
Netscape Personal Security Manager
Release 1.3
9/18/2000
These release notes contain the most recent information about this release
of Netscape Personal Security Manager. Please read these notes before using
the software.
These notes include information for IS professionals who are thoroughly
familiar with security and public-key infrastructure (PKI) issues.
Use of this product is subject to the terms detailed in the license
agreement accompanying Netscape 6 PR3.
Contents
Documentation
Changes Since Personal Security Manager
1.2
Software/Hardware Requirements
Installing Personal Security Manager
Using Personal Security Manager
Known Bugs/Issues for Personal
Security Manager 1.3
Feedback
Documentation
The following documentation is available with Personal Security Manager:
-
Personal Security Manager Help -- This online
help system can also be accessed by clicking the Help button in any personal
Security Manager window.
-
JavaScript API for Client Certificate Management
-- This reference describes a new Javascript API for performing user certificate
management operations with Personal Security Manager, including one-click
issuance, forced certificate backup by end users, and automatic archival
of encryption private keys.
For the latest release notes, deployment guide, and other information,
see http://docs.iPlanet.com/docs/manuals/psm.html.
Changes Since Personal Security Manager
1.2
The Transport Layer Security
(TLS) protocol is turned on by default in Personal Security Manager
1.3. TLS is an IETF standard based on the Secure Sockets Layer (SSL) protocol.
Most other changes since Personal Security Manager 1.2 involve minor
bug fixes and optimizations.
Netscape 6 and Mozilla do not supported signed or encrypted email. For
this reason, features related to email certificates are not available in
this release.
Software/Hardware
Requirements
Operating systems supported: Windows NT, Windows 95, Windows 98
Windows 2000; Solaris 2.6, 2.7, 2.8; and Red Hat Linux 6.1.
Other software requirements: This release has been tested with
Mozilla and Netscape 6. It is not intended for use with Communicator.
Installing Personal Security Manager
Personal Security Manager 1.3 is installed with Netscape 6 PR3. To install
Personal Security Manager 1.3 with Mozilla, see http://docs.iplanet.com/docs/manuals/psm/psm-mozilla/index.html.
The sections that follow describe how the Personal Security Manager
files are installed with Netscape 6 PR3.
Installing on Windows 95/98/2000/NT
When you install Netscape 6 PR3 on Windows, Personal Security Manager is
installed in the directory C:\Program Files\Common Files\Netscape Shared\Security\.
All Windows users: Personal Security Manager 1.3 works with Mozilla
and Netscape 6, but it is not currently supported for Communicator 4.x.
Therefore, you should not attempt to run Personal Security Manager 1.3
with Communicator 4.x.
If you have Personal Security Manager 1.2 installed for use with Communicator
4.x and you want to install Netscape 6 PR3, you should first exit Communicator,
then rename the directory C:\Program Files\Common Files\Netscape Shared\Security\
to something else, such as SecurityC47. When you install Netscape
6, a new Security directory will be created during the installation
process.
If you want to run Communicator 4.x with Personal Security Manager 1.2
after Netscape 6 PR3 has been installed, you should first exit Netscape
6, then rename the Security directory (which now contains the
Personal Security Manager 1.3 files) to something else (such as SecurityN6)
and rename your SecurityC47 directory (which contains the Personal
Security Manager 1.2 files) to Security. You can then launch Communicator
as usual.
Installing on Unix
When you install Netscape 6 PR3 on Unix, Personal Security Manager is installed
in a directory called psm in the same directory where the netscape
executable resides.
Disabling Personal Security Manager
To disable Personal Security Manager temporarily, exit Netscape
6, then:
-
on Unix, remove the directory
psm from the directory where the
netscape executable resides.
-
on Windows, rename the directory C:\Program Files\Common Files\Netscape
Shared\Security to something else.
Using Personal Security Manager
The sections that follow describe how to test some of the features of Personal
Security Manager that are available with this release:
The sections that follow briefly describe how to test some of the features
listed above.
For information on the JavaScript API supported by Personal Security
Manager, see JavaScript API for Client
Certificate Management and the Personal Security Manager Deployment
Guide. For the latest versions of these documents, see http://docs.iPlanet.com/docs/manuals/psm.html.
Use Personal Security
Manager with Netscape 6
Personal Security Manager starts automatically the first time Netscape
6 needs to perform some action involving security, such as handling an
SSL session.
Follow these steps to view your security settings and confirm that
Personal Security Manager is running:
-
Launch Netscape 6.
-
Choose Security & Privacy from the Tasks menu, then choose Security
Manager to view your Personal Security Manager settings.
-
Close the Personal Security Manager window.
-
Go to the page psmtest.html (in the same directory
as these release notes), then choose Page Source from the View menu to
see the JavaScript code that a web programmer can use to detect Personal
Security Manager and its version number.
