
Personal Security Manager
Release 1.01
1/27/2000
These release notes contain important information about this release of
Personal Security Manager. Please read these notes before using the software.
These notes include information for IS professionals who are thoroughly
familiar with security and public-key infrastructure (PKI) issues.
Use of this product is subject to the terms detailed in the license
agreement accompanying it (see license.html).
Contents
Documentation
Changes Since Personal Security Manager
1.0
Software/Hardware Requirements
Installing Personal Security Manager
Using Personal Security Manager
Known Bugs/Issues for
Personal Security Manager 1.01
Feedback
Documentation
The following documentation is available in the same directory as these
release notes:
-
Personal Security Manager Help -- This online
help system can also be accessed by clicking the Help button in any personal
Security Manager window.
-
JavaScript API for Client Certificate Management
-- This reference describes a new Javascript API for performing user certificate
management operations with Personal Security Manager, including one-click
issuance, forced certificate backup by end users, issuance of dual encryption
and signing email certificates, and automatic archival of encryption private
keys.
For the latest release notes, deployment guide, and other information,
see the link to Personal Security Manager documentation at http://developer.iPlanet.com/docs/manuals/cms.html.
Changes Since Personal Security Manager
1.0
The status of the following important features or bugs has changed since
the 1.0 release:
-
With release 1.0, Communicator crashed when you attempted to open an encrypted
message that contained an attachment and either (a) you had not yet entered
your personal security password during the current Communicator session
or (b) you hade selected the option "Every time your certificate is requested"
in the Personal Security Password window (available from the Mine panel
of the Certificates tab). This problem has been fixed in this release.
-
With release 1.0, it was not possible to set a personal security password
of zero length (blank password) or to import a certificate backup file
with a portable security password of zero length. This problem has been
fixed in this release. However, Netscape does not recommend the use of
blank passwords, and it is not possible to set a portable security password
of zero length.
-
Certificate authority nicknames that include the character ":" did not
work correctly in release 1.0. This problem has been fixed in this release.
-
The Personal Security Manager Deployment Guide was included with the other
documentation that shipped with Personal Security Manager 1.0. This release
does not include this document. For latest version of the deployment guide
and these release notes, see the link to Personal Security Manager documentation
at http://developer.iPlanet.com/docs/manuals/cms.html.
Software/Hardware
Requirements
Operating systems supported: Windows NT, Windows 95, Windows 98,
Solaris 2.6, and Linux 2.1 and 2.2.
Other software requirements:
You must use Communicator 4.7 or later versions. Get the latest version
of Communicator from http://home.netscape.com
before proceeding.
If you are running Comunicator 4.7, Personal Security Manager requires
that Communicator have JavaScript turned on. If you are running later versions
of Communicator, Personal Security Mnaager works regardless of whether
JavaScript is turned on.
If you are running Communicator 4.71, you must use Personal Security Manager
1.01. Communicator 4.71 and Personal Security Manager 1.0 do not work correctly
together. Other combinations, including Communicator 4.7/Personal Security
Manager 1.01 and Communicator 4.7/Personal Security Manager 1.0, work correctly.
Installing Personal Security Manager
Important: If you have installed earlier releases of Personal Security
Manager, you should delete the psm directory before installing
release 1.01. The psm directory required for previous releases
was located in the Netscape program directory on Windows 95/98/NT (default
location C:\Program Files\Netscape\Communicator\Program), and
in the directory where the Netscape executable resides on Unix.
To install Personal Security Manager on Windows 95/98/NT, simply click
the SmartUpdate link for the version of the product that you want to install.
If your copy of Communicator is installed in the default location, SmartUpdate
installs the Personal Security Manager files in the directory C:\Program
Files\Common Files\Netscape Shared\Security\ and adds the file cmnav.dll
in the directory C:\Program Files\Netscape\Communicator\Program.
Important: On Windows NT, you must have administrator privileges
to install Personal Security Manager using SmartUpdate.
Before you install Personal Security Manager on Unix, you must be logged
in as the same Unix user you will be logged in as when you run Communicator.
For the Unix installation to succeed, you must have write privileges for
both the directory where the Netscape executable resides and the directory
where the installation script creates the directory containing the Personal
Security Manager files.
To install Personal Security Manager on Unix, download the tar file
for the version of the product that you want to install and follow these
steps:
-
Exit Communicator, if it is running.
-
Decompress the downloaded file to some convenient location.
-
Run the psm-install program.
The psm-install program allows you to specify the directory in
which Personal Security Manager will be installed. In this release, you
must install Personal Security Manager locally. To do so, you can either
install it in the default location (/opt/netscape/security) or
in some other local location. However, if you install Personal Security
Manager anywhere other than the default location, Communicator must also
be installed locally.
