INSTALLATION GUIDE. Managed PKI v7.1. Hardware/Software Requirements

Transcription

1 INSTALLATION GUIDE Managed PKI v7.1 Hardware/Software Requirements VeriSign, Inc. February 20, 2007

2 Managed PKI v7.1 Hardware/Software Requirements Copyright VeriSign, Inc. All rights reserved. The information in this document belongs to VeriSign. It may not be used, reproduced or disclosed without the written approval of VeriSign. DISCLAIMER AND LIMITATION OF LIABILITY VeriSign, Inc. has made efforts to ensure the accuracy and completeness of the information in this document. However, VeriSign, Inc. makes no warranties of any kind (whether express, implied or statutory) with respect to the information contained herein.verisign, Inc. assumes no liability to any party for any loss or damage (whether direct or indirect) caused by any errors, omissions, or statements of any kind contained in this document. Further, VeriSign, Inc. assumes no liability arising from the application or use of the product or service described herein and specifically disclaims any representation that the products or services described herein do not infringe upon any existing or future intellectual property rights. Nothing herein grants the reader any license to make, use, or sell equipment or products constructed in accordance with this document. Finally, all rights and privileges related to any intellectual property right described herein are vested in the patent, trademark, or service mark owner, and no other person may exercise such rights without express permission, authority, or license secured from the patent, trademark, or service mark owner. VeriSign Inc. reserves the right to make changes to any information herein without further notice. TRADEMARKS VeriSign, the VeriSign logo, Where it all comes together., Intelligence and Control, VeriSign Trust Network, Unified Authentication, and other trademarks, service marks, and logos are registered or unregistered trademarks of VeriSign and its subsidiaries in the United States and in foreign countries. Other trademarks and service marks in this document are the property of their respective owners. This document may describe features and/or functionality that are not present in your software or your service agreement. Contact your account representative to learn more about what is available with this VeriSign product. If you need help using this product, contact customer support or Publication date: February 20, 2007

3 INSTALLATION GUIDE Contents Chapter 1 Introduction About this Manual Related Managed PKI Documents Compatibility Matrix for Single Digital ID Chapter 2 Managed PKI Requirements Protocols and Ports Internet Access for Authentication Methods Managed PKI Administrator Workstation Hardware Supported Operating Systems and Browsers End User Machine Managed PKI for SSL Administrator Workstation and End User Operating Systems Supported Browsers Supported Servers for Managed PKI for SSL Local Hosting VeriSign Registration Authority Service Module Requirements VeriSign Registration Authority Service Server... 9 VeriSign Registration Authority Service Data Sources Local Hosting Server Digital Notarization VeriSign, Inc. February 20, 2007

4 Managed PKI v7.1 Hardware/Software Requirements Web Browser Requirements Certificate Validation Module (CVM) Certificate Parsing Module (CPM) Online Certificate Status Protocol (OCSP) Browser Requirements Device Manufacturing Service (DMS) DMS Requirements (NT only) Outsourced Authentication Chapter 3 Go Secure! Requirements Go Secure! for Microsoft Exchange Managed PKI Installation Requirements Local Hosting Server Requirements Exchange Server Requirements Go Secure! for Web Applications Managed PKI Installation Requirements For Hosting Windows 2003 MSI Packages End User Client Requirements Chapter 4 Luna Token Reader Compatibility...19 Token Readers Tokens iv VeriSign, Inc. February 20, 2007

5 rte Chap CHAPTER 1 1Introduction Managed PKI v7.1 Hardware/Software Requirements describes what your organization needs to set up VeriSign enterprise services. About this Manual Managed PKI v7.1 Hardware/Software Requirements is designed for VeriSign Managed PKI Services customers and installers who need to know what equipment to buy for their enterprise configurations. This document contains lists of the hardware and software you must have to install these programs. For details about how to configure and set up VeriSign products, refer to the installation guides that accompany the respective products. Note Read the appropriate hardware/software section for the product you want to install. It is not possible for VeriSign to test every combination of third-party client, server, operating system, service pack, and so on. However, VeriSign does test the most common combinations and then, relying on the assertions of the vendors of these products, expands the list of supported combinations which are expected to work. For example, if a vendor asserts that a version of a Web browser is compatible with all versions of an operating system, VeriSign tests products and services against the Web browser on the most common version of the operating system and relies on the vendor s statement to assume the Web browser works with all versions of the operating system. If a problem arises with a combination which could not have been anticipated, VeriSign is committed to assisting you to work around the issue. If VeriSign cannot help you and cannot influence a timely patch to the third-party product by the vendor, we will add it to a list of unsupported combinations which will be available in our knowledge base and in this document. This document is divided into the following sections: VeriSign, Inc. February 20,

