Registration Authority Desktop Guide

Transcription

1 IBM SecureWay Trust Authority Registration Authority Desktop Guide Version 3 Release 1.1 SH

2

3 IBM SecureWay Trust Authority Registration Authority Desktop Guide Version 3 Release 1.1 SH

4 Note! Before using this information and the product it supports, read the general information under Notices on page 45. Second Edition (January 2000) This edition applies to IBM SecureWay Trust Authority, program 5648-D09, ersion 3 release 1 modification 1, and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation 1999, All rights resered. US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Chapter 1. About Trust Authority Chapter 2. Oeriew Chapter 3. How do I...? Become a registrar Enable a browser Access the enrollment Web page Request a browser certificate Check on enrollment status Get authorization Install the RA Desktop Reconfigure the RA Desktop Access the RA Desktop Work with queries Submit a query Retriee pending requests Retriee expiring certificates Select a date from the calendar Set a retrieal limit Set the number of records per page Get feedback during processing Work with results View query results View results on multiple pages Display details of an item View item attributes View an action history Moe between tabs Resize a table column Sort table rows by a column Select records in a table Take action Act on multiple records Act on an indiidual record Change an attribute alue Change a alidity period Specify a request profile Add a comment Approe a request Keep a request in pending status Reject a request Change renewability Put a certificate on hold Reoke a certificate Remoe a certificate from the CRL Check permissions for the domain Exit the RA Desktop Uninstall the RA Desktop Chapter 4. Tell me about Enrollment Preregistration Web browser support Registration Business policy Registration authorities Registration databases Registration domains Registration records Record Attributes Certification Certificate authorities Certificate reocation lists Directories Distinguished names Certificates Browser certificates CA certificates Serer or deice certificates Certificate extensions Certificate life cycles Renewability Administration Access control Authentication and authorization Concurrent administration RA Desktop support serlet Request profiles Chapter 5. Reference Query tab Query fields Predefined queries Retrieal limit options Records per page options Results tab Administratie actions Reasons for reoking a certificate Details tab Action history eents Attributes of requests and certificates Certificate extensions Supplied certificate types Detail groups Status of enrollment requests Help for tabs JVM for Internet Explorer Keyboard alternaties to the mouse Troubleshooting Notices Trademarks and serice marks Related information Glossary Index Copyright IBM Corp. 1999, 2000 iii

6 i Trust Authority: RA Desktop Guide

7 Chapter 1. About Trust Authority IBM SecureWay Trust Authority proides applications with the means to authenticate users and ensure trusted communications: It allows organizations to issue, publish, and administer digital certificates in accordance with their registration and certification policies. Support for Public Key Infrastructure for X.509 ersion 3 (PKIX) and Common Data Security Architecture (CDSA) cryptographic standards allows for endor interoperability. Digital signing and secure protocols proide the means to authenticate all parties in a transaction. Browser- and client-based registration capabilities proide maximum flexibility. Encrypted communications and secure storage of registration information ensure confidentiality. A Trust Authority system can run on IBM AIX/6000 and Microsoft Windows NT serer platforms. It includes the following key features: A trusted Certificate Authority (CA) manages the complete life cycle of digital certification. To ouch for the authenticity of a certificate, the CA digitally signs each one it issues. It also signs certificate reocation lists (CRLs) to ouch for the fact that a certificate is no longer alid. To further protect its signing key, you can use cryptographic hardware, such as the IBM SecureWay 4758 PCI Cryptographic Coprocessor. A Registration Authority (RA) handles the administratie tasks behind user registration. The RA ensures that only certificates that support your business actiities are issued, and that they are issued only to authorized users. The administratie tasks can be handled through automated processes or human decision-making. A Web-based enrollment interface makes it easy to obtain certificates for browsers, serers, and other purposes, such as irtual priate network (VPN) deices, smart cards, and secure . A Windows application, the Trust Authority Client, enables end users to obtain and manage certificates without using a Web browser. A Web-based administration interface, the RA Desktop, enables authorized registrars to approe or reject enrollment requests and administer certificates after they hae been issued. An Audit subsystem computes a message authentication code (MAC) for each audit record. If audit data is altered or deleted after it has been written to the audit database, the MAC enables you to detect the intrusion. Policy exits enable application deelopers to customize the registration processes. Integrated support for a cryptographic engine. To authenticate communications, the core Trust Authority components are signed with a factory-generated priate key. Security objects, such as keys and MACs, are encrypted and stored in protected areas called KeyStores. Integrated support for IBM SecureWay Directory. The Directory stores information about alid and reoked certificates in an LDAP-compliant format. Copyright IBM Corp. 1999,

