Red Hat CERTIFICATE 7.2 RELEASE NOTES Instruction Manual

Release Notes

7.2 and Updates

terms and conditions set forth in the Open Publication License, V1.0 or later with the

restrictions noted below (the latest version of the OPL is presently available at ht-

tp://www.opencontent.org/openpub/).

Distribution of substantively modified versions of this document is prohibited without

the explicit permission of the copyright holder.

Distribution of the work or derivative of the work in any standard (paper) book form for

commercial purposes is prohibited unless prior permission is obtained from the copy-

right holder.

Red Hat and the Red Hat "Shadow Man" logo are registered trademarks of Red Hat,

Inc. in the United States and other countries.

All other trademarks referenced herein are the property of their respective owners.

The GPG fingerprint of the [email protected] key is:

CA 20 86 86 2B D6 9D FC 65 F6 EC C4 21 91 80 CD DB 42 A6 0E

1801 Varsity Drive

Raleigh, NC 27606-2072USAPhone: +1 919 754 3700

Phone: 888 733 4281

Fax: +1 919 754 3701

PO Box 13588Research Triangle Park, NC 27709USA

1. Introduction .....................................................................................................................2

2. New Features in Red Hat Certificate System 7.2 ................................................................2

3. Deployment Notes ...........................................................................................................4

3.1. Server Support ......................................................................................................4

3.2. Optional Server Hardware ......................................................................................5

3.3. Client Support .......................................................................................................6

3.4. Optional Client Hardware .......................................................................................6

3.5. Other Required Software .......................................................................................6

3.6. Red Hat Enterprise Linux Considerations ................................................................6

3.7. Sun Solaris Considerations ....................................................................................7

4. Obtaining Packages .........................................................................................................7

5. Important Notes ...............................................................................................................8

5.1. Installation Notes ...................................................................................................8

5.2. Required JRE .......................................................................................................8

5.3. Required JDK .......................................................................................................9

5.4. TPS Subsystem Considerations ...........................................................................10

5.5. Directory Server Information ................................................................................10

5.6. Source RPMs ......................................................................................................10

5.7. New File Locations and Subsystem URIs ..............................................................10

6. Known Issues ................................................................................................................11

7. Updates and Errata Releases for Red Hat Certificate System 7.2 ......................................16

8. Documentation ..............................................................................................................19

9. Copyright and Third-Party Acknowledgments ...................................................................20

10. Document History .........................................................................................................24

1. Introduction

These release notes contain important information available at the time of release for Red Hat Certific-

ate System 7.2. New features, system requirements, installation notes, known problems, resources,

and other current issues are addressed here. Read this document before beginning to use Red Hat

Certificate System.

2. New Features in Red Hat Certificate System 7.2

Red Hat Certificate System 7.2 is a powerful public-key infrastructure (PKI) system containing the fol-

lowing new features:

•New silent installation script to ease installing and configuring multiple subsystem instances

•New security domain structure to organize and streamline communications between subsystems

•Enhanced cloning functionalities utilizing the new security domain organization

•Enhanced Red Hat Enterprise Security Client GUI and diagnostic and Phone Home functionality

•Multiple distinct packages rather than a single all-encompassing package

•A new standards-based architecture which more closely integrates Red Hat Certificate System with

its base operating system

•Simplified browser-based HTML configuration panels for setting up subsystems

•Replaced Netscape Enterprise Server (NES) with Tomcat and Apache web servers

•Decoupled Red Hat Directory Server from Red Hat Certificate System

•Relocatable Red Hat Certificate System subsystem instances

•New supported server platform, Red Hat Enterprise Linux AS 4 (Intel 64-bit)

•New supported client platform, Apple Macintosh OS X 10.4.x (Tiger) (Power PC 32-bit)

Release Notes

Red Hat Certificate System 7.1 was comprised of a single large package. Red Hat Certificate System

7.2 has been modularized into numerous smaller packages to allow easier support by updating an ex-

isting package rather than the entire server. This has the additional advantage of allowing changes to

be more easily tracked through the operating system's package management database. For example,

32-bit Red Hat Enterprise Linux 4 version of Certificate System is comprised of the following nine

entry-point packages:

Package Name Package Description

rhpki-ca-7.2.0-1.noarch.rpm Certificate Authority (CA)

rhpki-kra-7.2.0-1.noarch.rpm Data Recovery Manager (DRM); also known as Key Recovery