6 Managed PKI v7.1 Hardware/Software Requirements + Chapter 2, Managed PKI Requirements, lists the requirements for: Managed PKI Administrator Workstation on page 6 End User Machine on page 7 Managed PKI for SSL on page 7 Local Hosting on page 8 VeriSign Registration Authority Service Module on page 9 Digital Notarization on page 11 Certificate Validation Module (CVM) on page 11 Certificate Parsing Module (CPM) on page 12 Online Certificate Status Protocol (OCSP) on page 13 Device Manufacturing Service (DMS) on page 13 Outsourced Authentication on page 13 + Chapter 3, Go Secure! Requirements, lists the requirements for: Go Secure! for Microsoft Exchange on page 15 Go Secure! for Web Applications on page 17 + Chapter 4, Luna Token Reader Compatibility, lists the Luna token hardware requirements for Managed PKI. Related Managed PKI Documents Customer documentation for the VeriSign products described in this document is available on the various product CDs or from the Control Center Download page. If you did not receive product documentation or would like to order more copies of product documentation, contact your VeriSign account manager for information. Compatibility Matrix for Single Digital ID The Compatibility Matrix shows which different VeriSign enterprise services, software, and hardware can be used with the same Digital ID. The abbreviations used in the compatibility matrix are listed in Table 1-1. Table 1-1 Abbreviations used in the Compatibility Matrix RA VeriSign Registration Authority OCSP Online Certificate Status Protocol Service PTA Personal Trust Agent in Go Secure! CVM Certificate Validation Module for Web Applications GS! MSE Go Secure! for Microsoft Exchange CPM Certificate Parsing Module Priv CA Private hierarchy File Enc File Encryption feature of Go Secure! for Web Applications Publ CA Public hierarchy DMS Device Manufacturing Service MPKI SSL Managed PKI for SSL OA Outsourced Authentication CAS Consumer Authentication Service Win2k Int Windows 2000/XP integration with smart cards MS EFS Microsoft Encryption File Service Integration 2 VeriSign, Inc. February 20, 2007

7 Chapter 1 Introduction Find out if the products or services are compatible by looking at the intersection of the two items you are interested in. For example, if you want to check the features PTA (A), VeriSign Registration Authority Service (B), and Local Hosting (C) (ABC), check if AB (PTA row and VeriSign Registration Authority Service column) is compatible (the result is Yes). Next, check if AC is compatible (Yes), and finally compare BC (Yes). A Yes indicates the two features compared work together and that a single Digital ID can be used for both the features to work. A No indicates incompatibility or these features are not designed to work together. A Req d indicates the product requires VeriSign Registration Authority Service and Local Hosting. Note The following numbered notes corresponds to the numeric codes in the table. 1 Managed PKI for SSL and Managed PKI for SSL Premium Edition can only be issued under Public 2 IPSec issued under Private or shared (co-branded) CAs. 3 Registration Authority incorporates Automated Administration functionality, so a separate Automated Administration server is not needed. 4 Works with client certificates only. 5 Passcode, Manual Authentication, and VeriSign Registration Authority, including key escrow and recovery, are mutually exclusive. 6 There is no site kit for IPSec or Managed PKI for SSL. 7 Passcode can be made to work with VeriSign Registration Authority Service using customization. 8 CVM works with OCSP (CVM and OCSP are orthogonal). 9 Requires VeriSign Registration Authority, which requires Local Hosting. For Go Secure! for Microsoft Exchange, VeriSign Registration Authority and Local Hosting are required only if you are using Windows authentication, but optional otherwise. 10 PTA supports smart cards with the CAPI certificate store only. 11 File Encryption Feature requires PTA 2.x of higher. 12 CPM and CVM work with native SSL client authentication. PTA 6.0 and higher have added support for native SSL client authentication. 13 VeriSign Registration Authority Service requires Local Hosting. VeriSign Registration Authority and Local Hosting do not require key escrow and recovery functionality. 14 Microsoft does not currently support EFS certificates on smart cards. To use EFS, the certificate must be on the local hard drive. You can use the same certificates for Win2k logon (on a smart card) and for EFS (copy stored locally). 15 Smart card CSP required for Win2k logon. Microsoft Base CSP required for EFS. PTA works in CAPI mode only (PTA cannot use VeriSign Certificate Store). 16 Not supported by Java PTA. Supported by ActiveX PTA without TPM functionality. 17 Not supported by Java PTA. Supported by ActiveX PTA, with or without TPM functionality. VeriSign, Inc. February 20,

