimizations.</p>
|
|
<p>This version of Netscape Personal Security Manager ships with Netscape
|
|
6 and also works with Mozilla and Communicator 4.7x. </p>
|
|
<p></p>
|
|
<hr width="100%">
|
|
<h4><a name="Software/Hardware Requirements"></a><font size="+2">Software/Hardware
|
|
Requirements</font></h4>
|
|
<b>Operating systems supported:</b> Windows NT, Windows 95, Windows 98, Windows
|
|
2000; Solaris 2.6, 2.7, 2.8; and Red Hat Linux 6.1.
|
|
<p></p>
|
|
<hr width="100%">
|
|
<h2><a name="unpacking"></a>Installing Personal Security Manager</h2>
|
|
Netscape Personal Security Manager 1.4 is installed with Netscape 6 and recent versions
|
|
of Mozilla.
|
|
|
|
<p>When you install Netscape 6 on Windows, Personal Security Manager is installed
|
|
in the directory <tt>C:\Program Files\Common Files\Netscape Shared\Security\</tt>.
|
|
|
|
<p>When you install Netscape 6 on Unix, Personal Security Manager is installed
|
|
in a directory called <tt>psm</tt> in the same directory where the <tt>netscape</tt>
|
|
executable resides.<br>
|
|
|
|
<p>The sections that follow describe how to install the Personal Security Manager
|
|
files for use with Communicator 4.7x.</p>
|
|
<h3>Installing on Windows 95/98/2000/NT for Use With Communicator 4.7x</h3>
|
|
|
|
To install Netscape Personal Security Manager on Windows 95/98/2000/NT for use with
|
|
Communicator 4.7 or later, save the file in a convenient location with the
|
|
specified filename, then drag the file's icon into a Navigator window (that
|
|
is, a browser window displayed by Communicator). Dropping the file's icon
|
|
over the browser window initiates SmartUpdate, which automatically installs
|
|
Personal Security Manager. Afterinstallation is complete, exit Communicator
|
|
and relaunch it. If your copy of Communicator is installed in the default
|
|
location, SmartUpdate installs the Personal Security Manager files in the
|
|
directory<tt>C:\Program Files\CommonFiles\Netscape Shared\Security\</tt>
|
|
and adds the file <tt>cmnav.dll</tt>in the directory <tt>C:\Program Files\Netscape\Communicator\Program</tt>.<br>
|
|
<h3>Installing on Unix for Use With Communicator 4.7x</h3>
|
|
|
|
To install Personal Security Manager for use with Communicator 4.7 or later on Unix, you
|
|
must be logged in as the same Unix user you will be logged in as when you
|
|
run Communicator. For the Unix installation to succeed, you must have write
|
|
privileges for both the directory where the Netscape executable resides and
|
|
the directory where the installation script creates the directory containing
|
|
the Personal Security Manager files. To install Personal Security Manager for
|
|
use with Communicator 4.7x, download the tar file for the version of the product
|
|
that you want to install and follow these steps:<br>
|
|
<ol>
|
|
<li>Exit Communicator, if it is running.</li>
|
|
<li>Decompress the downloaded file to some convenient location.</li>
|
|
<li>Run the psm-install program.</li>
|
|
</ol>
|
|
The psm-install program allows you to specify the directory in which Personal
|
|
Security Manager will be installed. In this release, you must install Personal
|
|
Security Manager locally. To do so, you can either install it in the default
|
|
location (<tt>/opt/netscape/security</tt>) or in some other local location. However,
|
|
if you install Personal Security Manager anywhere other than the default
|
|
location, Communicator must also be installed locally. To run Personal Security
|
|
Manager on Unix, you must be logged in as the same Unix user you were logged
|
|
in as when you installed it.<br>
|
|
<h3>Disabling Personal Security Manager</h3>
|
|
To <b>disable</b> Personal Security Manager temporarily, exit the browser,
|
|
then:
|
|
<ul>
|
|
<li>on Unix, remove the directory<tt>psm</tt> from the directory where
|
|
the<tt>netscape</tt>executable resides.</li>
|
|
<li>on Windows, rename the directory <tt>C:\Program Files\Common Files\Netscape
|
|
Shared\Security</tt> to something else.</li>
|
|
</ul>
|
|
<hr width="100%">
|
|
<h2><a name="Using the Test Bed"></a>Using Personal Security Manager</h2>
|
|
The sections that follow describe how to test some of the features of Personal
|
|
Security Manager that are available with this release:
|
|
<ul>
|
|
<li><a href="#Start Up Personal Security Manager with">Start Up Personal
|
|
SecurityManager with Netscape 6</a></li>
|
|
<li><a href="#Use SSL with Server Authentication">Test Basic SSL</a></li>
|
|
<li><a href="#Get a Certificate">Get an SSL Client Certificate</a></li>
|
|
<li><a href="#View Your Personal Certificate">View Your Certificate</a></li>
|
|
<li><a href="#Using Your Personal Certificate for Client">Test Client Authentication</a></li>
|
|
<li><a href="#Validate Certificates Using OSCP">Validate Certificates Using
|
|
OCSP</a></li>
|
|
</ul>
|
|
The sections that follow briefly describe how to test some of the features
|
|
listed above.