8 Integrated support for IBM WebSphere Application Serer and IBM HTTP Serer. The Web serer works with the RA serer to encrypt messages, authenticate requests, and transfer certificates to the intended recipient. Integrated support for the award-winning IBM DB2 Uniersal Database. 2 Trust Authority: RA Desktop Guide

9 Chapter 2. Oeriew When an organization has secure applications protected by Trust Authority, only users with the proper credentials can access those applications. Someone who wants a credential, such as a digital certificate, can request it by proiding appropriate information. Data in the enrollment request is the basis for the decision to approe the request or reject it. If an enrollment request is approed, the Trust Authority Registration Authority (RA) processes the request, and the Trust Authority Certificate Authority (CA) issues the certificate. Records of enrollment requests and certificates reside in an encrypted registration database. Ealuating enrollment requests and administering these records is an administratie task. Sometimes your organization configures Trust Authority to automate parts of these tasks, and a program ealuates the registration data. Other times an registrar like you makes all the judgments. The Trust Authority Registration Authority Desktop (RA Desktop) is a graphical user interface (GUI) for handling enrollment requests and managing the resulting records. It supports your tasks as an registrar, such as: Ealuating enrollment requests that are pending, to approe or reject them Preparing queries to retriee records of certificates of a particular type or that belong to specific users Reiewing the details of a record Setting the alidity period of a certificate Taking action to change the status of a certificate or enrollment request Annotating a record to explain the reason for an action The RA Desktop is a secure applet. To use it, you must hae authority to do specific tasks, and you must be authenticated by presenting the proper digital certificate. Related topics: Become a registrar on page 5 Access the RA Desktop on page 10 Copyright IBM Corp. 1999,

10 4 Trust Authority: RA Desktop Guide

11 Chapter 3. How do I...? Become a registrar The topics in this section proide step-by-step directions for your tasks as an registrar, such as: Preparing your browser and installing the RA Desktop Getting your browser certificate and authorization to be an registrar Querying the registration database to work with requests and certificates Before you can access the RA Desktop to administer certificates and requests for certificates, you must be enrolled as an authorized Trust Authority registrar. This process inoles seeral steps, some of which must be handled by a system administrator. This section describes preliminary tasks you need to complete before you can use the RA Desktop: Step 1. One user, typically a system administrator, must follow the procedures in the System Administration Guide to add the first registrar to the system. Step 2. Set up your Web browser so that it can run the RA Desktop. Step 3. Access the Trust Authority enrollment Web page to obtain the necessary certification. Step 4. Request a CA certificate, and then a browser certificate, for your Web browser. Your organization should proide guidance about the type of browser certificate you should select to install and the name of the registration domain that you are being authorized to administer. Step 5. Check on the enrollment status and confirm that the certificate was installed. Step 6. After the certificate has been issued, you must request authorization to work as a registrar. Communicate a request to the first authorized registrar, and proide this user with the request ID that was returned to you after you submitted your request for a certificate. Step 7. The first registrar must follow the procedures in the System Administration Guide to authorize you as a new registrar. Step 8. After receiing confirmation that you hae been enrolled as a registrar, install the RA Desktop. If you later need to change the default browser you set during installation, or if you need to change the RA Serer s URL, you can reconfigure the RA Desktop. Enable a browser Before enabling a browser, make sure that your machine meets the following requirements for running the RA Desktop: An Intel Pentium processor with at least 64 MB of RAM, or better. A computer display that supports VGA resolution, or better. The Microsoft Windows 95, 98, or NT operating system. Copyright IBM Corp. 1999,

12 To enable a Web browser for the RA Desktop: 1. Install one of the supported Web browsers: Netscape Naigator or Communicator, release 4.51 or later Microsoft Internet Explorer, release 4.01 (with Serice Pack 1) or later. With Internet Explorer, you must hae Jaa Virtual Machine (JVM), release 5.00, build 3167 or later. JVM for Internet Explorer on page 40 describes how to determine which release of JVM you are running, and how to upgrade if necessary. Note: You must install the official ersion of the product, distributed by Netscape or Microsoft. Versions from third-party endors may not display information correctly, especially when you run the applet in a language other than English. 2. Alter your Web browser: In Netscape, open the Preferences menu to enable Jaa. In Internet Explorer, open the Options menu to enable Jaa. Note: The latest information about RA Desktop applet requirements is aailable in the Readme file. To obtain the Readme file, access the Library page at the IBM SecureWay Trust Authority Web site: Access the enrollment Web page To access the Web page for enrollment: 1. Get your organization s URL for accessing the enrollment Web page. The URL will hae the following format: where MyWebSerer:port is the host name and port of the serer on which the Trust Authority Registration Authority is installed. MyDomain is the configured name of the registration domain on this Trust Authority system. For example: 2. Open the browser you enabled for the RA Desktop. 3. Enter the URL: In Netscape, type the URL in the text box at Location. In Internet Explorer, type the URL in the text box at Address. 4. Press the Enter key. The Trust Authority enrollment Web page is displayed. For a default installation, the name of this page is Credential Central. 5. If you are using the Trust Authority enrollment serices for the first time, click install our serer s CA certificate. This certificate enables your browser to authenticate communications from the enrollment serices. The next time you use these serices, you can omit this step. Request a browser certificate This section describes how to use the Trust Authority enrollment page to request a browser certificate so you can run the RA Desktop. 6 Trust Authority: RA Desktop Guide

