# Certificate Information and Decisions

This section describes how to use various windows displayed at different times by Certificate Manager. The additional information given here appears when you click the Help button in one of those windows.

In this section: Certificate Details Enrollment Information Certificate Renewal User Identification Request New Certificate Authority Web Site Certificates

## Certificate Details

The Certificate Details window displays information about a certificate you selected in one of the Certificate Manager tabs.

The top panel of the Certificate Details window displays the certificate chain, with the certificate you originally selected at the bottom. A certificate chain is a hierarchical series of certificates signed by successive certificate authorities. A CA certificate identifies a certificate authority (CA) and is used to sign certificates issued by that authority. A CA certificate can in turn be signed by the CA certificate of a parent CA and so on up to a root CA.

To examine information for any certificate in the certificate chain, click the its name in the top panel. The corresponding information is displayed in the bottom panel. The bottom panel shows the following information about the selected certificate:

- Whether the certificate has been verified, and if so for what uses. See certificate verification for a discussion of how the Certificate Manager verifies certificates. Uses can include any of the following:

- SSL Client Certificate. Certificate used to identify you to web sites.
- SSL Server Certificate. Certificate used to identify a web site server to browsers.
- Email Signer Certificate. Certificate used to identify you for the purposes of digitally signing email messages.
- Email Recipient Certificate. Certificate used to identify someone else, for example so you can send that person encrypted email.
- Status Responder Certificate. Certificate used to identify an on-line status responder that uses the Online Certificate Status Protocol (OCSP) to check the validity of certificates. For more information about OCSP, see Validation Settings.
- Certificate Authority Certificate. Certificate used to identify a certificate authority—that is, a service that issues certificates for use as identification over computer networks.

- Common Name. The name of the person or other entity that the certificate identifies.

- Organization. The name of the organization to which the entity belongs (such as the name of a company).

- Organizational Unit. The name of the organizational unit to which the entity belongs (such as Accounting Department).

- Issuer Name. The name of the organization that issued the certificate.
- Serial Number. The certificate's serial number.
- RSA Public Modulus.
- SHA1 Fingerprint.A fingerprint is a unique number associated with a certificate. In this case the number is produced by applying a mathematical function based on the Secure Hash Algorithm (SHA1)to the contents of the certificate. A certificate's fingerprint can be used to verify that the certificate has not been tampered with.
- MD5 Fingerprint.A fingerprint produced by applying a mathematical function based on the Message Digest Algorithm (MD5)to the contents of the certificate.

The Details tab of the Certifiate Details window displays the complete contents of the selected certificate. This information is normally of interest to IS professionals only.

Certificate Manager displays basic ANSI types in human-readable form wherever possible. For fields whose contents it cannot interpret, Certificate Manager simply displays the actual values contained in the certificate.

## Choose Security Device

A security device (sometimes called a token) is a hardware or software device that provides cryptographic services such as encryption and decryption and stores certificates and keys. The Choose Security Device window appears when Certificate Manager needs help deciding which security device to use when importing a certificate or performing a cryptographic operation, such as generating keys for a new certificate. This window allows you to select one of two or more security devices that Certificate Manager has detected on your machine.

A smart card is one example of a security device. For example, if a smart card reader connected to your computer has a smart card inserted in it, the name of the smart card will show up in the drop-down menu. In this case, you must choose the name of the smart card from the menu to let Certificate Manager know that you want to use it.

The Certificate Manager also supplies its own default, built-in security device, which can always be used no matter what additional devices are or aren't available.

## Enrollment Information

The following windows may appear while you are attempting to obtain a certificate from a certificate authority (a process sometimes called certificate enrollment):

- Encryption Key Copy
- Certificate_Backup

### Encryption Key Copy

Certificate authorities (CAs) that issue separate signing and encryption email certificates typically make backup copies of your private encryption key during the certificate enrollment process. Separate signing and encryption certificates require client software that supports dual key pairs for use in signing and encrypting email.

It's important to understand that a CA that has archived a backup copy of your encryption key has the potential capability of decrypting any messages encrypted with your public key. If you trust your CA with this capability, click OK. After your CA makes a backup copy of the encryption key, you will be able to use that key to access your encrypted mail even if you lose your password or lose your own copy of the key. If no backup copy of your encryption key exists and you lose your password or the key, you will have no way of reading any of your encrypted email messages.