|
|
<p>For information on the JavaScript API supported by Personal SecurityManager,
|
|
see <a href="cmcjavascriptapi.html">JavaScript API for ClientCertificate
|
|
Management</a> and the Personal Security Manager DeploymentGuide. For the
|
|
latest versions of these documents, see <a href="http://docs.iPlanet.com/docs/manuals/psm.html">
|
|
http://docs.iPlanet.com/docs/manuals/psm.html</a>.</p>
|
|
<h3><a name="Start Up Personal Security Manager with"></a>Use Personal Security
|
|
Manager with Netscape 6</h3>
|
|
Personal Security Manager starts automatically the first time Netscape 6
|
|
needs to perform some action involving security, such as handling anSSL session.
|
|
<p>Follow these steps to view your security settings and confirm that
|
|
Personal Security Manager is running:</p>
|
|
<ol>
|
|
<li>Launch Netscape 6.</li>
|
|
<li>Choose Security & Privacy from the Tasks menu, then choose Security
|
|
Manager to view your Personal Security Manager settings.</li>
|
|
<li>Close the Personal Security Manager window.</li>
|
|
<li>Go to the page <a href="psmtest.html">psmtest.html</a> (in the same
|
|
directoryas these release notes), then choose Page Source from the View menu
|
|
tosee the JavaScript code that a web programmer can use to detect Personal
|
|
Security Manager and its version number.</li>
|
|
</ol>
|
|
Note that the version number has two parts. The first is the version ofthe
|
|
PSM client library, and the second is the version of the PSM serverlibrary.
|
|
<br>
|
|
|
|
<h3><a name="Use SSL with Server Authentication"></a>Test Basic SSL</h3>
|
|
Go to any online store, banking service, brokerage account, or other website
|
|
that supports SSL. Verify that the lock in the lower-left corner ofthe browser
|
|
window is closed when you reach the pages for which SSL shouldbe enabled,
|
|
for example a page where you are asked to give your creditcard number.
|
|
<h3><a name="Get a Certificate"></a>Get an SSL Client Certificate</h3>
|
|
Go to any public or private CA and apply for an SSL client certificate.
|
|
<p>To test one-click certificate issuance, dual key-pair certificates,and
|
|
other Personal Security Manager features, system administrators shoulddownload,
|
|
install, and configure Netscape Certificate Management System.For complete
|
|
CMS documentation and other information, see <a href="http://docs.iPlanet.com/docs/manuals/cms.html">
|
|
http://docs.iPlanet.com/docs/manuals/cms.html</a>.To download the latest
|
|
version of CMS, see <a href="http://www.iplanet.com/downloads/download/">
|
|
http://www.iplanet.com/downloads/download/</a>.</p>
|
|
<h3><a name="View Your Personal Certificate"></a>View Your Certificate</h3>
|
|
After you have obtained a certificate, follow these steps to view it:
|
|
<ol>
|
|
<li>Click the Security icon in the Navigator toolbar.</li>
|
|
<li>Click the Certificates tab.</li>
|
|
<li>Click to select your certificate.</li>
|
|
<li>Click View.</li>
|
|
</ol>
|
|
You should see information about your new certificate.
|
|
<h3><a name="Using Your Personal Certificate for Client"></a><font size="+1">
|
|
TestClient Authentication</font></h3>
|
|
Personal Security Manager allows the SSL server and client to negotiatewhich
|
|
certificate to use, and in most cases they can agree on a singlecorrect certificate
|
|
for the client to present. When this happens, the usercan access an SSL site
|
|
that requires client authentication with zero additionalclicks.