8 RA Local Host PTA GS! MSE Priv CA Publ CA MPKI SSL Pass code OC SP CVM, CPM File Enc DM S Smartcards BAS OA Client VPN CAS Win2k Int RA Local req'd Host (13) yes PTA (15) yes GS! yes yes MSE (9) (15) yes Public CA yes yes yes yes Priv CA yes yes yes yes Publ Cy yes yes yes yes no (1) IPSec no (6) no (6) yes no (6) yes (2) yes (2) MPKI SSL no (6) no (6) no (4) no (4) no (1) yes Passcode yes no (7) yes yes (9) yes yes no (4) OC yes yes SP yes yes (16) (16) yes yes no yes CVM, yes CPM yes yes (12) yes yes yes no (4) yes File Enc yes yes yes (8) yes (11,15) yes yes yes no (4) yes no no DMS no no no no yes yes no no no no no Smart yes cards yes yes (14) yes yes yes no yes yes yes no no BAS no yes yes no yes yes no no yes yes no no yes OA no (9); req'd req'd (9) yes no yes yes no no yes yes no no yes no Client VPN yes yes yes no yes no no yes yes no no no no no no CAS no yes no no yes yes no no yes no no no no no no no Win2k Int. req'd (9) req'd (9) MS EFS yes yes yes (15) yes yes yes no no (5) yes yes no no yes no no no no yes (15) yes yes yes no no (5) yes yes no no yes (14) no no no no yes MS EFS

9 rte Chap CHAPTER 2 2Managed PKI Requirements This document describes the hardware and software that have been tested for use with Managed PKI. You may find that earlier versions of hardware and/or software and service packs work well with Managed PKI and its options. However, the versions in this document are the ones that are supported by VeriSign. For the most current information about any Managed PKI version, refer to the Release Notes for that product. Protocols and Ports The numbers in the following list indicate port numbers. End user - Local Hosting server: 443, https Local Hosting server - VeriSign Registration Authority Service: 2003, TCP/IP VeriSign Registration Authority Service - Data sources: LDAP directory: 389, LDAP Secure LDAP: 636, LDAP with SSL Database: ODBC Local Hosting (with VeriSign Registration Authority Service) - VeriSign: 80, http Figure 2-1 shows a common hardware configuration for a Managed PKI installation with Local Hosting, Go Secure! for Web Applications, and VeriSign Registration Authority Service functionality. VeriSign, Inc. February 20,

10 Managed PKI v7.1 Hardware/Software Requirements Figure 2-1 Typical configuration for Managed PKI with VeriSign Registration Authority Service Internet Access for Authentication Methods There are three types of authentication methods that use Local Hosting: + Manual Authentication (Local Hosting not required). Client/end user needs Internet access to VeriSign for this to work. Local Hosting can be used. + Passcode Authentication (Local Hosting not required). Client/end user needs Internet access to VeriSign for this to work. Local Hosting can be used. + VeriSign Registration Authority Service (Local Hosting required). Client/end user does not need Internet access for this to work. The Local Hosting server needs access to the Authentication server and the Internet. A CGI on the Local Hosting server handles communication with VeriSign. Managed PKI Administrator Workstation This section describes hardware and software needed for the administrator s machine for Managed PKI, Managed PKI for SSL, Managed PKI for SSL Premium Edition, and IPSec Managed PKI accounts. Hardware + Intel-based PC, 866Mhz Pentium or faster Note Lighter configurations will work but may not meet expected performance levels. In addition, adding more memory or a faster CPU to this configuration would probably not make a difference in performance. The administrator workstation must be able to access the Internet through port VeriSign, Inc. February 20, 2007

