
Netscape Personal Security Manager
Release 1.4
12/18/2000
These release notes contain the most recent information about this release
of Netscape Personal Security Manager. Please read these notes before using
the software.
These notes include information for IS professionals who are thoroughly
familiar with security and public-key infrastructure (PKI) issues.
Use of this product is subject to the terms detailed in the license agreement
at http://docs.iplanet.com/docs/manuals/psm/14/license.txt.
Contents
Documentation
Changes Since Personal Security Manager 1.3
Software/Hardware Requirements
Installing Personal Security Manager
Using Personal Security Manager
Known Bugs/Issues for Personal
Security Manager 1.4
Feedback
Documentation
The following documentation is available with Personal Security Manager:
- Personal Security Manager Help -- This online
help system can also be accessed by clicking the Help button in any personal
Security Manager window.
- JavaScript API for Client Certificate
Management -- This reference describes a new Javascript API for performing
user certificate management operations with Personal Security Manager, including
one-click issuance, forced certificate backup by end users, and automatic
archival of encryption private keys.
For the latest release notes, deployment guide, and other information,see
http://docs.iPlanet.com/docs/manuals/psm.html
.
Changes Since Personal Security Manager
1.3
The Transport Layer Security
(TLS) protocol is turned on by default in Personal Security Manager1.4.
To turn TLS off, open Personal Security Manager, click the Advanced tab, click
Options in the left frame, then deselect the checkbox labeled "Enable TLS."
TLS is an IETF standard based on the Secure Sockets Layer (SSL) protocol.
It can be thought of as SSL version 3.1. Some servers that do not implement
SSL correctly cannot negotiate the SSL handshake with client software (such
as Personal Security Manager) that supports TLS. To allow Personal Security
Manager to use SSL with such TLS-intolerant servers, you must disable TLS
as described above.
Most other changes since Personal Security Manager 1.3 involve minor bug
fixes and optimizations.
This version of Netscape Personal Security Manager ships with Netscape
6 and also works with Mozilla and Communicator 4.7x.
Software/Hardware
Requirements
Operating systems supported: Windows NT, Windows 95, Windows 98, Windows
2000; Solaris 2.6, 2.7, 2.8; and Red Hat Linux 6.1.
Installing Personal Security Manager
Netscape Personal Security Manager 1.4 is installed with Netscape 6 and recent versions
of Mozilla.
When you install Netscape 6 on Windows, Personal Security Manager is installed
in the directory C:\Program Files\Common Files\Netscape Shared\Security\.
When you install Netscape 6 on Unix, Personal Security Manager is installed
in a directory called psm in the same directory where the netscape
executable resides.
The sections that follow describe how to install the Personal Security Manager
files for use with Communicator 4.7x.
Installing on Windows 95/98/2000/NT for Use With Communicator 4.7x
To install Netscape Personal Security Manager on Windows 95/98/2000/NT for use with
Communicator 4.7 or later, save the file in a convenient location with the
specified filename, then drag the file's icon into a Navigator window (that
is, a browser window displayed by Communicator). Dropping the file's icon
over the browser window initiates SmartUpdate, which automatically installs
Personal Security Manager. Afterinstallation is complete, exit Communicator
and relaunch it. If your copy of Communicator is installed in the default
location, SmartUpdate installs the Personal Security Manager files in the
directoryC:\Program Files\CommonFiles\Netscape Shared\Security\
and adds the file cmnav.dllin the directory C:\Program Files\Netscape\Communicator\Program.
Installing on Unix for Use With Communicator 4.7x
To install Personal Security Manager for use with Communicator 4.7 or later on Unix, you
must be logged in as the same Unix user you will be logged in as when you
run Communicator. For the Unix installation to succeed, you must have write
privileges for both the directory where the Netscape executable resides and
the directory where the installation script creates the directory containing
the Personal Security Manager files. To install Personal Security Manager for
use with Communicator 4.7x, download the tar file for the version of the product
that you want to install and follow these steps:
- Exit Communicator, if it is running.
- Decompress the downloaded file to some convenient location.
- Run the psm-install program.
The psm-install program allows you to specify the directory in which Personal
Security Manager will be installed. In this release, you must install Personal
Security Manager locally. To do so, you can either install it in the default
location (/opt/netscape/security) or in some other local location. However,
if you install Personal Security Manager anywhere other than the default
location, Communicator must also be installed locally. To run Personal Security
Manager on Unix, you must be logged in as the same Unix user you were logged
in as when you installed it.
Disabling Personal Security Manager
To disable Personal Security Manager temporarily, exit the browser,
then:
- on Unix, remove the directorypsm from the directory where
thenetscapeexecutable resides.
- on Windows, rename the directory C:\Program Files\Common Files\Netscape
Shared\Security to something else.
Using Personal Security Manager
The sections that follow describe how to test some of the features of Personal
Security Manager that are available with this release:
The sections that follow briefly describe how to test some of the features
listed above.
For information on the JavaScript API supported by Personal SecurityManager,
see JavaScript API for ClientCertificate
Management and the Personal Security Manager DeploymentGuide. For the
latest versions of these documents, see
http://docs.iPlanet.com/docs/manuals/psm.html.
Use Personal Security
Manager with Netscape 6
Personal Security Manager starts automatically the first time Netscape 6
needs to perform some action involving security, such as handling anSSL session.
Follow these steps to view your security settings and confirm that
Personal Security Manager is running:
- Launch Netscape 6.
- Choose Security & Privacy from the Tasks menu, then choose Security
Manager to view your Personal Security Manager settings.
- Close the Personal Security Manager window.
- Go to the page psmtest.html (in the same
directoryas these release notes), then choose Page Source from the View menu
tosee the JavaScript code that a web programmer can use to detect Personal
Security Manager and its version number.
Note that the version number has two parts. The first is the version ofthe
PSM client library, and the second is the version of the PSM serverlibrary.
Test Basic SSL
Go to any online store, banking service, brokerage account, or other website
that supports SSL. Verify that the lock in the lower-left corner ofthe browser
window is closed when you reach the pages for which SSL shouldbe enabled,
for example a page where you are asked to give your creditcard number.
Get an SSL Client Certificate
Go to any public or private CA and apply for an SSL client certificate.
To test one-click certificate issuance, dual key-pair certificates,and
other Personal Security Manager features, system administrators shoulddownload,
install, and configure Netscape Certificate Management System.For complete
CMS documentation and other information, see
http://docs.iPlanet.com/docs/manuals/cms.html.To download the latest
version of CMS, see
http://www.iplanet.com/downloads/download/.
View Your Certificate
After you have obtained a certificate, follow these steps to view it:
- Click the Security icon in the Navigator toolbar.
- Click the Certificates tab.
- Click to select your certificate.
- Click View.
You should see information about your new certificate.
TestClient Authentication
Personal Security Manager allows the SSL server and client to negotiatewhich
certificate to use, and in most cases they can agree on a singlecorrect certificate
for the client to present. When this happens, the usercan access an SSL site
that requires client authentication with zero additionalclicks.
To test client authentication with Netscape Enterprise Server, systemadministrators
should follow these steps:
- Install an Enterprise Server and configure it for client authentication
as described in
AppendixD, Using SSL with Enterprise Server 3.x, of Netscape Certificate
Management System Installation and Deployment Guide.
- Test the Enterprise Server installation as described at the end of
AppendixD using Personal Security Manager.
Validate Certificates
UsingOSCP
Personal Security Manager supports the use of the On-Line Certificate Status
Protocol (OSCP) to check the validity of certificates in real time. Information
about this protocol and how configure Personal Security Manager 1.3 andNetscape
Certificate Management System 4.2 to support it is available from
http://docs.iPlanet.com/docs/manuals/psm/12/psmdply.htm
It's important to note that Personal Security Manager will accept signatures
from responders only under the following conditions:
- The response was signed by a delegated responder--that is, the responder's
certificate was signed by the same CA as the certificate you're trying
to verify and has the extendedKeyUsage bit set indicating thatthe
certificate is an OCSP response signer. The certificate should be thesame
as a CA certificate with the addition of the extendedKeyUsagebit.
- The user has designated a default responder in the OCSP Settings dialog
box (available from the Advanced tab under Options).
Common problems include the following:
- Time drift between the client and server machine. Personal Security
Managerexpects the time of the response to be within the past 24 hours. If
thereis a difference in the clocks between the machine used to sign the response,
so the response looks to Personal Security Manager like it was signed inthe
future, Personal Security Manager interprets this as an error. Runntp on
both machines to fix this problem.
- The response doesn't include the certificates required to complete
thechain needed to verify the signer's certificate. The client frequently
doesn't have all the certificates in the database that are needed to verify
the signer's certificate, in which case Personal Security Manager can'tverify
the signer's certificate and OCSP fails. Make sure the entire chainis included
with every response. This is the safest way to avoid this problem.
- If you are using ValiCert, misconfiguration may cause the Validation
Authoritynot to send the certificate chain (including the CA root certificate
andthe OCSP responder's certificate) correctly.
Known Bugs/Issues for
Personal Security Manager 1.4
- To run Personal Security Manager on Unix with Netscape 6 or Communicator,
you must be logged in as thesame Unix user you were logged in as when the
browser was installed.
- FORTEZZA is not guaranteed to work with this release. [# 94220]
- In some unusual circumstances you may encounter problems such as valid
certificates not being verified or the browser freezing up. If you encounter
a problem that doesn't appear to have a logical explanation, try the following
as a last resort:
- Exit the browser, then relaunch it. If necessary, use Control-Alt-Delete
on Windows 95/98/2000/NT to bring up the Task Manager and click End Process
for both psm.exe and netscp6.exe.
- Warning: Before taking this step, back up your own certificates
stored internally by Personal Security Manager. If exiting and relaunching
the browser doesn't take care of the problem, in some rare cases it maywork
to exit the browser, then delete or rename your cert7.db and
key3.dbfiles (located in your user profile directory on Windows 95/98/2000/NT,
or in the directory in which the Netscape or Mozilla executable resideson
Unix) and relaunch the browser. You should also look for all otherfiles in
the same directory that begin with cert orkeyand end in
.db and delete those files as well before relaunchingthe browser.
Feedback
To send feedback to the Personal Security Manager development team, send email
to psmfeedback@netscape.com.
Feedback back sent to this address will be read by the team, but you will
not receive a personal response.