13 Note: As a registrar, you might also need to enroll serers or deices, or preregister someone. For help with those tasks, refer to the Trust Authority User s Guide. Depending on how the registration facility was customized for your organization, the procedures for getting a alid certificate may ary. The following discussion outlines basic steps. Contact your system administrator for procedures appropriate for your site. To obtain your browser certificate: 1. Access the enrollment Web page from your browser. 2. In the Certificate Enrollment area: a. Select Enrollment Type Browser certificate. b. Select Action Enroll. c. Click OK. The enrollment form you requested is displayed. 3. Follow the instructions on the Web page to complete the fields. There are two sections: A Registration Information section with text boxes where you supply information about yourself. A Certificate Request Information section with text boxes where you supply information about the certificate you want. If you do not supply alues in the section s optional fields, Trust Authority supplies defaults that are associated with the type of certificate you are requesting. Pay particular attention to the following fields: Type of Certificate Select the kind of browser certificate that your organization wants you to present to access the RA Desktop. Supplied certificate types on page 37 describes the certificate types. Install CA certificate to Browser Click to get a corresponding CA certificate that is compatible for the certificate type. If you click this button, the CA certificate is downloaded immediately. This certificate enables your browser to authenticate communications from the registration facility when you use the RA Desktop. If for some reason you already hae the same CA certificate, you do not need another one. Address To select Notification, you must supply your address. Notification Select this to receie about the outcome of your request. Note: If the RA serer is installed on a Windows NT platform in your organization, the registration facility s configuration file (raconfig.cfg) may need to be updated to point to an SMTP host to enable this feature. For details, see the Trust Authority Customization Guide. Challenge Response Be sure to remember the case-sensitie Challenge Response you supply. You will need to know it later to check the status of the enrollment request. Chapter 3. How do I...? 7

14 Domain Name Optionally, type the host name of the machine where the certificate will be installed (your machine s host name). Typically, you can omit this field unless you hae been instructed to use it. If you need further help with the fields, consult the Reference section of the Trust Authority User s Guide. 4. Click Submit Enrollment Request. After Trust Authority receies the enrollment form, it alidates the information: If the form contains errors, it shows you the errors. Make the changes and click Resubmit Enrollment Request. If the form contains no errors, another Web page displays your request ID. 5. Make sure to keep your request ID. It identifies you later so that you can check on the status of the request and receie your certificate when it is ready. Do one of the following, as described on the Web page: Bookmark the Web page so that you can return to this display and check on your certificate. This is the easiest way to return to check your status. Record the request ID so that you can supply it when you return. As a safeguard, you may want to record the request ID regardless of whether you created a bookmark for the status page. If you specified that you wanted to receie an notification on the enrollment field, you can wait for the request ID to come by . Check on enrollment status To check the status of your enrollment request, either return to the Web page you bookmarked during enrollment, or complete the following steps: 1. Access the enrollment Web page. 2. At Enrollment Type, select the type of enrollment you requested. 3. At Action, select Check Status. 4. Click OK. The display contains fields where you must authenticate your identity before you can get any information about your request. 5. Supply information in the fields: At Request ID, type the request ID you were shown after you submitted the enrollment form. At Challenge Response, type the same Challenge Response you supplied on the enrollment form. 6. Click Check Enrollment Status. A message indicates the current status of your request. If your request is still pending, you can return later and check again. If your browser certificate has been issued, it was downloaded when you clicked Check Enrollment Status. 7. View your certificate if desired, following the instructions on the Web page. Get authorization Before asking your system administrator to authorize you for the RA Desktop, complete the following tasks: Request a browser certificate and specify the registration domain you will administer. 8 Trust Authority: RA Desktop Guide