11 Chapter 2 Managed PKI Requirements + 512MB RAM + 10MB free disk space Required for USB Token Users + CD-ROM drive + Aladdin token(s) and connector cable + One available USB port for connecting the token Supported Operating Systems and Browsers The Administrator workstation requires the following browsers and operating systems. All browsers must be capable of 128-bit crypto, with JavaScript support enabled. Table 2-1 Administrator workstation operating system/browser requirements Operating System Browser Windows XP SP2 Internet Explorer 6.x, 7.x Firefox 1.5 Solaris 10 Mozilla Macintosh OS X 10.2 Firefox 1.5 End User Machine The end user machine requires the following browsers and operating systems. All browsers must be capable of 128-bit crypto, with JavaScript support enabled. Table 2-2 Administrator workstation operating system/browser requirements Operating System Browser Windows XP SP2 Internet Explorer 6.x, 7.x Firefox 1.5 Solaris 10 Mozilla Macintosh OS X 10.2 Firefox 1.5 Note The end user machine must be able to access the Local Hosting server through port 443 and the Internet through port 443 if VeriSign Registration Authority Service is not being used. Managed PKI for SSL Administrator Workstation and End User Operating Systems + Windows 2000 SP2 + Windows 2003 Enterprise SP1 + Windows ME + Windows XP VeriSign, Inc. February 20,

12 Managed PKI v7.1 Hardware/Software Requirements Supported Browsers + Internet Explorer 6.x, 7.x + Netscape Communicator 4.7x, 4.8, 7.x + Firefox 1.5 Supported Servers for Managed PKI for SSL Supported server vendors for Managed PKI for SSL are listed in Table 2-3. Table 2-3 Supported Server Vendors for Managed PKI for SSL Microsoft Netscape Apache iplanet Advanced Businesslink AliBaba (WarpGroup) AOL/Navisoft Aventail Backweb BEA WebLogic Beyond Software Brokat C2Net Apache SSL-US Cacheflow Compaq Consensus Control Data Systems Covalent Dascom Domino F5 Frontier Technologies Gradient Hummingbird I/NET IBM Information Builders Information Hyperlink Ingrian Networks Intel Internet Factory Iserver JavaSoft Microsoft Visual InterDev 6.0 Mirapoint Mitem Nanoteq NetCentric Netscreen Nokia Novell Open Market OpenConnect Systems Oracle O'Reilly & Associates Process Software Purveyor Quarterdeck/StarNine r3 Radnet Red Hat Roxen SilverStream Software Sirius Software Sonic WALL Sterling Software Sun Microsystems Tandem Tektonic Tempest Software Tenon (WebTen) Thawte Consulting Unify Unisys Unwired Planet Velocity Software Volera Wall Data WebMethods WebSphere WebSTAR Zeus Local Hosting To provide SSL-enabled access to your locally-hosted enrollment pages, you should install the appropriate VeriSign server certificate. Although SSL is not required, it is highly recommended. If used with VeriSign Registration Authority Service. Front-end Local Hosting server must be able to send outbound http on port 80 without being prompted for a proxy user ID or password. Also, if Local Hosting is on the same machine as VeriSign Registration Authority Service, then VeriSign Registration Authority Service only requires a Web server. 8 VeriSign, Inc. February 20, 2007

13 Chapter 2 Managed PKI Requirements If used without VeriSign Registration Authority Service. The Local Hosting server does not need outbound access, but the end user does (on port 443). Table 2-4 Supported Web Server Platforms Web Server Applications Operating Systems Sun Java System Web Server 6.1 Service Pack 2 Solaris9 or 10: Sparc Ultra 2 or faster 150 MB free disk space 512 MB RAM Microsoft IIS 6.0 Windows 2003 Enterprise R2: Pentium, 866 Mhz or faster 100 MB free disk space 512 MB RAM Apache Web server 2.0.x Red Hat Enterprise Linux AS 4.0 Pentium, 866 Mhz or faster 100 MB free disk space 512 MB RAM VeriSign Registration Authority Service Module Requirements + VeriSign Registration Authority Service server: VeriSign Registration Authority Service host with same requirements as Local Hosting server host. (Can be on the same machine as Local Hosting server, although it is recommended that it be installed on a separate machine separated by a firewall.) + Local Hosting module + LDAP/ODBC database for validating shared secret data and/or registration of user certificates. Can be two separate databases or one. + For some hardware token readers, the interface slot is a PCI slot. See Chapter 4, Luna Token Reader Compatibility for the specific token reader that applies. VeriSign Registration Authority Service Server Platform configurations for VeriSign Registration Authority Service servers are listed in Table 2-5. VeriSign, Inc. February 20,