To run Personal Security Manager on Unix, you must be logged in as the
same Unix user you were logged in as when you installed it.
You are now ready to begin using Personal Security Manager.
To disable Personal Security Manager temporarily, simply rename
the file cmnav.dll (in the Netscape program directory on Windows
95/98/NT, or the directory in which your Netscape executable resides on
Unix) to some other name, such as cmnav.txt. On Unix, you can
also rename the file cmnav.so to some other name to disable Personal
Security Manager.
Using Personal Security Manager
The sections that follow describe how to test some of the features of Personal
Security Manager that are available with this release:
The sections that follow briefly describe how to test some of the features
listed above.
For information on the JavaScript API supported by Personal Security
Manager, see JavaScript API for Client
Certificate Management and the Personal Security Manager Deployment
Guide. For the latest version of the deployment guide, see the link to
Personal Security Manager documentation at http://developer.iPlanet.com/docs/manuals/cms.html.
Start Up Personal
Security Manager with Communicator
Follow these steps to start Personal Security Manager with Communicator.
-
Launch Communicator. Personal Security Manager will silently load in the
background.
-
Go to the page psmtest.html (in the same directory
as these release notes), then choose Page Source from the View menu to
see the JavaScript code that a web programmer can use to detect Personal
Security Manager and its version number.
Note that the version number has two parts. The first is the version of
the PSM client library, and the second is the version of the PSM server
library.
Test Basic SSL
Go to any online store, banking service, brokerage account, or other web
site that supports SSL. Verify that the lock in the lower-left corner of
the browser window is closed when you reach the pages for which SSL should
be enabled, for example a page where you are asked to give your credit
card number.
Get an SSL Client Certificate
Go to any public or private CA and apply for an SSL client certificate.
To test one-click certificate issuance, dual key-pair certificates,
and other Personal Security Manager features with Netscape Certificate
Management System 4.2, system administrators must first download, install,
and configure Netscape Certificate Management System 4.2. See the Personal
Security Manager Deployment Guide for details. For complete CMS documentation
and other information, see http://developer.iPlanet.com/docs/manuals/cms.html
(this page includes a link to the latest Personal Security Manager documentation).
To download Certificate Management System 4.2, see http://home.netscape.com/testdrive/download/.
View Your Certificate
After you have obtained a certificate, follow these steps to view it:
-
Click the Security icon in the Navigator toolbar.
-
Click the Certificates tab.
-
Click to select your certificate.
-
Click View.
You should see information about your new certificate.
Test
Client Authentication
Personal Security Manager allows the SSL server and client to negotiate
which certificate to use, and in most cases they can agree on a single
correct certificate for the client to present. When this happens, the user
can access an SSL site that requires client authentication with zero additional
clicks.
To test client authentication with Netscape Enterprise Server, system
administrators should follow these steps:
-
Install an Enterprise Server and configure it for client authentication
as described in Appendix
E, Using SSL with Enterprise Server 3.x, of Netscape Certificate
Management System Installation and Deployment Guide.
-
Test the Enterprise Server installation as described at the end of Appendix
E using Personal Security Manager.
Request and
Use Separate Signing and Encryption Certificates ("Dual Key-Pair Certificates")
Separate signing and encryption certificates, sometimes called "dual key-pair
certificates," are specialized certificates used only with S/MIME. The
term "dual key pair" refers to the fact that two public-private key pairs--four
keys altogether--correspond to two separate certificates. The private key
of one pair is used for email signing operations, and the public and private
keys of the other pair are used for email encryption and decryption operations.
Each pair corresponds to a separate certificate.
In the past, Communicator has supported the signing and encryption functions
for S/MIME with a single, combined signing and encryption certificate.
This version of Personal Security Manager allows you to request dual
key-pair certificates from a single, specially configured enrollment page
provided by Netscape Certificate Management System. The resulting certificates
are combined under a single nickname in the Certificates/Mine panel displayed
by Personal Security Manager. (To see this panel after Personal Security
Manager is installed, click the Security button in the Communicator toolbar,
then click the Certificates tab.) When you select a nickname that represents
a pair of related signing and encryption certificates, then click View
or other buttons that act on the selection, a dialog box allows you to
select which certificate you want to act on.
For instructions on configuring Certificate Management System to issue
dual key-pair certificates and to archive the private encryption key, see
Chapter
25, Recovering Encrypted Data, in Netscape Certificate Management System
Administrator's Guide. For a more general description of the steps involved,
see the Personal Security Manager Deployment Guide (see the link to Personal
Security Manager documentation at http://developer.iPlanet.com/docs/manuals/cms.html).
Once you have obtained your dual key-pair certificates, you can use
them with Personal Security Manager to sign and encrypt email. You can
also back them up and import them using buttons in the Certificates/Mine
panel, and set the certificate you want to use for signing in the Applications/Messenger
panel.
Validate Certificates Using
OSCP
Personal Security Manager supports the use of the On-Line Certificate Status
Protocol (OSCP) to check the validity of certificates in real time. For
information about this protocol and how configure Personal Security Manager
1.01 and Certificate Management System 4.2 to support it, see the Personal
Security Manager Deployment Guide (see the link to Personal Security Manager
documentation from http://developer.iPlanet.com/docs/manuals/cms.html).
Fetch Certificates
Automatically from a Directory
Personal Security Manager can search a specified directory for the certificate
associated with an email address. This search is performed automatically
when you send a message (but note that it doesn't work over SSL in this
release; see Known Bugs/Issues
for 1.01. Release).
To activate this feature, you must specify a directory server to search.
To do so, choose Preferences from the File menu in Communicator, then click
Addressing under Mail & Newsgroups. In the right panel, click Directory
Server under Pinpoint Addressing, select the directory you want to use
from the drop-down menu, and click OK. Personal Security Manager uses this
directory for automatic certificate lookups when you send an encrypted
email message.
If the directory you want doesn't show up in the drop-down menu under
Pinpoint Addressing, you can add it to your list of directories using the
Communicator Address Book. To do so, choose Address Book from the Communicator
menu, then choose New Directory from the File menu. You must then add information
about the directory you want to add. Once the directory has been added
to the Address book, you can specify it in your preferences as described
above.
Known Bugs/Issues for Personal
Security Manager 1.01
-
FORTEZZA is not guaranteed to work with this release. [# 94220]
-
LDAP over SSL does not work for address book lookups, pinpoint addressing,
or automatic certificate fetching. That is, if you choose Address Book
from the Communicator menu, select a directory in the left frame, and click
the Properties button, the checkbox labeled Secure must not be selected.
If Secure is selected, address book lookups for that directory will not
work. Similarly, if the same Secure checkbox is selected for a directory
that is also specified for pinpoint addressing, pinpoint addressing and
automatic certificate lookups won't work. To view pinpoint addressing settings,
choose Preferences from the Edit menu in Communicator and select Addressing
under Mail & Newsgroups. [# 364811]
-
Secure proxy does not work with this release. [# 362464] HTTP proxy does
work, but you must configure the appropriate Communicator preferences as
follows:
-
Choose Preferences from the Edit menu, then click the plus sign beside
Advanced, then click Proxies.
-
In the Proxies panel, click "Manual proxy configuration." You must configure
the proxy manually.
-
Click View to see the proxy configurations.
-
In the Manual Proxy Configuration dialog box, enter the hostname for the
HTTP proxy you want to use in the field labeled HTTP, and the port number
in the corresponding port field. Then, enter 127.0.0.1 in the
field at the bottom labeled "Exceptions/Do not use proxy servers for domains
beginning with:" (plus other names of other hosts, if necessary, that you
don't want to use a proxy server to reach). This number identifies the
local host, which cannot use a proxy server (or else Personal Security
Manager won't work). Do not enter anything in the field labeled "Security."
-
When you send signed or encrypted email, Personal Security Manager may
occasionally cause Communicator to lock up for one or two minutes while
displaying "Assembling message..." at the bottom of the message window.
[383114]
-
In some unusual circumstances you may encounter problems such as valid
certificates not being verified or Communicator freezing up. If you encounter
a problem that doesn't appear to have a logical explanation, try the following
as a last resort:
-
Exit Communicator, then relaunch it. If necessary, use Control-Alt-Delete
on Windows 95/98/NT to bring up the Task Manager and click End Process
for both psm.exe and netscape.exe.
-
Warning: Before taking this step, back up your own certificates
stored internally by Personal Security Manager. If exiting and relaunching
Communicator doesn't take care of the problem, in some rare cases it may
work to exit Communicator, then delete or rename your cert7.db
and key3.db files (located in your user profile directory on Windows
95/98/NT, or in the directory in which the Netscape executable resides
on Unix) and relaunch the Communicator. You should also look for all other
files in the same directory that begin with cert or key
and end in .db and delete those files as well before relaunching
Communicator.
Feedback
To send feedback to the Personal Security Manager development team, send
email to psmfeedback@netscape.com.
Feedback back sent to this address will be read by the team, but you will
not receive a personal response.