15 Download to your Web browser the browser certificate and its compatible CA certificate. Install the RA Desktop Installing the RA Desktop is a two-part process. When installing the serer software, a system administrator must select Registration Authority Desktop to install the installation image for the applet. The administrator must then distribute the image or make it aailable on your network so that you can run the installation program from your workstation. Note: If you install the RA Desktop applet on the same machine from which the Setup Wizard was preiously run, the Setup Wizard cannot be run again. If you are using Trust Authority in a test enironment, you may want to install the Setup Wizard and RA Desktop on separate machines so that you will be able to repeat the configuration process until you are ready to put the system into production mode. Use the following procedure to run the RA Desktop installation program, RADInst.exe. 1. Make sure your workstation meets the requirements listed in Enable a browser on page From your system administrator, get the URL for the registration domain that you will be administering. 3. Follow your organization s instructions to copy, access, or download the RA Desktop installation image. 4. Shut down all actie programs. 5. Select Start Run, click Browse to locate the RADInst.exe file, and click OK to run the program. 6. Reiew the information on the Welcome window, and click Next. 7. On the Choose Destination Location window, click Next if you want to install the software in the default location (c:\program Files\IBM\Trust Authority\RA Desktop). Otherwise, click Browse to select or type a different destination folder, and then click Next. 8. On the Choose Browser window, select the browser that you want to use as your default browser for accessing the RA Desktop. Note: You see this window only if you hae both Microsoft and Netscape browsers installed and they are both at the required release leel. 9. On the Choose Host window, type the URL for serer where the Registration Authority is installed. You must type it in the following format, where hostname:port is the irtual host name and secure port number on the serer where the Registration Authority was installed, and RegistrationDomainName is the name that was configured for your organization s registration domain: For example: On the Select Program Folder window, click Next if you want to use the default program folder (IBM SecureWay Trust Authority). Otherwise, type or select the name of the folder you want to use, and then click Next. 11. On the Start Copying Files window, reiew the settings you specified for this installation of the RA Desktop. If you are satisfied with your choices, click Next. The program copies files to the requested location. Chapter 3. How do I...? 9

16 12. On the Setup Complete window: Click the check box to iew the README if you want to reiew the Trust Authority product Readme file. After you click Finish, the Readme file will be displayed in your selected browser. Click Finish to complete the installation process. After the installation is complete, RA Desktop and RA Desktop Configuration are in your Start menu under Programs IBM SecureWay Trust Authority. Reconfigure the RA Desktop After you install the RA Desktop, you can change the default browser that you want to use when accessing the applet and change the URL for the RA serer that hosts the applet. Use the following procedure to make these changes. Access the RA Desktop 1. Select Start Programs IBM SecureWay Trust Authority RA Desktop Configuration. 2. On the Choose Browser window, select the browser that you want to use when accessing the RA Desktop. 3. On the Choose Host window, type the URL for the RA serer that hosts the RA Desktop. You must specify the secure host name, the port number, and the name of the registration domain you need to administer (the domain name cannot contain spaces). For example: 4. On the Select Program Folder window, click Next without making any changes. 5. On the Start Copying Files window, reiew your changes and then click Next. 6. On the Setup complete window, click Finish to complete the reconfiguration process. Each time you want to start the RA Desktop, you must first do the following: 1. If your registrar certificate is in your Netscape browser, close any Netscape sessions you are running. 2. On your Windows taskbar, select Start Programs IBM SecureWay Trust Authority RA Desktop. When you request the URL of the RA Desktop, your Web browser and the serer agree to initiate a secure (client-authenticated) session. Before the serer can return the content of that URL, you must be authenticated as a alid registrar. The browser should prompt you to present a certificate. The prompt aries with the browser you use. 3. Present your registrar certificate. Note: If you use Internet Explorer, the browser automatically submits the last certificate you presented to the serer during your browser session. It does not prompt you for acknowledgment. To present a different certificate, you must exit and restart the browser. The Web browser downloads and initializes the RA Desktop applet: During downloading of the applet, you might see seeral messages at the bottom of the browser s display. For example, you might see a message to indicate that the browser is initializing Jaa. 10 Trust Authority: RA Desktop Guide