Note that the version number has two parts. The first is the version of
the PSM client library, and the second is the version of the PSM server
library.
Test Basic SSL
Go to any online store, banking service, brokerage account, or other web
site that supports SSL. Verify that the lock in the lower-left corner of
the browser window is closed when you reach the pages for which SSL should
be enabled, for example a page where you are asked to give your credit
card number.
Get an SSL Client Certificate
Go to any public or private CA and apply for an SSL client certificate.
To test one-click certificate issuance, dual key-pair certificates,
and other Personal Security Manager features, system administrators should
download, install, and configure Netscape Certificate Management System.
For complete CMS documentation and other information, see http://docs.iPlanet.com/docs/manuals/cms.html.
To download the latest version of CMS, see http://www.iplanet.com/downloads/download/.
View Your Certificate
After you have obtained a certificate, follow these steps to view it:
-
Click the Security icon in the Navigator toolbar.
-
Click the Certificates tab.
-
Click to select your certificate.
-
Click View.
You should see information about your new certificate.
Test
Client Authentication
Personal Security Manager allows the SSL server and client to negotiate
which certificate to use, and in most cases they can agree on a single
correct certificate for the client to present. When this happens, the user
can access an SSL site that requires client authentication with zero additional
clicks.
To test client authentication with Netscape Enterprise Server, system
administrators should follow these steps:
-
Install an Enterprise Server and configure it for client authentication
as described in Appendix
D, Using SSL with Enterprise Server 3.x, of Netscape Certificate
Management System Installation and Deployment Guide.
-
Test the Enterprise Server installation as described at the end of Appendix
D using Personal Security Manager.
Validate Certificates Using
OSCP
Personal Security Manager supports the use of the On-Line Certificate Status
Protocol (OSCP) to check the validity of certificates in real time. Information
about this protocol and how configure Personal Security Manager 1.2 and
a forthcoming version of Certificate Management System to support it will
be available from http://docs.iPlanet.com/docs/manuals/psm.html.
It's important to note that Personal Security Manager will accept signatures
from responders only under the following conditions:
-
The response was signed by a delegated responder--that is, the responder's
certificate was signed by the same CA as the certificate you're trying
to verify and has the extendedKeyUsage bit set indicating that
the certificate is an OCSP response signer. The certificate should be the
same as a CA certificate with the addition of the extendedKeyUsage
bit.
-
The user has designated a default responder in the OCSP Settings dialog
box (available from the Advanced tab under Options).
Common problems include the following:
-
Time drift between the client and server machine. Personal Security Manager
expects the time of the response to be within the past 24 hours. If there
is a difference in the clocks between the machine used to sign the response,
so the response looks to Personal Security Manager like it was signed in
the future, Personal Security Manager interprets this as an error. Run
ntp on both machines to fix this problem.
-
The response doesn't include the certificates required to complete the
chain needed to verify the signer's certificate. The client frequently
doesn't have all the certificates in the database that are needed to verify
the signer's certificate, in which case Personal Security Manager can't
verify the signer's certificate and OCSP fails. Make sure the entire chain
is included with every response. This is the safest way to avoid this problem.
-
If you are using ValiCert, misconfiguration may cause the Validation Authority
not to send the certificate chain (including the CA root certificate and
the OCSP responder's certificate) correctly.
Known Bugs/Issues for Personal
Security Manager 1.3
-
To run Personal Security Manager on Unix, you must be logged in as the
same Unix user you were logged in as when Netscape 6 was installed.
-
FORTEZZA is not guaranteed to work with this release. [# 94220]
-
In some unusual circumstances you may encounter problems such as valid
certificates not being verified or Netscape 6 freezing up. If you encounter
a problem that doesn't appear to have a logical explanation, try the following
as a last resort:
-
Exit Netscape 6, then relaunch it. If necessary, use Control-Alt-Delete
on Windows 95/98/2000/NT to bring up the Task Manager and click End Process
for both psm.exe and netscp6.exe.
-
Warning: Before taking this step, back up your own certificates
stored internally by Personal Security Manager. If exiting and relaunching
Netscape 6 doesn't take care of the problem, in some rare cases it may
work to exit Netscape 6, then delete or rename your cert7.db and
key3.db
files (located in your user profile directory on Windows 95/98/2000/NT,
or in the directory in which the Netscape or Mozilla executable resides
on Unix) and relaunch the Netscape 6. You should also look for all other
files in the same directory that begin with cert or
key
and end in .db and delete those files as well before relaunching
Netscape 6.
Feedback
To send feedback to the Personal Security Manager development team, send
email to psmfeedback@netscape.com.
Feedback back sent to this address will be read by the team, but you will
not receive a personal response.