If you don't trust the CA that is requesting the backup copy, don't request a certificate from it. Click Cancel to stop both the backup procedure and the request for a certificate.

If you are not sure whether to trust the CA that is requesting the backup copy, talk to your system administrator.

### Certificate Backup

When you receive a certificate, make a backup copy of the certificate and its private key, then store the copy in a safe place. For example, you can put the copy on a floppy disk and store it with other valuable items under lock and key. That way, even if you have hard disk or file corruption problems, you can easily restore the certificate.

It can be inconvenient, at best, and in some situations catastrophic to lose your certificate and its associated private key, depending on what you use it for. For example:

- If you lose a certificate that identifies you to important web sites, you will not be able to access those web sites until you obtain a new certificate.
<
- If you lose a certificate used to encrypt email messages, you will not be able to read any of your encrypted email—including both encrypted messages that you have sent and encrypted messages that you have received. In this case, if you cannot obtain a backup of the private encryption key associated with the certificate, you will never be able to read any of the messages encrypted with that key.

Like any other valuable data, certificates should be backed up to avoid future trouble and expense. Do it now so you don't forget.

## Certificate Renewal

Like a credit card, a driver's license, and many other forms of identification, a certificate is valid for a specified period of time. When a certificate expires, you need to get a new one—unless you have decided that you don't need that certificate anymore.

Certifocate Manager displays the Certificate Renewal window when it detects that one of your certificates is about to expire. Information about the certificate is displayed at the top of the window. The information provided includes the name of the CA that issued the certificate (labeled "Issued Under").

The Certificate Renewal window allows you to make one of two decisions:

- Renew this certificate now. If you select this option, Certificate Manager initiates the renewal process.
- Remind me to renew this certificate later. If you select this option, Certificate Manager will not initiate the renewal process, but will remind you again later.

## User Identification Request

Some web sites require that you identify yourself with a certificate rather than a name and password, because certificates provide a more reliable form of identification. This method of identifying yourself over the Internet is sometimes called client authentication.

However, Certificate Manager may have more than one certificate on file that can be used for the purposes of identifying yourself to a web site. In this case, Certificate Manager presents the User Identification Request window, which allows you to select the appropriate certificate for the web site you want to visit.

Web sites can also use certificates to identify themselves. The certificate presented by the web site you want to visit is displayed in the top part of this window. The information provided includes the name of the CA that issued the certificate (labeled "Issued Under").

The certificates you have available for the purposes of identifying yourself to a web site are listed in the drop-down menu in the bottom part of the window. Choose the certificate that seems most likely to be recognized by the web site you want to visit.

## No_Acceptable_Identification

text to come

## New Certificate Authority

The certificates the Certificate Manager has on file, whether stored on your computer or on an external security device such as a smart card, include certificates that identify a certificate authorities (CAs). To be able to recognize any other certificates it has on file, Certificate Manager must have certificates for the CAs that issued or authorized issuance of those certificates. When you decide to trust a CA, Certificate Manager files that CA's certificate and can then recognize the kinds of certificates you trust that CA to issue.

[what follows needs updating for new UI]

Certificate Manager displays two windows that allow you to specify that you trust a new CA:

- New Certificate Authority: Step 1. Before you decide to trust a new CA, make sure that you know who is operating it. Make sure the CA's policies and procedures and are appropriate for the kinds of certificates it issues. For example, if the CA issues certificates identifying web sites you use for financial transactions, make sure you are comfortable with the level of assurance the CA provides.

- New Certificate Authority: Step 2. At this stage, you need to decide what kinds of certificates issued by this CA you want to trust. You can select any of the following options:

- Trust this CA to identify web sites. As noted above, web site certificates for some sites, such as those that handle financial transactions, can be extremely important, and inappropriate or false identification can have negative consequences.

- Trust this CA to identify email users. If you intend to send email users confidential information in encrypted form, or if accurate identification of email users is important to you for any other reason, you should consider carefully the CA's procedures for identifying prospective certificate owners and whether they are appropriate for your purposes before selecting this option.

- Trust this CA to identify software developers. Selecting this option means that you trust the CA to issue certificates that identify the origin of Java applets and JavaScript scripts requesting special access to your computer, such as the ability to change files. Since such access privileges can be misused, for example to destroy data stored on your hard disk, be very careful about selecting this option unless you are certain that you trust the CA for this purpose.