17 Work with queries During initialization, you see a progress bar that indicates how near the process is to completion. If an error occurs during initialization, the progress bar stops, and you see a generic warning message. After initialization is complete, you see the RA Desktop. It is ready to use. You can start administering registration requests and certificates for the registration domain that is associated with your certificate. Note: If you access the RA Desktop from Netscape and some time passes without actiity on the RA Desktop, Netscape prompts you for your certificate again. This additional security protects your organization in case an emergency calls you away from your desk before you hae exited the RA Desktop. Select the Query tab to prepare a query. You can make your query ery specific, or you can retriee a group of records with common characteristics. You can also limit the number of records to retriee and specify how many to display on a page when you iew them. Submit a query On the Query tab, prepare a query to retriee enrollment requests and certificate records you want to work with. You can base your query on either the current status of a request or certificate or on its renewal and expiration characteristics. Within these two categories, you can further refine your query by using the other aailable fields. 1. Use the fields on the tab to prepare your query. You can refine your query by combining as many of the aailable fields as desired. Query fields on page 31 describes the fields. As you moe your cursor oer a field, the bottom of the tab displays help for that field. You can run the query without specifying any alues of your own. This will retriee records of all the requests that are pending, regardless of their other characteristics. 2. Change the limit on the number of records to retriee, if desired. 3. Change the number of records to display on a page when you iew the results on the Results tab, if desired. 4. When you hae prepared your query, click Submit Query. While you are waiting for your query results, a progress bar shows the progress of query processing. When the results of your query are ready, the Results tab is automatically displayed. 5. On the Results tab, find the records you want to work with. Related topics: Retriee pending requests Retriee expiring certificates on page 12 Predefined queries on page 33 Retriee pending requests On the Query tab, do either of the following: Run a query without specifying any alues of your own. This is the same as specifying a Pending status. Chapter 3. How do I...? 11

18 Without changing the selection at Query type, specify additional characteristics for the records to retriee, if desired. For example, suppose that your manager asks that you handle someone s registration request before you handle other pending requests. You could specify the person s name in your query. Retriee expiring certificates On the Query tab, prepare a query to retriee records of renewable certificates that are due to expire within a specific period: 1. At Query type, select By renewability and expiration. 2. Open the list at Renewability and click Renewable. 3. Refine your query to retriee only the records of certificates that will expire during a specific period. At Range of expiration dates: Type or select the earliest expiration date at From. Type or select the latest expiration date at To. Related topics: Change a alidity period on page 17 Select a date from the calendar To select a date from the calendar instead of typing it in a date field: 1. Click the small calendar icon next to the field s text box. The calendar opens, displaying the current month or the month of the date in the field. 2. To select a different year, click the year on the calendar. This displays a list from which you can select a year. 3. To select a month, click one of the arrowheads next to the name of the current month. The left arrowhead displays earlier months, and the right arrowhead displays later months. 4. To select a day, click the day of the month you want. The calendar closes, displaying the selected date in the field. Set a retrieal limit On the Query tab, you can limit the number of records that are retrieed, een if more than that number match your query. The limit you set is only for the query you are preparing. 1. At Retrieal limit, open the list and select a limit. The default is 150. This limit affects the size of your query results. 2. Specify the rest of your query. Set the number of records per page On the Query tab, you can limit the number of records that are displayed on a page of the Results tab. The limit you set is only for the query you are preparing. 1. At Records per page, do one of the following: Open the list and select a limit. Type a number oer the displayed default. This alue controls the display of your query. 2. Specify the rest of your query. 12 Trust Authority: RA Desktop Guide

19 Get feedback during processing After you click a command button on any tab, the status area at the bottom of the panel shows the progress of the processing you requested. Work with results Select the Results tab to display the results of your query. The tab can display more than one of the records you retrieed. The number of records per page depends on the alue you selected when you submitted the query. View query results On the Results tab, you can iew the results after you run a query. Each row in the table at Query results contains a record that matches your query. The table contains the following columns: Name The name associated with a request or certificate, displayed in the following format: lastname, firstname Request status The current status of the enrollment request, such as Approed. Status of enrollment requests on page 39 describes each status alue. Fulfillment status The current status of processing for the request, such as Deliered. Last update The date associated with the status of the request or certificate. Date receied The date the enrollment request was receied. To iew your query results: 1. Find the records you need. You can do any of the following if it helps you to find the needed records: Scroll the table, resize columns, or sort the rows of the table. Moe from page to page to iew more of the results. 2. When you find the records you want to work with, you can do the following, if desired: Select one or more records and act on them as a group. Select a single record to iew more detail. Note: If you did not retriee the record you need, return to the Query tab: If your query is incorrect, make changes and then run it again. If your query is correct, set the retrieal limit to retriee a larger number of records, and run your query again. Related topics: Set the number of records per page on page 12 Chapter 3. How do I...? 13

20 View results on multiple pages On the Results tab, the results of your query might occupy multiple pages. The number of pages depends on the number of records that match your query and the page size you specified for displaying them. The status area tells you how many pages there are and which page you are iewing. Click Next Page to moe to the next page of the group. Click Preious Page to moe to the preious page of the group. To go back more than a few pages, it may be faster to return to the Query tab and resubmit the query. Then the Results tab displays the first page of your query results again. Display details of an item On the Results tab: 1. In the query results table, select the row for a record in your query results. 2. Click Show Details. The Details tab is displayed automatically, to show the details of the record you chose. 3. On the Details tab at Display, select the type of detail you want to see. Note: You can also display details of a record by double-clicking it on the Results tab, or by selecting it and then selecting the Details tab. Related topics: Act on an indiidual record on page 17 View item attributes On the Results tab: 1. Select a record from the table of query results. 2. Click Show Details to display the record in more detail on the Details tab. 3. On the Details tab, at Display, select the type of attributes you want to see. Detail groups on page 38 describes how the attributes are grouped. The default is Basic Attributes. 4. Look at the table. Each row in the table lists an attribute of the request or certificate. Attributes of requests and certificates on page 36 describes the request attributes. The table contains the following columns: Attribute name The name of the attribute. Attribute alue The alue of the attribute. The alue may change during the life cycle of a request or certificate. 5. Scroll the table, resize columns, or sort the rows of the table if it helps you with your task. Related topics: Change an attribute alue on page Trust Authority: RA Desktop Guide

21 View an action history On the Results tab: 1. Select a record from the table of query results. 2. Click Show Details to display the record in more detail on the Details tab. 3. On the Details tab, at Display, select Action History. 4. Look at the table. It includes details of eery eent in the life cycle of the item. Each row in the action history describes an action that was taken on the item. Information includes the date when it happened, the responsible party, and any associated comments. The table has the following columns: Date The date of the action that is shown in the same row. By The distinguished name of the registrar who took the action, or the RA program that did so. Request Status Status of the enrollment request, such as Approed. Status of enrollment requests on page 39 describes each status alue. Fulfillment Status Status of processing for the request, such as Deliered. Comment The comment that is proided by the registrar at the time of the action. 5. Scroll the table, resize columns, or sort the rows of the table if it helps you with your task. Related topics: Action history eents on page 36 Moe between tabs Sometimes you moe from one tab to another automatically. For example: When you run a query from the Query tab, you moe to the Results tab when the query results arrie on the RA Desktop. When you request details for a record, you moe to the Details tab. When you complete an action from the Details tab, you moe back to your query results on the Results tab. To moe between tabs at other times, simply click the tab you want to display. When you do, you can expect the following: If you return to the Query tab after iewing your query results, your query is still displayed. If you request details for the wrong item, you can return to your query results on the Results tab. There, you can select a different record to display in detail. Your query results remain on the Results tab until you run another query. Wheneer you moe to the Details tab after selecting one record on the Results tab, the Details tab shows that record. The tab contains no information if you hae not selected a record on the Results tab, or if you select more than one record. After you submit an action on the Details tab, the information is cleared from that tab. Note: When you begin a session, the RA Desktop fields display only default alues. Chapter 3. How do I...? 15

22 Take action Resize a table column To resize a table column: 1. Place the cursor on the boundary of a column you want to resize. 2. Click the mouse and drag it left or right to change the column width. 3. Release the mouse button at the desired width. Sort table rows by a column To sort the rows on the basis of a column: Click the column heading. To sort in the opposite order, click again. Select records in a table You can select one or more records: To select a single record, click its row. To select seeral adjacent records, click the first record, then hold down the Shift key while you click the last record. To select seeral records that are not adjacent, hold down the Ctrl key while you click each one. To deselect a record, click it again. You can act on an enrollment request or update the record of a certificate. Both the Results tab and the Details tab contain fields where you can choose the action. Actions you can take depend on your own permissions in the registration domain where you are a registrar. Act on multiple records On the Results tab, each row in the table is a record in your query results. You can take action on one or more of the records in the table, or you can look at one record in greater detail before you act. To act while iewing multiple records: 1. Select one or more records. 2. At Set the alidity period, specify a alidity period for the certificate to be in effect, if desired. 3. At Select the request profile, specify a different request profile, if desired, for a request you are approing. Supplied certificate types on page 37 describes the features of the certificate that is associated with each request profile. 4. Open the list at Take action on the selected items and select an action. Your permissions for working with records are the only actions aailable to you. 5. If you select Reoke as your action, you must select a reason for doing so. At Reason for choosing Reoke, open the list and select a reason. Reasons for reoking a certificate on page 35 describes the meaning of each reason. 6. At Comment on your action, type a comment to document your action, if desired. 7. Click Submit Action to submit the action for the selected records. To see more details of a record before acting: 1. Select the row that contains the record. 16 Trust Authority: RA Desktop Guide

23 2. Click the Show Details button. Related topics: Resize a table column on page 16 Sort table rows by a column on page 16 Act on an indiidual record On the Details tab, you can make other changes to the displayed record before you specify an action: 1. At Display, select the type of detail you want to see. If you display the processing attributes of an item, you can change some of the alues in the table. 2. Change some attribute alues as necessary. Attributes of requests and certificates on page 36 describes some of the attributes. 3. At Set the alidity period, specify a alidity period for the certificate to be in effect, if desired. 4. At Select the request profile, specify a different request profile for a request you are approing, if desired. Supplied certificate types on page 37 describes the features of the certificate that is associated with each request profile. 5. Open the list at Take action on the displayed item and select an action. Your permissions for working with records are the only actions aailable to you. Note: If your action is Reoke, you must also select the reason for the reocation. Reasons for reoking a certificate on page 35 describes the alid reasons. 6. At Comment on your action, type a comment to document your action, if desired. 7. Click Submit Action to submit the action. Related topics: Resize a table column on page 16 Sort table rows by a column on page 16 Change an attribute alue On the Details tab, when you approe an enrollment request or act on a fulfilled request, you can change the alues of some attributes: 1. At Display, select Business process ariables. 2. Scroll to the attribute you want to update. The alues you can update hae either a text box for typing a new alue or a list box for selecting a different alue. Attributes of requests and certificates on page 36 describes some of the attributes. 3. Type or select the alue you want. Note: Values in the request profile may oerride alues you set. Change a alidity period On the Results or Details tab, you can change the alidity period for the certificate when you approe an enrollment request or act on a fulfilled request. At Set the Chapter 3. How do I...? 17

24 alidity period, specify a range of dates. To supply a date, click the calendar to open it and then click the date you want. If you type the date, use the same format the calendar uses to fill the text box. At Begin date, specify the date the certificate will become alid. At End date, specify the date the certificate will expire. The alidity period you specify is passed to the RA when you submit the action. Usage Guidelines: You can modify a certificate alidity period to a period within the limits of the defined request profile. For example, if a user requests a certificate with a 1 year alidity period, you can shorten the period to less than one year. If you need to extend the alidity period beyond the limits of the profile, howeer, you must take one of the following actions: Reject the certificate, and ask the user to submit a request that specifies a longer alidity period, such as a 2 year certificate. Modify the request profile and submit the change. You must select the Keep Pending action until all changes hae been made. For example, if you want to change a certificate from a 1 year certificate type to a 2 year certificate type, but limit the certificate alidity period to 18 months, take the following steps: 1. Select the certificate request, and change the certificate type to a 2 year certificate. 2. Select Keep Pending, and then click Submit Action. 3. Select the certificate request again, and change the start and end dates as necessary to limit the alidity period to 18 months. 4. Select Approe, and then click Submit Action. Specify a request profile On the Results or Details tab, you can specify a different request profile to use in creating the certificate when you approe an enrollment request. At Select the request profile, select one of the following: Select a request profile from the list. Profiles on the list are the ones you are permitted to specify. Supplied certificate types on page 37 describes the certificate that is associated with each request profile. Select Use the current profile. This is the default. It enables you to proceed een if the current profile is not one that you are permitted to specify. The profile you specify is used to process the request and create the certificate after you submit the action. Add a comment On the Results or Details tab, you can add comments to explain the action you are taking: 1. At Take action, select an action. 2. At Comment on your action, type your comment in the text box. You can use up to 512 characters. 3. Click Submit Action to include the comment as you update the record. Your comment is added to the record when you submit your action. 18 Trust Authority: RA Desktop Guide

25 Approe a request You can approe a request on either the Results tab or the Details tab. If you use the Results tab, you can select more than one record to approe. If you use the Details tab, you can alter the alues of some attributes before approing the displayed request. From either tab: 1. At Take action, click Approe. 2. Click Submit Action. Keep a request in pending status You can keep a request pending on either the Results tab or the Details tab. If you use the Results tab, you can select more than one record to keep pending. From either tab: 1. At Take action, click Keep Pending. 2. Click Submit Action. Reject a request You can reject a request on either the Results tab or the Details tab. If you use the Results tab, you can select more than one record for rejection. From either tab: 1. At Take action, click Reject. 2. Click Submit Action. Change renewability You can change the renewability of a certificate on either the Results tab or the Details tab. You can make a renewable certificate non-renewable, or ice ersa. If you use the Results tab, you can select more than one record and then change the renewability status for the group. From either tab: 1. At Take action, click one of the following: Make request renewable Make request non-renewable 2. Click Submit Action. Put a certificate on hold You can put a certificate on hold temporarily, on either the Results tab or the Details tab. If you use the Results tab, you can select more than one certificate to put on hold. From either tab: 1. At Take action, click Reoke. 2. At Reason, select Put on Hold. Note: You can reerse the action later, unless the certificate expires during the time it is on the CRL. 3. Click Submit Action. Chapter 3. How do I...? 19

26 After you take this action, the Processing attributes for the record are updated. The Reocation Reason attribute is set to the alue Put on Hold. Related topics: Remoe a certificate from the CRL Reoke a certificate You can reoke a certificate on either the Results tab or the Details tab. If you use the Results tab, you can select more than one certificate for reocation. Before you reoke a certificate, you must use the Details tab to reiew the certificate s alidity period. You must erify that the certificate is currently alid before you submit the reocation request. To reoke a certificate from either tab: 1. At Take action, click Reoke. 2. At Reason, select a reason. Note: If you select the reason Put on hold, you can reerse the action later, unless the certificate has expired. 3. Click Submit Action. After you take this action, the Processing attributes for the record are updated. The Reocation Reason attribute is set to the alue you specified. Related topics: Put a certificate on hold on page 19 Remoe a certificate from the CRL Remoe a certificate from the CRL You might want to remoe a certificate from the CRL for either of the following reasons: To rid the CRL of certificates that are no longer alid. To reactiate a certificate you preiously reoked with the reason Put on Hold. Note: If the certificate has expired in the interim, you cannot reactiate it. You can remoe a certificate from the CRL on either the Results tab or the Details tab. If you use the Results tab, you can select more than one certificate to remoe from the CRL. From either tab: 1. At Take action, click Reoke. 2. At Reason, select Remoe from CRL. 3. Click Submit Action. After you take this action, the Processing attributes for the record are updated. The Reocation Reason attribute is set to the alue Remoe from CRL. Related topics: Put a certificate on hold on page Trust Authority: RA Desktop Guide

27 Check permissions for the domain On either the Results tab or the Details tab: Exit the RA Desktop 1. Click Take action. 2. View the list of actions. These are your capabilities for working with records of certificates and enrollment requests for the registration domain. If you hae authority only to iew the records, the only alue on the list is No action is aailable. Uninstall the RA Desktop To exit the RA Desktop from any of its tabs, do either of the following: Click Exit. You are returned to the Web page where you accessed the RA Desktop, unless your organization has set another path for you. Close the desktop as you would close other browser windows, by clicking one of the small icons on the title bar. This closes your browser. Use the following procedure if you need to remoe the RA Desktop applet from your workstation. 1. Select Start Settings Control Panel. 2. Double-click Add/Remoe Programs. 3. Select the IBM SecureWay Trust Authority RA Desktop program folder, and click Add/Remoe. 4. When prompted to confirm that you want to delete the program, click Yes. 5. If you see a message about certain folders not being deleted, click Details. You must manually delete any folders listed in the Details window to completely remoe the RA Desktop from your system. Chapter 3. How do I...? 21

28 22 Trust Authority: RA Desktop Guide

29 Chapter 4. Tell me about... Enrollment The topics in this section define or describe concepts that are related to registration, certification, and administration in an RA Desktop setting. Enrollment is applying for a certificate. Trust Authority offers more than one method of enrollment, and your organization s policies dictate which methods are aailable. Users might do either of the following: Complete and submit a Trust Authority enrollment form through their Web browsers. In default Trust Authority installations, the enrollment forms are at a Web page called Credential Central. Your site might call this page by another name. Preregister more informally and then supply preregistration alues to Trust Authority through a Trust Authority Client application installed on their workstation. As a Registration Authority (RA) registrar, you must enroll for a certificate to access the RA Desktop. Later, you might use the enrollment Web page to preregister other users. Data from enrollment forms goes into database records that you can iew from the RA Desktop. Preregistration Trust Authority enables a program or an administrator to preregister prospectie users. If you preregister other people for certificates, here is the scenario for doing so: You need to get information about the person you want to preregister. You might get it from the person or use organization records, such as information from a database. You access the enrollment page from your Web browser. There is an enrollment form especially for preregistering someone. You complete the form, supplying information that describes the person and the type of certificate they want. Then you submit the form. You check on the status of the request. When the preregistration request is approed, you receie a transaction ID, password, and the URL of the RA that approed the request. You gie this information by telephone, , or in person to the person you preregistered. Optionally, for their conenience, you can gie them a preregistration file that contains other request information. The person uses what you send when they are ready to request their certificate. For guidance during preregistration tasks, refer to the Trust Authority User s Guide. Web browser support Trust Authority enables you to create an enrollment request by completing and submitting an enrollment form through either of the following Web browsers: Copyright IBM Corp. 1999,