Authority (KRA)

rhpki-ocsp-7.2.0-1.noarch.rpm Online Certificate Status Protocol (OCSP) Responder

rhpki-tks-7.2.0-1.noarch.rpm Token Key Service (TKS)

rhpki-tps-7.2.0-1.i386.rpm Token Processing System (TPS)

rhpki-console-7.2.0-1.noarch.rpm PKI Console

rhpki-java-tools-7.2.0-1.noarch.rpm Java™-based command-line tools

rhpki-native-tools-7.2.0-1.i386.rpm Native command-line tools

esc-1.0.0-16.i386.rpm Red Hat Enterprise Security Client

Table 1. Packages in Red Hat Certificate System 7.2

The new modular architecture is based upon standards such as the Filesystem Hierarchy Standard

(FHS) 2.3. This means that there is no longer an all-inclusive server root. Rather, Red Hat Certificate

System server functionality is implemented through distribution to appropriate locations within the op-

erating system. For example, 32-bit Red Hat Certificate System libraries are located under /usr/lib,

binaries are located under /usr/bin, and Java™archives (jars) are located under /

usr/share/java.

In Red Hat Certificate System 7.1, the Java™-based tool startconsole was used to configure and

manage any server instance of Red Hat Certificate System. In Red Hat Certificate System 7.2, an

HTML-based configuration wizard is used to configure any new subsystem instance, while a utility

called pkiconsole is used to manage existing instances. The HTML configuration panels are indi-

vidually customized for subsystem type.

Red Hat Certificate System 7.1 used Netscape Enterprise Server as an integrated web server for all of

its HTTP/HTTPS transactions. Red Hat Fortitude provides a Network Security Services (NSS) module

to the Apache HTTP Server 2.0 and a Java™Security Services (JSS) plug-in to Tomcat 5.5. The leg-

acy NES web server in CA, DRM, OCSP, and TKS subsystems has been replaced by Tomcat running

Fortitude, and the legacy NES web server in TPS subsystems has been replaced by Apache running

Fortitude.

Previously, Red Hat Directory Server was bundled and installed with Red Hat Certificate System. Red

Hat Certificate System 7.2 still requires a Red Hat Directory Server 7.1 (SP 3) installation for each

subsystem at configuration, but this server must be installed separately and before the Certificate Sys-

tem is installed.

New Features in Red Hat Certificate System 7.2

NOTE

The Red Hat Directory Server can be installed on a separate machine, which is the re-

commended scenario for most production deployments.

Red Hat Certificate System 7.2 creates and removes instances of CA, DRM, OCSP, TKS, and TPS

through command-line utilities called pkicreate and pkiremove. The pkicreate utility allows an

instance to be placed anywhere on the operating system, including a data partition that may be RAID-

enabled. This allows true separation of unique Red Hat Certificate System data from shared Red Hat

Certificate System libraries, executables, and jars, thus providing a better means of maintaining the

security and integrity of a user's valuable data. Furthermore, a Red Hat Certificate System instance

may only be removed by running pkiremove; removing the core Red Hat Certificate System services

have no effect on any Red Hat Certificate System instances installed on a given system.

The Red Hat Certificate System 7.2 server product is now available for 64-bit Red Hat Enterprise

Linux 4 (AMD64 and Intel EM64T) platforms, as well as 32-bit Red Hat Enterprise Linux 4 (i386).

Red Hat Enterprise Security Client 1.0 is now available on Apple Macintosh OS X 10.4.x (Tiger), as

well as Microsoft Windows XP Professional and 32-bit and 64-bit Red Hat Enterprise Linux 4. The

TokenD implementation in the new Enterprise Security Client allows use of Red Hat Certificate System

smart card technology to be integrated with Apple applications such as the Safari Web browser and

Apple Mail.

The Red Hat Enterprise Security Client GUI has been completely revamped and standardized across

all platforms. Enhanced diagnostic information has been added to the UI. New Phone Home configur-

ation streamlines the communication between the TPS and Enterprise Security Client and simplifies

the initial Enterprise Security Client configuration.

3. Deployment Notes

This section contains information related to installing Red Hat Certificate System 7.2, including hard-

ware and platform requirements and prerequisites.