## Web Site Certificates

One of the following windows may appear when you attempt to go to a web site that supports authentication and encryption:

- New Web Site Certificate
- Expired Web Site Certificate
- Web Site Certificate Not Yet Valid
- Unexpected Certificate Name

### New Web Site Certificate

Many web sites use certificates to identify themselves when you visit the site. If Certificate Manager doesn't recognize the certificate authority (CA) that issued a web site's certificate, it displays the following windows:

[following needs updating for new UI

- New Web Site Certificate: Step 1. To examine the certificate, click View. If you believe that this web site is the site the certificate says it is, click Next. If you suspect that the web site is not what it claims to be, you can either click Cancel (in which case you will not connect to the web site) or click Next to go to Step 2.

- New Web Site Certificate: Step 2. If you clicked Next in Step 1, you now have to decide how long you are willing to trust this certificate, if at all:

- Accept this certificate permanently means that Certificate Manager will recognize this certificate as legitimate identification until it expires. You should not select this option unless you are absolutely sure that you trust the web site identified by the certificate.

- Accept this certificate temporarily for this session means that Certificate Manager will recognize this certificate as legitimate identification for this session only. If you select this option, Certificate Manager will connect with the web site this time, but will display the New Web Site Certificate window again the next time you visit the web site.

- Do not accept this certificate and do not connect to the web site means that Certificate Manager will not accept this certificate. If you select this option, Certificate Manager will not connect with this web site this time and will display the New Web Site Certificate window again the next time you visit the web site.

### Expired Web Site Certificate

Like a credit card, a driver's license, and many other forms of identification, a certificate is valid for a specified period of time. When a certificate expires, the owner of the certificate needs to get a new one.

Certificate Manager displays the Expired Web Site Certificate window when you attempt to visit a web site whose certificate has expired. As the window explains, the first thing you should do is make sure the time and date displayed by your computer is correct. If your computer's clock is set to a date that is after the expiration date, Certificate Manager treats the web site's certificate as expired.

You can examine information about the certificate, including its validity period, by clicking the View button.

The decision whether to trust the site anyway depends on what you intend to do at the site and what else you know about it. Most commercial sites will make sure that they replace their certificates before they expire.

If you believe the certificate's expiration is an inadvertent error, you may want to accept the certificate anyway for this session and let the webmaster for the site know about the problem.

If you suspect that there may be a more significant problem, either accept the certificate and be cautious about any actions you take while you are visiting the site, or do not accept the certificate (in which case the browser will not connect you to the site).

### Web Site Certificate Not Yet Valid

Like a credit card, a driver's license, and many other forms of identification, a certificate is valid for a specified period of time.

Certificate Manager displays the Web Site Certificate Not Yet Valid window when you attempt to visit a web site whose certificate's validity period has not yet started. The first thing you should do is make sure the time and date displayed by your own computer is correct. If your computer's clock is set to the wrong date, Certificate Manager may treat the web site's certificate as not yet valid even if this is not the case.

You can examine information about the certificate, including its validity period, by clicking the View button.

The decision whether to trust the site anyway depends on what you intend to do at the site and what else you know about it. Most commercial sites will make sure that the validity period for their certificates has begun before beginning to use them.

If you believe the certificate's expiration is an inadvertent error, you may want to accept the certificate anyway for this session and let the webmaster for the site know about the problem.

If you suspect that there may be a more significant problem, either accept the certificate and be cautious about any actions you take while you are visiting the site, or do not accept the certificate (in which case Certificate Manager will not connect you to the site).

### Unexpected Certificate Name

A web site certificate specifies the name of the web site in the form of the site's host name. For example, the host name for Netscape Netcenter is home.netscape.com. If the host name in a web site's certificate doesn't match the actual host name of the web site, it may be a sign that someone is attempting to intercept your communication with the web site.

The decision whether to trust the site anyway depends on what you intend to do at the site and what else you know about it. Most commercial sites will make sure that the host name for a web site certificate matches the web site's actual host name.

If you decide to accept the certificate anyway for this session, you should be cautious about what you do on the web site, and you should treat any information you find there as potentially suspect.

5/10/2001

Copyright © 1994-2001 Netscape Communications Corporation.