14 Managed PKI v7.1 Hardware/Software Requirements Note Most customers are able to edit the configuration file for the VeriSign Registration Authority Service server to allow it to work with verification and registration data sources, and will therefore not need a compiler to customize the VeriSign Registration Authority Service code. Table 2-5 Platform configurations for RA servers Operating Systems Requirements Optional (Compilers) Windows 2003 Enterprise R2 Pentium, 866Mhz or faster 100MB free disk space 512MB RAM Solaris 9 or 10 Sparc Ultra 5 or faster 150MB free disk space 512MB RAM Red Hat Enterprise Linux AS 4.0 Pentium, 866Mhz or faster (Intel x86 processors only) 100MB free disk space 512MB RAM Optional, only if you want to customize: Microsoft Visual C Optional, only if you want to customize: Sun Forte C/C++ Workshop 6.2, Update 2 Optional, only if you want to customize: gcc and g libc so for lib VeriSign Registration Authority Service Data Sources The Registration Authority data sources include the following: + Verification + Registration + Key Recovery (each escrowed key requires approximately 6k of disk space), if implementing the key escrow and recovery option Data sources should be replicated for redundancy, high availability, and fail-over. LDAP Directory VeriSign Registration Authority Service supports the following LDAP directories: + Sun Java System Directory Server Windows 2003 Enterprise Active Directory + OpenLDAP 2.3 (Red Hat Enterprise Linux AS 4.0) ODBC + DataDirect ODBC for Oracle 9i on Solaris 9 or 10 + DataDirect ODBC for Oracle 10g on Solaris 10 + Microsoft SQL Server 2000, 2005 Local Hosting Server The front-end Local Hosting server used with VeriSign Registration Authority Service must be able to send traffic though outbound ports 80 and 443 without being prompted for a proxy user ID or password. For configuration information, see Local Hosting on page VeriSign, Inc. February 20, 2007

15 Chapter 2 Managed PKI Requirements Digital Notarization Digital Notarization is a VeriSign back-end service that is accessed from the Managed PKI Control Center or directly from VeriSign s Web site. This requires no installation at the customer site. Web Browser Requirements + Netscape Communicator 4.7x, 4.8, 7.x + Internet Explorer 5.5, 6.x Certificate Validation Module (CVM) The CVM plug-in is installed on a Web server. To access the Certificate Validation Module from the Web, use any Web browser that supports SSL client authentication. Table 2-6 Platform Requirements Web Server Plug-in Requirements Platforms Microsoft ISA 2006 Windows 2003 Enterprise R2: Pentium, 866Mhz or faster 10MB free disk space 128MB RAM Microsoft Internet Information Server (IIS) 6.0 Windows 2003 Enterprise R2: Pentium, 866Mhz or faster 10MB free disk space 128MB RAM Sun ONE Web Server 6.0 SP5 Solaris 9: Sparc Ultra 2 or faster 10MB free disk space 128MB RAM Sun Java System Web Server 6.1 SP2 Solaris 10: Sparc Ultra 2 or faster 10MB free disk space 128MB RAM VeriSign, Inc. February 20,

16 Managed PKI v7.1 Hardware/Software Requirements Table 2-6 Platform Requirements Web Server Plug-in Requirements Platforms Apache Red Hat Enterprise Linux AS MB free disk space 128MB RAM HP-UX 11i (11-11): 10MB free disk space 128MB RAM Certificate Parsing Module (CPM) VeriSign provides two CPM implementations: + Server plug-in version (NSAPI or SAF). The server plug-in can be used with any other server plug-ins and extensions such as servers, javascript, CGI programs in any programming language (csh, Perl, C, C++), NSAPI modules, and so on. + Toolkit Both support the following platforms: Table 2-7 Platform Requirements Web Server Plug-in Requirements Platforms Microsoft Internet Information Server (IIS) 6.0 Windows 2003 Enterprise R2: Server Plug-in CPM is available as a server plug-in for SunONE Web Server 6.0. VeriSign provides example CGI programs that use the server plug-in for: + C and C++ for Bourne shell and C shell Pentium, 866Mhz or faster 10MB free disk space 128MB RAM Sun ONE Web Server 6.0 SP5 Solaris 9: Sun Java System Web Server 6.1 SP2 Solaris 10: Sparc Ultra 2 or faster 10MB free disk space 128MB RAM Sparc Ultra 2 or faster 10MB free disk space 128MB RAM 12 VeriSign, Inc. February 20, 2007