3.1. Server Support

The Certificate System subsystems are supported on the following platforms:

•Red Hat Enterprise Linux AS 4 for i386

•Red Hat Enterprise Linux ES 4 for i386

•Red Hat Enterprise Linux AS 4 for AMD64 and Intel EM64T

•Red Hat Enterprise Linux ES 4 for AMD64 and Intel EM64T

•64-bit Solaris 9 for SPARC

Release Notes

Component Details

CPU Intel — 2.0 GHz Pentium 4 or faster

RAM 1 GB (required)

Hard disk storage space Total is approximately 5 GB

•Total transient space required during installa-

tion: 1 GB

•Hard disk storage space required for installa-

tion:

•Space required to set up, configure, and run

the server: approximately 2 GB

•Additional space for database growth in pilot

deployment: approximately 1 GB

•Total disk storage space for installation: ap-

proximately 1 GB

Table 2. Server Requirements

3.2. Optional Server Hardware

•Chrysalis-ITS LunaSA Hardware Security Module (HSM)

•Firmware: 4.5.2

•Appliance Software: 3.2.4

•Client Software: 3.2.4

•nCipher netHSM

•Firmware: 2.12

•Software: 9.01

Optional Server Hardware

3.3. Client Support

The Enterprise Security Client is supported on the following platforms:

•Apple Macintosh OS X 10.4.x (Tiger) (Power PC, Intel)

•Microsoft Windows XP Professional (i386)

•Red Hat Enterprise Linux AS 4 (i386)

•Red Hat Enterprise Linux ES 4 (i386)

•Red Hat Enterprise Linux AS 4 for AMD64 and Intel EM64T

•Red Hat Enterprise Linux ES 4 for AMD64 and Intel EM64T

3.4. Optional Client Hardware

•Axalto Global Platform compatible Cyberflex eGate token

3.5. Other Required Software

•Red Hat Directory Server 7.1; the source code and binaries for this component are available at ht-

tps://1rhn.redhat.com), through the Red Hat Directory Server 7.1 channel.

•Web browser software that supports SSL. It is strongly recommended that users such as agents or

administrators use Mozilla Firefox. End-entities should use Mozilla Firefox or Microsoft Internet Ex-

plorer.

The only browser that is fully-supported for the HTML-based instance configuration wizard is Mozilla

Firefox.

3.6. Red Hat Enterprise Linux Considerations

Before installing the Certificate System packages, ensure that the proper dependencies are installed

on the Red Hat Enterprise Linux system.

The following package groups and packages must be installed on all Red Hat Enterprise Linux sys-

tems:

•dialup (package group)

Release Notes

•gnome-desktop (package group)

•compat-arch-support (package group)

•web-server (package group)

•kernel-smp (package)

•e2fsprogs (package)

•firefox (package)

On 64-bit Red Hat Enterprise Linux platforms, ensure that the 64-bit (x86_64) compat-libstdc++

libraries are installed, and not only the 32-bit (i386) libraries. To confirm this, run the following com-

mand as root:

rpm -qa --queryformat 'compat-libstdc++-%{VERSION}-%{RELEASE}.%{ARCH}.rpm

| grep x86_64

Numerous libraries should be displayed.

3.7. Sun Solaris Considerations

The Sun Solaris version of Certificate System was tested on Solaris 9 with patch level 118558-28.

4. Obtaining Packages

Red Hat Network (http://1rhn.redhat.com) is the software distribution mechanism for most Red Hat

customers. Account login information for Red Hat Network, including entitlements for the Red Hat Cer-

tificate System 7.2 release, is required to download this software from Red Hat Network. After logging

into Red Hat Network, go to the appropriate Red Hat Certificate System 7.2 channel to download the

packages for the selected Red Hat Enterprise Linux platform.

NOTE

The source code for Red Hat Directory Server 7.1 is included with the ISO image down-

loaded for the 32-bit Red Hat Enterprise Linux version. Red Hat Certificate System it-

self is not yet open source.

Red Hat Enterprise Linux systems can upgrade or download Red Hat Certificate System using

up2date.

Sun Solaris Considerations

5. Important Notes

The following sections contain important installation, configuration, and deployment information for

Red Hat Certificate System 7.2.

5.1. Installation Notes

•Packages are non-relocatable. The Red Hat Certificate System base packages can not be installed

to a user-designated location.

•Do not use the Autorun feature of the CD drive. If you use the Autorun feature with a CD created

from the ISO image, all subsystems (CA, DRM, OCSP, TKS, and TPS) as well as the Enterprise Se-

curity Client are installed on the system by default.

The preferred alternative is to run the installation scripts provided for the server, or to follow the in-

stallation instructions in the Red Hat Certificate System 7.2 Administration Guide.

5.2. Required JRE

Java™1.5.0 Java Runtime Environment (JRE). Certificate System does not support earlier versions of

the JRE. This JRE is required for running Tomcat, among other applications for the Certificate System.

