Sun Java logo     Previous      Main      Next     

Sun logo
Sun Java System Web Proxy Server User Interface 

The Security Tab


The Administration Server Security tab is used to create new trust databases, add or renew server certificates, install certificates, change the password for the trust database, view and manage installed certificates, add or replace CRLs and CKLs (Certificate Revocation Lists and Compromised Key Lists), and manage CRLs and CKLs.

(If you’re accessing this tab from the Server Manager, see the Server Manager section for information about the other Server Manager tabs.)

The tab contains the following pages:


The Create Database Page

The Create Database page is used to create a new trust database with the default CA settings and protect it with a password.

The server can have only one trust database, so you can create a trust database only if one does not already exist. The trust database is created with the default CA entries, which are configured so that they are not trusted CAs for client certificates.

To configure the server to trust these CAs for use with client certificates, see The Manage Certificates Page. For more information about creating a trust database, see "Creating a Trust Database" in the Proxy Server Administration Guide.

The following elements are displayed:

Database Password. Specify the certificate database password.


Note

The database password is sent in plain text from the client to the Administration Server. To minimize security risks, run the browser used for server administration on the same machine as the Administration Server, or run your Administration Server with SSL.


Password (again). Confirm the password. If what you enter is different from what you entered in the Database Password field, you will be prompted to try again.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.


The Request Certificate Page

The Request Certificate page is used to add or renew a server certificate. For more information, see "Requesting and Installing Other Server Certificates" in the Proxy Server Administration Guide.

The following elements are displayed:

Certificate Type. Select the certificate type. The following options are available:

Submit To Certificate Authority Via. Specify the manner in which to submit the certificate request. The following options are available:

Cryptographic Module. From the drop-down list, select the module to be used with the certificate. Choose Internal unless an external encryption module has been installed.

Key Pair File Password. Specify the trust database password.

Requestor Name. Specify the name under which the certificate will be issued.

Telephone Number. Specify the telephone number of the requestor.

Common Name. Specify the fully qualified host name used in DNS lookups (for example, www.example.com). This is the host name in the URL that a browser uses to connect to your site. It is important that these two names are the same. Otherwise, a client is notified that the certificate name does not match the site name, which often makes users doubt the authenticity of your certificate.

Email Address. Specify the business email address used for correspondence between you and the CA.

Organization. Specify the official, legal name of your company, educational institution, organization, and so on. Most CAs require you to verify this information with legal documents (such as a copy of a business license).

Organizational Unit. Enter a description of an organizational unit within your company.

Locality. Enter a description of the city, principality, or country for the organization.

State Or Province. Specify the state or province in which the business is located.

Country. Specify the two-character abbreviation of your country name (in ISO format). The country code for the United States is US.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.


The Install Certificate Page

The Install Certificate page is used to install a certificate for a server. You can install your own certificate to present to clients, or install a CA’s certificate for use in a certificate chain.

When you receive a certificate from the CA, it will be encrypted with your public key so that only you can decrypt it. The server will use the key-pair file password you specify to decrypt the certificate when you install it. For more information, see "Requesting and Installing Other Server Certificates" in the Proxy Server Administration Guide.


Note

Install certificates for use in a certificate chain using the same process as installing your own certificate. Many CAs include their certificate in the same email that contains your certificate. If your CA does not automatically send you its certificate, you should request it. Your server installs both certificates at the same time.


The following elements are displayed:

Certificate For. Specify where the certificate will be used. The following options are available:

Cryptographic Module. From the drop-down list, select the module to be used with the certificate. Choose Internal unless an external encryption module has been installed.

Key Pair File Password. Specify the password for the certificate database.

Certificate Name. Specifies the common name of the certificate. Enter the certificate name only if it differs from the fully qualified host name of your server used in DNS lookups (for example, www.example.com).

Message Is In This File. Specifies the file that contains the CA certificate.

Message Text (with headers). Contains the content of the CA certificate. If you copy and paste the text, be sure to include the headers Begin Certificate and End Certificate.

OK. Takes you to the The Add or Replace Certificate Page.

Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.


The Add or Replace Certificate Page

The Add or Replace Certificate page displays the new certificate information you just installed.

Add Server Certificate or Replace Server Certificate. Adds or replaces your previous certificate with the one displayed.


The Change Key Pair File Password Page

The Change Key Pair File Password page is used to change the password used to access your trust database. For more information, see "Changing Passwords or PINs" in the Proxy Server Administration Guide.