17 Chapter 2 Managed PKI Requirements + Perl for Bourne shell and C shell. Online Certificate Status Protocol (OCSP) Online Certificate Status Protocol (OCSP) requires no installation at the customer site besides the CVM plug-in, which can be modified to access OCSP. Browser Requirements Any Web browser that supports SSL client authentication. Device Manufacturing Service (DMS) DMS enables a cable modem or device manufacturer to send batch requests for certificates to VeriSign. The manufacturer then downloads the certificates. DMS Requirements (NT only) + NT 4.0 English version or higher MB of RAM + 5G+ of disk space + Luna token reader + DMS CD Outsourced Authentication Requirements: + Local Hosting + VeriSign Registration Authority Service (must be customized for Outsourced Authentication) The Managed PKI options you can use with Outsourced Authentication are listed in Table 2-8. Note If you have contracted for the services of VeriSign s Professional Services Organization (PSO), PSO will handle all installation and configuration issues as part of your initial service contract. This includes configuring VeriSign Registration Authority Service to work with Outsourced Authentication, enrolling you for your first certificate, assisting with running the Policy Wizard to set up the initial Managed PKI configuration, and creating your end users lifecycle pages. VeriSign, Inc. February 20,

18 Managed PKI v7.1 Hardware/Software Requirements Table 2-8 Managed PKI options used with Outsourced Authentication CD Local Hosting Authentication Options VeriSign Registration Authority Service Other Managed PKI CD Outsourced Authentication CD Required VeriSign Registration Authority Service (required) Not supported Optional: Go Secure! for Web Applications CVM CPM OCSP Outsourced Authentication is an Managed PKI option that works with the same hardware and software that a customer receives with VeriSign Registration Authority Service. However, Outsourced Authentication requires a customer or VCS to make some programming modifications to the VeriSign Registration Authority Service source code (included on the Managed PKI CD). This enables the customer's authentication logic to be used to decide when to reject a enrollment request or pass it on as a pending request. The Managed PKI features you can use with Outsourced Authentication are listed in Table 2-9. Table 2-9 Features supported with Outsourced Authentication Managed PKI add-ons and options Required Optional Not supported Local Hosting VeriSign Registration Authority Service X X Manual Authentication Passcode Authentication Go Secure! for Web Applications (PTA) Authentication should be done at VeriSign or through VeriSign Registration Authority Service. However, Manual Authentication has not been disabled. X X Go Secure! for Microsoft Exchange X CVM CPM OCSP X X X 14 VeriSign, Inc. February 20, 2007

19 rte Chap CHAPTER 3 3Go Secure! Requirements Go Secure! requirements are listed in the following sections. Go Secure! for Microsoft Exchange Go Secure! for Microsoft Exchange v7.0 works with specific combinations of versions of Microsoft Exchange and Outlook, as detailed below. Managed PKI Installation Requirements Table 3-1 lists the Managed PKI requirements for Go Secure! for Microsoft Exchange. Table 3-1 Managed PKI options used with Go Secure! for Microsoft Exchange CD Local Hosting Authentication Methods VeriSign VeriSign Registration Authority Service Required: Managed PKI Local Hosting CD Go Secure! for Microsoft Exchange CD Optional: Go Secure! for Web Applications CD Optional Manual Authentication Passcode Authentication VeriSign Registration Authority Service Windows authentication (Requires the VeriSign Registration Authority Service module) Optional Local Hosting Server Requirements If you are locally hosting, you must install the Go Secure! for Microsoft Exchange site kit on the same server as your Local Hosting site kit. If you are also implementing the optional VeriSign Registration Authority Service, refer to VeriSign Registration Authority Service Module on page 9. Exchange Server Requirements The Exchange server can be Windows 2003 Enterprise R2 server. + Pentium, 866Mhz or faster + 100MB free disk space + 256MB RAM + Microsoft Exchange Server 2003 Enterprise VeriSign, Inc. February 20,

20 Managed PKI v7.1 Hardware/Software Requirements + Outlook Domain controller is Windows 2003 with Active Directory, with either No Active Directory Connector (ADC), or Active Directory Connector replicating data between the Active Directory and Exchange directory. CAUTIONMicrosoft Exchange Server and the Windows domain controller should be on separate machines. Exchange Server 2003 The Exchange Server schema must be such that the User object on the Active Directory includes the following LDAP attributes: + cn + alias + rfc822name + usercertificate + usersmimecertificate + legacyexchangedn + directoryname Directory Replication If multiple Exchange Servers are involved, then directory replication must be enabled in such a way that all of the above mentioned attributes are replicated. Each of the above mentioned LDAP attribute names have a different name as seen from the Exchange Administrator console. For example, the LDAP attribute usercertificate is referred as X509-Cert in Exchange Administrator console. End User Mailboxes All users who are going to enroll for a Go Secure! for Microsoft Exchange certificate must have a mailbox created on an Exchange Server. The mailbox must have a valid Primary NT Account value, as displayed in the mailbox property sheet through the Exchange Administrator Console. End User Machine Requirements + Internet Explorer 5.5, or Outlook Windows Installer version 2.x + MSI version 2.0 packages supplied on Go Secure! for Microsoft Exchange CD or on the Download page of the Control Center. 16 VeriSign, Inc. February 20, 2007

21 Chapter 3 Go Secure! Requirements Go Secure! for Web Applications Managed PKI Installation Requirements Table 3-2 lists the Managed PKI requirements for Go Secure! for Web Applications. Table 3-2 Managed PKI options used with Go Secure! for Web Applications CD Local Hosting Authentication Options VeriSign Registration Authority Service Other Managed PKI Local Hosting CD Go Secure! for Web Applications CD Optional Manual Authentication Passcode Authentication VeriSign Registration Authority Service Optional Table 3-3 lists the application server requirements. Table 3-3 Application Server Requirements Web Server Platform Microsoft Internet Information Server (IIS) 6.0 Windows 2003 Enterprise R2: Pentium, 866Mhz or faster 10MB free disk space 128MB RAM Sun Java System Web Server 6.1 SP2 Solaris 10: Sparc Ultra 2 or faster 10MB free disk space 128MB RAM Apache Red Hat Enterprise Linux AS MB free disk space 128MB RAM WebSphere and WebLogic Application Server Integration The PTA application server integrates with + IBM WebSphere Application Server v3.5 + WebLogic server 6.0 and above. + Apache (on Red Hat Enterprise Linux AS 4.0 only) Supported hardware platforms and Web server software are shown in Table 3-3. VeriSign, Inc. February 20,

22 Managed PKI v7.1 Hardware/Software Requirements Note If you use the PTA for transaction signing and you want to customize the authentication server code, install the appropriate development environment as described on page 10. Netegrity SiteMinder Integration The PTA server implements a custom authentication scheme that integrates with Netegrity s SiteMinder 5.0. Supported software platforms are Solaris 8, 9, or 10, or Windows Signature Verification API Supported Windows Server 2003 implements a COM version of Signature Verification API. This allows enterprises to verify digital signatures in the Microsoft ASP environment. This support includes the standard capabilities of the PTA server suite such as chain validation and revocation checking based on CRLs and OCSP. For Hosting Windows 2003 MSI Packages + Windows 2003 Domain Controller + Active Directory to specify the Group policies. For specific information, refer to Microsoft Technet at End User Client Requirements There are two ways to install PTA on a client machine for Internet Explorer cab file or MSI package. If you use the MSI package, then use Windows Installer 1.x. ActiveX-based PTA ActiveX-based PTA works only for browsers using Microsoft Windows operating systems. Table 3-4 ActiveX-based PTA Requirements Web Browser Internet Explorer 6.0 Platform Windows XP Java-based PTA Java PTA has been tested on the following platforms, with browsers using Java plug-in Table 3-5 Java-based PTA Requirements Web Browser Internet Explorer 6.0, 7.0 Platform Windows XP SP2 Mozilla Solaris 10 Firefox 1.5 Windows XP SP2 MacOS X VeriSign, Inc. February 20, 2007

23 rte Chap CHAPTER 4 4Luna Token Reader Compatibility VeriSign ships token readers with Managed PKI for use with the VeriSign Registration Authority Service module. Token Readers Tokens For SafeNet Luna 2, Luna RA, and Luna PCM tokens, Managed PKI supports only the SafeNet Luna Dock reader, which is an external reader that requires a hardware PCI slot. The reader requires the driver version listed here. Older models of token readers are not supported, and earlier versions of the driver are not supported. + For token readers on Windows, Solaris, or Linux platforms, use version 8.1 Managed PKI supports the following hardware for signing: Table 4-1 Supported tokens for signing Token type Platform Driver version Firmware version SafeNet Luna 2 All SafeNet Luna SA All SafeNet Luna PCI Windows SafeNet Luna PCM Windows Managed PKI supports the following hardware for key generation: Table 4-2 Supported tokens for key generation Token type Platform Driver version Firmware version SafeNet Luna RA All SafeNet Luna SA (Password Authentication mode) All SafeNet Luna PCI Windows SafeNet Luna PCM Windows Note IBM Netfinity is incompatible with Luna token readers. VeriSign, Inc. February 20,

24 Managed PKI v7.1 Hardware/Software Requirements 20 VeriSign, Inc. February 20, 2007

25 Index Index A ActiveX PTA 3 B browsers Certificate Validation Module 11 Digital Notarization 11 Managed PKI administrator workstation 6 Managed PKI end user 7 Managed PKI for SSL 7 Online Certificate Status Protocol 13 C Certificate Parsing Module 12 compatibility matrix 2 Outsourced Authentication with 14 Certificate Validation Module compatibility matrix 2 Outsourced Authentication with 14 platform requirements 11, 12 plug-in Web server availability 11 Client Managed PKI see Managed PKI compatibility matrix 1 compilers Linux 10 Solaris 10 Windows Consumer Authentication Service compatibility matrix 2 CPM see Certificate Parsing Module CVM see Certificate Validation Module D Device Manufacturing Service 13 compatibility matrix 2 Digital Notarization 11 DMS see Device Manufacturing Service documentation 2 E end users Exchange server requirements for 16 Go Secure! for Web Applications client requirements 18 Managed PKI requirements for 7 protocols and ports 5 Exchange server 15 F File Encryption feature compatibility matrix 2 G Go Secure! for Microsoft Exchange 15 compatibility matrix 2 Outsourced Administration with 14 Go Secure! for Web Applications 17 Managed PKI requirements for 17 Outsourced Authentication with 14 I IPSec Managed PKI administrator workstation 6 J Java PTA 18 L LDAP see Lightweight Directory Access Protocol Lightweight Directory Access Protocol protocols and ports 5 VeriSign Registration Authority Service with 10 Local Hosting 9 Go Secure! for Microsoft Exchange with 15 VeriSign, Inc. February 20,

26 Managed PKI v7.1 Hardware/Software Requirements Go Secure! for Web Applications with 17 Outsourced Authentication with 14 protocols and ports 5 VeriSign Registration Authority Service with 9 Luna token 19 Luna token reader 19 M Managed PKI compatibility matrix 1 Managed PKI administrator workstation 6 Managed PKI for SSL compatibility matrix 2 Managed PKI for SSL administrator workstation 6 Managed PKI for SSL Premium Edition administrator workstation 6 Managed PKI requirements administrator workstation 6 Go Secure! for Microsoft Exchange 15 Go Secure! for Web Applications 17 Outsourced Authentication 14 Manual Authentication 6, 14 Go Secure! for Microsoft Exchange with 15 Go Secure! for Web Applications 17 manuals see documentation MSI package 18 N Netegrity SiteMinder 18 O OA see Outsourced Authentication ODBC protocols and ports 5 Online Certificate Status Protocol 13 compatibility matrix 2 Outsourced Administration with 14 operating system Managed PKI administrator workstation 7 Managed PKI end user machine 7 Managed PKI for SSL 7 VeriSign Registration Authority Service 10 Outsourced Authentication 13 compatibility matrix 2 Managed PKI requirements for 14 P Passcode Authentication 6 Go Secure! for Microsoft Exchange 15 Go Secure! for Web Applications 17 Outsourced Administration with 14 Personal Trust Agent compatibility matrix 2 Outsourced Administration with 14 requirements for 17 protocols and ports 5 PTA see Personal Trust Agent R requirements Certificate Parsing Module 12 Device Manufacturing Service 13 Digital Notarization 11 Exchange server 15 Go Secure! for Microsoft Exchange 15 Go Secure! for Web Applications 17 local hosting 9 Luna tokens and reader 19 Managed PKI administrator workstation 6 Managed PKI end user machine 7 Managed PKI for SSL administrator workstation 7 Online Certificate Status Protocol 13 Outsourced Authentication 14 VeriSign Registration Authority Service 9 S Signature Verification API 18 T token reader see Luna token reader tokens see Luna token 22 VeriSign, Inc. February 20, 2007

27 Index V VeriSign Registration Authority Service 9 Go Secure! for Microsoft Exchange with 15 Outsourced Administration with 14 Outsourced Authentication with 14 W Web servers Certificate Validation Module 11, 12, 13 Local Hosting 8, 9 Managed PKI for SSL 8 WebLogic Application Server 17 WebSphere Application Server 17 Windows authentication Go Secure! for Microsoft Exchange 15 VeriSign, Inc. February 20,

28 Managed PKI v7.1 Hardware/Software Requirements 24 VeriSign, Inc. February 20, 2007