On 32-bit Red Hat Enterprise Linux 4 platforms, Certificate System 7.2 requires the 32-bit version of

the IBM JRE 1.5.0. A pre-packaged binary distribution of this package, java-

1.5.0-ibm-1.5.0.0-1jpp_2rh:0.i386, is available through either the Red Hat Enterprise

Linux AS (v. 4 for x86) Extras Red Hat Network channel or the Red Hat Enterprise Linux ES (v. 4

for x86) Extras Red Hat Network channel.

Similarly, for 64-bit Red Hat Enterprise Linux 4 platforms, Certificate System 7.2 requires the 64-bit

version of the IBM JRE 1.5.0. A pre-packaged binary distribution of this package, java-

1.5.0-ibm-1.5.0.0-1jpp_2rh:0.x86_64, is available through either the Red Hat Enterprise

Linux AS (v. 4 for AMD64/EM64T) Extras Red Hat Network channel or the Red Hat Enterprise

Linux ES (v. 4 for AMD64/EM64T) Extras Red Hat Network channel.

As root, run /usr/sbin/alternatives --config java to ensure that the IBM Java™1.5.0

JRE is selected.

Warning

Both the 32-bit xSeries (Intel-compatible) and 64-bit AMD/Opteron/EM64T versions of

the IBM J2SE JRE 5.0 RPM packages available through the IBM download site are

packaged in a format which is incompatible with Certificate System 7.2.

For 64-bit Solaris 9 (SPARC) platforms, download and install the latest version of the 64-bit Sun J2SE

Java™Runtime Environment 5.0 (Update 8) available from the Sun download site, ht-

tp://java.sun.com/javase/downloads/index.jsp.

Release Notes

IMPORTANT

The 64-bit Solaris version of the Certificate System requires the user to install the 32-bit

version of the JRE as well as installing the 64-bit version. The 32-bit version is used for

the applet and Java™Web Start support. Read ht-

tp://java.sun.com/j2se/1.5.0/README.html,ht-

tp://java.sun.com/j2se/1.5.0/ReleaseNotes.html, and ht-

tp://java.sun.com/j2se/1.5.0/jre/install-solaris-64.html before installing the Certificate

System.

Under the section Java Runtime Environment (JRE) 5.0 Update 9, Sun only makes this JRE available

through a self-extracting file which is incompatible with Certificate System since this format does not

use the native Solaris packaging utility database.

It is possible to obtain the Sun 5.0 JRE in a compatible format. Click Download under the JDK 5.0 Up-

date 9 section, and, under Solaris SPARC Platform - J2SETM Development Kit 5.0 Up-

date 9, select Solaris SPARC 32-bit packages - tar.Z

(jdk-1_5_0_09-solaris-sparc.tar.Z) and Solaris SPARC 64-bit packages - tar.Z

(use 32-bit version for applet and Java Web Start support)

(jdk-1_5_0_09-solaris-sparcv9.tar.Z).

After downloading these two files, uncompress them using the gunzip utility, and extract the contents

using the tar utility.

The contents of the 32-bit file, jdk-1_5_0_09-solaris-sparc.tar.Z, are COPYRIGHT,

LICENSE,README.html,SUNWj5cfg,SUNWj5dev,SUNWj5dmo,SUNWj5jmp,SUNWj5man, and

SUNWj5rt.

The contents of the 64-bit file, jdk-1_5_0_09-solaris-sparcv9.tar.Z, are SUNWj5dmx,SUN-

Wj5dvx, and SUNWj5rtx.

Since only the JRE is needed on Solaris 9 systems, use the pkgadd utility to add the 32-bit package,

SUNWj5rt, first, and then add the 64-bit package, SUNWj5rtx.

5.3. Required JDK

A JDK must be present on Red Hat Enterprise Linux systems. See ht-

tp://kbase.redhat.com/faq/FAQ_54_4667.shtm for more information. While almost any JDK is suffi-

cient, installing one of these JDKs is recommended:

•For 32-bit Red Hat Enterprise Linux 4 platforms, a pre-packaged binary distribution of the 32-bit ver-

sion of the IBM JDK 1.5.0, java-1.5.0-ibm-devel-1.5.0.0-1jpp_2rh:0.i386, is available

through either the Red Hat Enterprise Linux AS (v. 4 for x86) Extras Red Hat Network channel or

the Red Hat Enterprise Linux ES (v. 4 for x86) Extras Red Hat Network channel.