The following elements are displayed:

Cryptographic Module. From the drop-down list, select the module to be used with the certificate. Choose Internal unless an external encryption module has been installed.

Old Password. Specify the current key pair password.

New Password. Specify the new key pair password.

Password (again). Confirm the password. If what you enter is different from what you entered in the New Password field, you will be prompted to try again.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.


The Manage Certificates Page

The Manage Certificates page displays all installed certificates associated with the server, and is used to manage the certificates. For more information, see "Managing Certificates" in the Proxy Server Administration Guide.

If an external module is installed, you will be warned to do this only on your local machine. For the external module to be made accessible for management, you must enter the password for the external module and click OK.

The following elements are displayed:

Certificate Name. Specifies the name of the certificate authority.

Type. Specifies whether it is a trusted certificate authority.

Expiration Time (in UTC). Displays the date and time the certificate expires. Once a certificate has expired, you must renew it to use it again.

When you click a certificate, information about the certificate is displayed. Internally issued certificates have the following options:

Certificates issued by a Certificate Authority have the following options:


The Request VeriSign Certificate Page

The Request VeriSign Certificate page describes the process of requesting a VeriSign certificate, and lists the basic steps. For more information, see "Requesting and Installing a VeriSign Certificate" in the Proxy Server Administration Guide.

In addition to the basic steps, the following elements are also displayed:

OK. Activates the VeriSign Enrollment Wizard, which walks you through the process.


The Install VeriSign Certificate Page

The Install VeriSign Certificate page is used to retrieve the server certificate requested from VeriSign for installation on your server. For more information, see "Requesting and Installing a VeriSign Certificate" in the Proxy Server Administration Guide.

If an external module is installed, you will be warned to do this only on your local machine. You must enter the password for the external module and click OK for the external module to be made accessible for management.

The following elements are displayed:

Cryptographic Module. From the drop-down list, select the module to be used with the certificate. Choose Internal unless an external encryption module has been installed.

Key Pair File Password. Specify the trust database password.

Select The Transaction ID To Retrieve. From the drop-down list, select the requested certificate.

OK. Installs the selected certificate.

Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.


The Install Certificate Revocation List/Compromised Key List Page

The Install Certificate Revocation List/Compromised Key List page is used to add or replace CRLs (Certificate Revocation Lists) or CKLs (Compromised Key Lists). For more information, see "Installing and Managing CRLs and CKLs" in the Proxy Server Administration Guide.

The following elements are displayed:

File Contains. The following options are available:

The CRL/CKL Is In This File: Specify the CRL/CKL location.

OK. Based on your selections, takes you to:

Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.


The Add Certificate Revocation List Page

The following information is displayed:

Add CRL. Installs the specified CRL.


The Replace Certificate Revocation List Page

The following information is displayed:

Replace CRL. Replaces the specified CRL.


The Add Compromised Key List Page

The following information is displayed:

Add CKL. Installs the specified CKL.


The Replace Compromised Key List Page

The following information is displayed:

Replace CKL. Replaces the specified CKL.


The Manage Certificate Revocation List/Compromised Key List Page

The Manage Certificate Revocation List/Compromised Key List page displays the CRLs (Certificate Revocation Lists) and CKLs (Compromised Key Lists) you have installed, by certificate name. The date of expiration is also shown. This page is used to view and delete CRLs and CKLs. For more information, see "Installing and Managing CRLs and CKLs" in the Proxy Server Administration Guide.

The following elements are displayed:

Server CRLs. Lists the CRLs. Click a specific CRL for more information and options.

Server CKLs. Lists the CKLs. Click a specific CKL for more information and options.

Clicking a CRL or CKL displays The Edit CKL/CRL Page.


The Edit CKL/CRL Page

Based on your selection on The Manage Certificate Revocation List/Compromised Key List Page, the Edit CKL/CRL page displays information for a CKL or CRL.

The following information is displayed:

Delete CKL / CRL. Deletes the CKL or CRL displayed.

Quit. Returns you to the previous page.


The Migrate 3.x Certificates Page

The Migrate 3.x Certificates page is used to migrate Proxy Server 3.6 certificates to the currently supported Network Security Services (NSS) format. The certificate is named according to the Proxy Server page from which it was accessed (that is, from the Administration Server Security tab or the Server Manager Security tab).

The following elements are displayed:

3.6 Server Root. Specify the root directory where the 3.6 server is installed.

Alias. Specify the alias for this machine.

Password. Specify the administrator’s password.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.



Previous      Main      Next     


  Copyright 2006 Sun Microsystems, Inc. All rights reserved.