|
|
<p>To test client authentication with Netscape Enterprise Server, systemadministrators
|
|
should follow these steps:</p>
|
|
<ul>
|
|
<li>Install an Enterprise Server and configure it for client authentication
|
|
as described in <a href="http://docs.iplanet.com/docs/manuals/cms/41/dep_gide/entsrv.htm">
|
|
AppendixD, Using SSL with Enterprise Server 3.x</a>, of <i>Netscape Certificate
|
|
Management System Installation and Deployment Guide</i>.</li>
|
|
<li>Test the Enterprise Server installation as described at the end of
|
|
AppendixD using Personal Security Manager.</li>
|
|
</ul>
|
|
<h3><a name="Validate Certificates Using OSCP"></a>Validate Certificates
|
|
UsingOSCP</h3>
|
|
Personal Security Manager supports the use of the On-Line Certificate Status
|
|
Protocol (OSCP) to check the validity of certificates in real time. Information
|
|
about this protocol and how configure Personal Security Manager 1.3 andNetscape
|
|
Certificate Management System 4.2 to support it is available from<a href="http://docs.iPlanet.com/docs/manuals/psm/12/psmdply.htm">
|
|
http://docs.iPlanet.com/docs/manuals/psm/12/psmdply.htm</a>
|
|
<p>It's important to note that Personal Security Manager will accept signatures
|
|
from responders only under the following conditions:</p>
|
|
<ul>
|
|
<li>The response was signed by a delegated responder--that is, the responder's
|
|
certificate was signed by the same CA as the certificate you're trying
|
|
to verify and has the <tt>extendedKeyUsage</tt> bit set indicating thatthe
|
|
certificate is an OCSP response signer. The certificate should be thesame
|
|
as a CA certificate with the addition of the <tt>extendedKeyUsage</tt>bit.</li>
|
|
<li>The user has designated a default responder in the OCSP Settings dialog
|
|
box (available from the Advanced tab under Options).</li>
|
|
</ul>
|
|
Common problems include the following:
|
|
<ul>
|
|
<li>Time drift between the client and server machine. Personal Security
|
|
Managerexpects the time of the response to be within the past 24 hours. If
|
|
thereis a difference in the clocks between the machine used to sign the response,
|
|
so the response looks to Personal Security Manager like it was signed inthe
|
|
future, Personal Security Manager interprets this as an error. Runntp on
|
|
both machines to fix this problem.</li>
|
|
<li>The response doesn't include the certificates required to complete
|
|
thechain needed to verify the signer's certificate. The client frequently
|
|
doesn't have all the certificates in the database that are needed to verify
|
|
the signer's certificate, in which case Personal Security Manager can'tverify
|
|
the signer's certificate and OCSP fails. Make sure the entire chainis included
|
|
with every response. This is the safest way to avoid this problem.</li>
|
|
<li>If you are using ValiCert, misconfiguration may cause the Validation
|
|
Authoritynot to send the certificate chain (including the CA root certificate
|
|
andthe OCSP responder's certificate) correctly.</li>
|
|
</ul>
|
|
<hr width="100%">
|
|
<h2><a name="Known Bugs/Issues for 14 Release"></a>Known Bugs/Issues for
|
|
Personal Security Manager 1.4</h2>
|
|
<ul>
|
|
<li>To run Personal Security Manager on Unix with Netscape 6 or Communicator,
|
|
you must be logged in as thesame Unix user you were logged in as when the
|
|
browser was installed.</li>
|
|
<li>FORTEZZA is not guaranteed to work with this release. [# 94220]</li>
|
|
<li>In some unusual circumstances you may encounter problems such as valid
|
|
certificates not being verified or the browser freezing up. If you encounter
|
|
a problem that doesn't appear to have a logical explanation, try the following
|
|
as a last resort:</li>
|
|
<ol>
|
|
<li>Exit the browser, then relaunch it. If necessary, use Control-Alt-Delete
|
|
on Windows 95/98/2000/NT to bring up the Task Manager and click End Process
|
|
for both <tt>psm.exe</tt> and <tt>netscp6.exe</tt>.</li>
|
|
<li><b>Warning:</b> <b>Before taking this step, back up your own certificates
|
|
stored internally by Personal Security Manager.</b> If exiting and relaunching
|
|
the browser doesn't take care of the problem, in some rare cases it maywork
|
|
to exit the browser, then delete or rename your <tt>cert7.db</tt> and<tt>
|
|
key3.db</tt>files (located in your user profile directory on Windows 95/98/2000/NT,
|
|
or in the directory in which the Netscape or Mozilla executable resideson
|
|
Unix) and relaunch the browser. You should also look for all otherfiles in
|
|
the same directory that begin with <tt>cert</tt> or<tt>key</tt>and end in
|
|
<tt>.db</tt> and delete those files as well before relaunchingthe browser.</li>
|
|
</ol>
|
|
</ul>
|
|
<hr width="100%">
|
|
<h2><a name="Feedback"></a>Feedback</h2>
|
|
To send feedback to the Personal Security Manager development team, send email
|
|
to <a href="mailto:psmfeedback@netscape.com">psmfeedback@netscape.com</a>.
|
|
Feedback back sent to this address will be read by the team, but you will
|
|
not receive a personal response.
|
|
</body>
|
|
</html>
|