•For 64-bit Red Hat Enterprise Linux 4 platforms, a pre-packaged binary distribution of the 64-bit ver-

sion of the IBM JDK 1.5.0, java-1.5.0-ibm-devel-1.5.0.0-1jpp_2rh:0.x86_64, is avail-

able through either the Red Hat Enterprise Linux AS (v. 4 for AMD64/EM64T) Extras Red Hat

Network channel or the Red Hat Enterprise Linux ES (v. 4 for AMD64/EM64T) Extras Red Hat

Network channel.

Required JDK

After installing the JDK, run /usr/sbin/alternatives --config javac as root to insure that

a JDK is available.

Solaris 9 systems do not require downloading and installing a JDK; however, it may be required to

download and install the Sun JDK 5.0 package in order to obtain a compatible Sun JRE 5.0 package.

5.4. TPS Subsystem Considerations

•TPS subsystems installed on a Red Hat Enterprise Linux system require a local installation of the

Apache 2.0.x web server. If the installation is made on a newly-installed Red Hat Enterprise Linux

AS or ES system, rather than an upgraded system, and Everything was selected during the

Anaconda installation process, an Apache server should already be present.

When installing the TPS subsystem on Solaris 9, a specially-configured Apache server is included

as part of the Certificate System 7.2 packages.

•The TPS subsystem cannot be cloned.

5.5. Directory Server Information

All subsystems require access to Red Hat Directory Server 7.1 on either the local machine (if it is also

a 32-bit Red Hat Enterprise Linux platform) or a remote machine (acceptable platforms are 32-bit Red

Hat Enterprise Linux 4, 32-bit Solaris 9 for SPARC, or 64-bit Solaris 9 for SPARC).

5.6. Source RPMs

Since Red Hat Certificate System 7.2 is not an open-source product, source RPMs are only available

for third-party packages.

NOTE

Several of these third-party packages may issue warnings when they are installed be-

cause they may contain the UID or GUID of their original packager.

5.7. New File Locations and Subsystem URIs

The subsystem files in Certificate System 7.2 are in different locations than in Certificate System 7.1.

The old and new locations are listed in Table 3, “Certificate System 7.1 and 7.2 File Locations”. These

are explained in more detail in chapter 3, "Administrative Basics," in the Certificate System Adminis-

trator's Guide.

File 7.1 Location 7.2 Location

Subsystem start and stop

scripts /opt/redhat-cs/cert-in-

stance_ID /etc/init.d/instance_ID

Release Notes

This manual suits for next models

Table of contents

Other Red Hat Software manuals

Red Hat

Red Hat ENTERPRISE LINUX 5.5 - S 2010 User manual

Red Hat

Red Hat ENTERPRISE LINUX 4 - USING BINUTILS Manual

Red Hat

Red Hat CLUSTER SUITE 4.7 - CLUSTER LVM... User manual

Red Hat

Red Hat NETWORK 4.0 - User manual

Red Hat

Red Hat GNBD WITH GLOBAL FILE SYSTEM 4.7 Instruction Manual

Red Hat

Red Hat CLUSTER SUITE FOR ENTERPRISE LINUX 5.1 Installation guide

Red Hat

Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER... User manual

Red Hat

Red Hat ENTERPRISE LINUX 3 - SECURITY GUIDE Instruction Manual

Red Hat

Red Hat ENTERPRISE LINUX 4 - STEP BY STEP GUIDE User manual

Red Hat

Red Hat NETWORK 3.5 - PROVISIONING User manual

Red Hat

Red Hat GFS 5.2.1 - Service manual

Red Hat

Red Hat SATELLITE 5.1 RELEASE NOTES Instruction Manual

Red Hat

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION... User manual

Red Hat

Red Hat SYSTEM 8.0 - MIGRATION GUIDE 7.X TO 8.0 User manual

Red Hat

Red Hat NETWORK SATELLITE SERVER 4.0 User manual

Red Hat

Red Hat CLUSTER SUITE FOR ENTERPRISE LINUX 4.6 Installation guide

Red Hat

Red Hat NETWORK SATELLITE SERVER 4.1.0 User manual

Red Hat

Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Instruction Manual

Red Hat

Red Hat CLUSTER MANAGER - INSTALLATION AND Instruction Manual

Red Hat

Red Hat NETWORK 3.5 - PROVISIONING User manual

Red Hat

Red Hat CLUSTER FOR ENTERPRISE LINUX 5.0 User manual

Red Hat

Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER... User manual

Red Hat

Red Hat ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE User manual

Red Hat

Red Hat NETWORK 4.0 - User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual