1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
|
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"[
<!ENTITY % brandDTD SYSTEM "chrome://branding/locale/brand.dtd" >
%brandDTD;
]>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Using Certificates</title>
<link rel="stylesheet" href="helpFileLayout.css"
type="text/css"/>
</head>
<body>
<h1 id="using_certificates">Using Certificates</h1>
<p>A certificate is the digital equivalent of an ID card. Just as you may have
several ID cards for different purposes, such as a driver's license, an
employee ID card, or a credit card, you can have several different
certificates that identify you for different purposes.</p>
<p>This section describes how to perform operations related to
certificates.</p>
<div class="contentsBox">In this section:
<ul>
<li><a href="#getting_your_own_certificate">Getting Your Own
Certificate</a></li>
<li><a href="#checking_security_for_a_web_page">Checking Security for a Web
Page</a></li>
<li><a href="#managing_certificates">Managing Certificates</a></li>
<li><a href="#managing_smart_cards_and_other_security_devices">Managing
Smart Cards and Other Security Devices</a></li>
<li><a href="#managing_ssl_warnings_and_settings">Managing SSL Warnings and
Settings</a></li>
<li><a href="#controlling_validation">Controlling Validation</a></li>
</ul>
</div>
<h1 id="getting_your_own_certificate">Getting Your Own Certificate</h1>
<p>Much like a credit card or a driver's license, a certificate is a form
of identification you can use to identify yourself over the Internet and
other networks. Like other commonly used personal IDs, a certificate is
typically issued by an organization with recognized authority to issue such
identification. An organization that issues certificates is called a
<strong>certificate authority (CA)</strong>.</p>
<p>You can obtain certificates that identify you from public CAs, from system
administrators or special CAs within your organization, or from websites
offering specialized services that require a means of identification more
reliable that your name and password.</p>
<p>Just as the requirements for a driver's license vary depending on the
type of vehicle you want to drive, the requirements for obtaining a
certificate vary depending on what you want to use it for. In some cases
getting a certificate may be as easy as going to a website, entering some
personal information, and automatically downloading the certificate into your
browser. In other cases you may have to go through more complicated
procedures.</p>
<p>You can obtain a certificate today by visiting the URL for a certificate
authority and following the on-screen instructions. For a list of certificate
authorities issuing certificates recognized by &brandShortName;, see the
online document
<a href="http://www.mozilla.org/projects/security/certs/included/">Included
Certificate List</a>.</p>
<p>Once you obtain a certificate, it is automatically stored in a
<a href="glossary.xhtml#security_device">security device</a>. Your browser
comes with its own built-in Software Security Device. A security device can
also be a piece of hardware, such as a smart card.</p>
<p>Like a driver's license or a credit card, a certificate is a valuable
form of identification that can be abused if it falls into the wrong hands.
Once you've obtained a certificate that identifies you, you should
protect it in two ways: by backing it up and by setting your
<a href="glossary.xhtml#master_password">master password</a>.</p>
<p>When you first obtain a certificate, you may be prompted to back it up. If
you haven't yet created a master password, you will be asked to create
one.</p>
<p>For detailed information about backing up a certificate and setting your
master password, see <a href="certs_help.xhtml#your_certificates">Your
Certificates</a>.</p>
<p>[<a href="#using_certificates">Return to beginning of section</a>]</p>
<h1 id="checking_security_for_a_web_page">Checking Security for a Web Page</h1>
<p>When you're viewing any web page, the lock icon near the lower-right
corner of the window informs you whether the entire contents of the page was
protected by <a href="glossary.xhtml#encryption">encryption</a> while it was
being received by your computer:</p>
<table summary="lock icons">
<tr>
<td><img alt="closed lock icon"
src="chrome://communicator/skin/icons/lock-secure.png"/></td>
<td>A closed lock means that the page was protected by encryption when it
was received.</td>
</tr>
<tr>
<td><img alt="open lock icon"
src="chrome://communicator/skin/icons/lock-insecure.png"/></td>
<td>An open lock means the page was not protected by encryption when it was
received.</td>
</tr>
<tr>
<td><img alt="broken lock icon"
src="chrome://communicator/skin/icons/lock-broken.png"/></td>
<td>A broken lock means that some or all of the elements within the page
were not protected by encryption when the page was received, even though
the outermost HTML page was encrypted.</td>
</tr>
</table>
<p>For more details about the encryption status of the page when it was
received, click the lock icon (or open the View menu, choose Page Info, and
click the Security tab).</p>
<p>The Security tab for Page Info provides two kinds of information:</p>
<ul>
<li>The top half describes whether the website displaying the page has been
verified. (For information on certificate verification, see
<a href="#controlling_validation">Controlling Validation</a>.)</li>
<li>The bottom half describes whether the contents of the page you are
viewing is protected by encryption while in transit over the network.</li>
</ul>
<p><strong>Important</strong>: The lock icon describes only the encryption
status of the page while it was being received by your computer. To be
notified when you send or receive information without encryption, or to
block potentially harmful mixed content, select the appropriate SSL warning
and mixed content options. See <a href="ssl_help.xhtml">Privacy &
Security Preferences - SSL</a> for details.</p>
<p>[<a href="#using_certificates">Return to beginning of section</a>]</p>
<h1 id="managing_certificates">Managing Certificates</h1>
<p>You can use the Certificate Manager to manage the certificates you have
available. Certificates may be stored on your computer's hard disk or on
<a href="glossary.xhtml#smart_card">smart cards</a> or other security devices
attached to your computer.</p>
<p>To open the Certificate Manager:</p>
<ol>
<li>Open the <span class="mac">&brandShortName;</span>
<span class="noMac">Edit</span> menu and choose Preferences.</li>
<li>Under the Privacy & Security category, click Certificates. (If no
subcategories are visible, double-click Privacy & Security to expand
the list.)</li>
<li>In the Manage Certificates section, click Manage Certificates. You see
the Certificate Manager.</li>
</ol>
<div class="contentsBox">In this section:
<ul>
<li><a href="#managing_certificates_that_identify_you">Managing
Certificates that Identify You</a></li>
<li><a href="#managing_certificates_that_identify_people">Managing
Certificates that Identify People</a></li>
<li><a href="#managing_certificates_that_identify_servers">Managing
Certificates that Identify Servers</a></li>
<li><a href="#managing_certificates_that_identify_certificate_authorities">Managing
Certificates that Identify Certificate Authorities</a></li>
<li><a href="#managing_certificates_that_identify_others">Managing
Certificates that Identify Others</a></li>
</ul>
</div>
<h2 id="managing_certificates_that_identify_you">Managing Certificates that
Identify You</h2>
<p>When you first open the Certificate Manager, you'll notice that it has
several tabs across the top of its window. The first tab is called Your
Certificates, and it displays the certificates your browser or mail client
has available that identify you. Your certificates are listed under the names
of the organizations that issued them.</p>
<p>To perform an action on one or more certificates, click the entry for the
certificate (or <kbd class="mac">Cmd</kbd><kbd class="noMac">Ctrl</kbd>-click
to select more than one), then click one of the buttons at the bottom of the
Certificate Manager window. Each of these buttons brings up another window
that allows you to perform the action. Click the Help button in any window to
obtain more information about using that window.</p>
<p>For more details on how to view and manage these certificates, see
<a href="certs_help.xhtml#your_certificates">Your Certificates</a>.</p>
<p>[<a href="#managing_certificates">Return to beginning of section</a>]</p>
<h2 id="managing_certificates_that_identify_people">Managing Certificates that
Identify People</h2>
<p>When you compose a mail message, you can choose to attach your digital
signature to it. A <a href="glossary.xhtml#digital_signature">digital
signature</a> allows recipients of the message to verify that the message
really comes from you and hasn't been tampered with since you sent
it.</p>
<p>Every time you send a digitally signed message, your encryption certificate
is automatically included with the message. This certificate allows the
message recipients to send you encrypted messages.</p>
<p>One of the easiest ways to obtain someone else's encryption certificate
is for that person to send you a digitally signed message. Certificate
Manager automatically stores other people's certificates whenever they
are received in this way.</p>
<p>To view all the certificates identifying other people that are available to
the Certificate Manager, click the People tab at the top of the
Certificate Manager window. You can send encrypted messages to anyone for
whom a valid certificate is listed. Certificates are listed under the names
of the organizations that issued them.</p>
<p>To perform an action on one or more certificates, click the entry for the
certificate (or <kbd class="mac">Cmd</kbd><kbd class="noMac">Ctrl</kbd>-click
to select more than one), then click one of the buttons at the bottom of the
Certificate Manager window. Each of these buttons brings up another window
that allows you to perform the action. Click the Help button in any window to
obtain more information about using that window.</p>
<p>For more details on how to view and manage these certificates, see the
description of the Certificate Manager's
<a href="certs_help.xhtml#people">People</a> tab.</p>
<p>[<a href="#managing_certificates">Return to beginning of section</a>]</p>
<h2 id="managing_certificates_that_identify_servers">Managing Certificates
that Identify Servers</h2>
<p>Some websites and mail servers use certificates to identify themselves.
Such identification is required before the server can encrypt information
transferred between it and your computer (or vice versa), so that no one
can read the data while in transit.</p>
<p>If the URL for a website begins with <tt>https://</tt>, the website has a
certificate. If you visit such a website and its certificate was issued by a
CA that the Certificate Manager doesn't know about or doesn't
trust, you will be asked whether you want to accept the website's
certificate. When you accept a new website certificate, the Certificate
Manager adds it to its list of website certificates.</p>
<p>To view all the website certificates available to your browser, click the
Servers tab at the top of the Certificate Manager window.</p>
<p>To perform an action on one or more certificates, click the entry for the
certificate (or <kbd class="mac">Cmd</kbd><kbd class="noMac">Ctrl</kbd>-click
to select more than one), then click one of the buttons at the bottom of the
Certificate Manager window. Each of these buttons brings up another window
that allows you to perform the action. Click the Help button in any window to
obtain more information about using that window.</p>
<p>For more details on how to view and manage these certificates, see the
description of the Certificate Manager's
<a href="certs_help.xhtml#servers">Servers</a> tab.</p>
<p>[<a href="#managing_certificates">Return to beginning of section</a>]</p>
<h2 id="managing_certificates_that_identify_certificate_authorities">Managing
Certificates that Identify Certificate Authorities</h2>
<p>Like other commonly used forms of ID, a certificate is issued by an
organization with recognized authority to issue such identification. An
organization that issues certificates is called a
<a href="glossary.xhtml#certificate_authority">certificate authority
(CA)</a>. A certificate that identifies a CA is called a CA certificate.</p>
<p>Certificate Manager typically has many CA certificates on file. These CA
certificates permit Certificate Manager to recognize and work with
certificates issued by the corresponding CAs. However, the presence of a CA
certificate in this list does <em>not</em> guarantee that the certificates it
issues can be trusted. You or your system administrator must make decisions
about what kinds of certificates to trust depending on your security
needs.</p>
<p>To view all the CA certificates available to your browser, click the
Authorities tab at the top of the Certificate Manager window.</p>
<p>To perform an action on one or more CA certificates, click the entry for the
certificate (or <kbd class="mac">Cmd</kbd><kbd class="noMac">Ctrl</kbd>-click
to select more than one), then click one of the buttons at the bottom of the
Certificate Manager window. Each of these buttons brings up another window
that allows you to perform the action. Click the Help button in any window to
obtain more information about using that window.</p>
<p>For more details on how to view and manage these certificates, see the
description of the Certificate Manager's
<a href="certs_help.xhtml#authorities">Authorities</a> tab.</p>
<p>[<a href="#managing_certificates">Return to beginning of section</a>]</p>
<h2 id="managing_certificates_that_identify_others">Managing Certificates that
Identify Others</h2>
<p>To see all certificates that do not fit into any of the other categories,
click the Others tab at the top of the Certificate Manager window.</p>
<p>For more details on how to view and manage these certificates, see the
description of the Certificate Manager's
<a href="certs_help.xhtml#others">Others</a> tab.</p>
<p>[<a href="#managing_certificates">Return to beginning of section</a>]</p>
<h1 id="managing_smart_cards_and_other_security_devices">Managing Smart Cards
and Other Security Devices</h1>
<p>A smart card is a small device, typically about the size of a credit card,
that contains a microprocessor and is capable of storing information about
your identity (such as your <a href="glossary.xhtml#private_key">private
keys</a> and <a href="glossary.xhtml#certificate">certificates</a>) and
performing cryptographic operations.</p>
<p>To use a smart card, you typically need to have a smart card reader (a piece
of hardware) attached to your computer, as well as software on your computer
that controls the reader.</p>
<p>A smart card is just one kind of security device. A security device
(sometimes called a token) is a hardware or software device that provides
cryptographic services and stores information about your identity. Use the
Device Manager to work with smart cards and other security devices.</p>
<div class="contentsBox">In this section:
<ul>
<li><a href="#about_security_devices_and_modules">About Security Devices
and Modules</a></li>
<li><a href="#using_security_devices">Using Security Devices</a></li>
<li><a href="#using_security_modules">Using Security Modules</a></li>
<li><a href="#enable_fips_mode">Enable FIPS Mode</a></li>
</ul>
</div>
<h2 id="about_security_devices_and_modules">About Security Devices and
Modules</h2>
<p>The Device Manager displays a window that lists the available security
devices. You can use the Device Manager to manage any security devices,
including smart cards, that support the Public Key Cryptography Standard
(PKCS) #11.</p>
<p>A <a href="glossary.xhtml#pkcs_11_module">PKCS #11 module</a> (sometimes
called a security module) controls one or more security devices in much the
same way that a software driver controls an external device such as a printer
or modem. If you are installing a smart card, you must install the PKCS #11
module for the smart card on your computer as well as connecting the smart
card reader.</p>
<p>By default, the Device Manager controls two internal PKCS #11 modules that
manage three security devices:</p>
<ul>
<li><strong>&brandShortName; Internal PKCS #11 Module</strong>: Controls two
security devices:
<ul>
<li><strong>Generic Crypto Services</strong>: A special security device
that performs all cryptographic operations required by the
&brandShortName; Internal PKCS #11 Module.</li>
<li><strong>Software Security Device</strong>: Stores your certificates
and keys that aren't stored on external security devices,
including any CA certificates that you may have installed in addition
to those that come with the browser.</li>
</ul>
</li>
<li><strong>Builtin Roots Module</strong>: Controls a special security device
called the Builtin Object Token. This security device stores the default
<a href="glossary.xhtml#ca_certificate">CA certificates</a> that come with
the browser.</li>
</ul>
<p>[<a href="#managing_smart_cards_and_other_security_devices">Return to
beginning of section</a>]</p>
<h2 id="using_security_devices">Using Security Devices</h2>
<p>The Device Manager allows you to perform operations on security devices. To
open the Device Manager, follow these steps:</p>
<ol>
<li>Open the <span class="mac">&brandShortName;</span>
<span class="noMac">Edit</span> menu and choose Preferences.</li>
<li>Under the Privacy & Security category, click Certificates. (If no
subcategories are visible, double-click Privacy & Security to expand
the list.)</li>
<li>In the Certificates panel, click Manage Security Devices.</li>
</ol>
<p>The Device Manager lists each available PKCS #11 module in boldface, and the
security devices managed by each module below its name.</p>
<p>When you select a security device, information about it appears in the
middle of the Device Manager window, and some of the buttons on the right
side of the window become available. For example, if you select the Software
Security Device, you can perform these actions:</p>
<ul>
<li>Click Login or Logout to log in or out of the Software Security Device.
If you are logging in, you will be asked to supply the master password for
the device. You must be logged into a security device before your browser
software can use it to provide cryptographic services.</li>
<li>Click Change Password to change the master password for the device.</li>
</ul>
<p>You can perform these actions on most security devices. However, you cannot
perform them on the Builtin Object Token or Generic Crypto Services, which
are special devices that must normally be available at all times.</p>
<p>For more details, see <a href="certs_help.xhtml#device_manager">Device
Manager</a>.</p>
<p>[<a href="#managing_smart_cards_and_other_security_devices">Return to
beginning of section</a>]</p>
<h2 id="using_security_modules">Using Security Modules</h2>
<p>If you want to use a smart card or other external security device, you must
first install the module software on your computer and, if necessary, connect
any associated hardware. Follow the instructions that come with the
hardware.</p>
<p>After a new module is installed on your computer, follow these steps to load
it:</p>
<ol>
<li>Open the <span class="mac">&brandShortName;</span>
<span class="noMac">Edit</span> menu and choose Preferences.</li>
<li>Under the Privacy & Security category, click Certificates. (If no
subcategories are visible, double-click Privacy & Security to expand
the list.)</li>
<li>In the Certificates panel, click Manage Security Devices.</li>
<li>Click Load.</li>
<li>In the Load PKCS #11 Module dialog box, click the Browse button, locate
the module file, and click Open.</li>
<li>Fill in the Module Name field with the name of the module and click
OK.</li>
</ol>
<p>The new module will then show up in the list of modules with the name you
assigned to it.</p>
<p>To unload a PKCS #11 module, select its name and click Unload.</p>
<p>[<a href="#managing_smart_cards_and_other_security_devices">Return to
beginning of section</a>]</p>
<h2 id="enable_fips_mode">Enable FIPS Mode</h2>
<p>Federal Information Processing Standards Publications (FIPS PUBS) 140-1 is a
US government standard for implementations of cryptographic
modules—that is, hardware or software that encrypts and decrypts data
or performs other cryptographic operations (such as creating or verifying
digital signatures). Many products sold to the US government must comply with
one or more of the FIPS standards.</p>
<p>To enable FIPS mode for the browser, you use the Device Manager:</p>
<ol>
<li>Open the <span class="mac">&brandShortName;</span>
<span class="noMac">Edit</span> menu and choose Preferences.</li>
<li>Under the Privacy & Security category, click Certificates. (If no
subcategories are visible, double-click Privacy & Security to expand
the list.)</li>
<li>In the Certificates panel, click Manage Devices.</li>
<li>Click the Enable FIPS button. When FIPS is enabled, the name NSS Internal
PKCS #11 Module changes to NSS Internal FIPS PKCS #11 Module and the Enable
FIPS button changes to Disable FIPS.</li>
</ol>
<p>To disable FIPS-mode, click Disable FIPS.</p>
<p>[<a href="#managing_smart_cards_and_other_security_devices">Return to
beginning of section</a>]</p>
<h1 id="managing_ssl_warnings_and_settings">Managing SSL Warnings and
Settings</h1>
<p>The Secure Sockets Layer (SSL) protocol allows your computer to exchange
information with other computers on the Internet in encrypted form—that
is, the information is scrambled while in transit so that no one else can
make sense of it. SSL is also used to identify computers on the Internet by
means of <a href="glossary.xhtml#certificate">certificates</a>.</p>
<p>The Transport Layer Security (TLS) protocol is a new standard based on SSL.
By default, the browser supports both SSL and TLS. This approach works for
most people, because it guarantees that the browser will work with virtually
all other existing software on the Internet that supports any version of SSL
or TLS.</p>
<p>However, in some circumstances system administrators or other knowledgeable
persons may wish to adjust the SSL settings to fine-tune them for special
security needs or to account for bugs in some older software products.</p>
<p>You shouldn't adjust the SSL settings for your browser unless you know
what you're doing or have the assistance of someone else who does. If
you do need to adjust them for some reason, follow these steps:</p>
<ol>
<li>Open the <span class="mac">&brandShortName;</span>
<span class="noMac">Edit</span> menu and choose Preferences.</li>
<li>Under the Privacy & Security category, select SSL. (If no
subcategories are visible, double-click Privacy & Security to expand
the list.)</li>
</ol>
<p>For more details, see <a href="ssl_help.xhtml">SSL Settings</a>.</p>
<p>[<a href="#using_certificates">Return to beginning of section</a>]</p>
<h1 id="controlling_validation">Controlling Validation</h1>
<p>As discussed above under <a href="#getting_your_own_certificate">Get Your
Own Certificate</a>, a certificate is a form of identification, much like a
driver's license, that you can use to identify yourself over the
Internet and other networks. However, also like a driver's license, a
certificate may expire or become invalid for some other reason. Therefore,
your browser software needs to confirm the validity of any given certificate
in some way before trusting it for identification purposes.</p>
<p>This section describes how Certificate Manager validates certificates and
how to control that process. To understand the process, you should have some
familiarity with <a href="glossary.xhtml#public-key_cryptography">public-key
cryptography</a>. If you are not familiar with the use of certificates, you
should check with your system administrator before attempting to change any
of your browser's certificate validation settings.</p>
<div class="contentsBox">In this section:
<ul>
<li><a href="#how_validation_works">How Validation Works</a></li>
<li><a href="#configuring_ocsp">Configuring OCSP</a></li>
</ul>
</div>
<h2 id="how_validation_works">How Validation Works</h2>
<p>Whenever you use or view a certificate stored by Certificate Manager, it
takes several steps to verify the certificate. At a minimum, it confirms that
the CA's digital signature on the certificate was created by a CA whose
own certificate is (1) present in the Certificate Manager's list of
available CA certificates and (2) marked as trusted for issuing the kind of
certificate being verified.</p>
<p>If the CA certificate is not itself present, the
<a href="glossary.xhtml#certificate_chain">certificate chain</a> for the CA
certificate must include a higher-level CA certificate that is present and
correctly trusted. Certificate Manager also confirms that the certificate
being verified is currently marked as trusted in the certificate store. If
any one of these checks fails, Certificate Manager marks the certificate as
unverified and won't recognize the identity it certifies.</p>
<p>A certificate can pass all these tests and still be compromised in some way;
for example, the certificate may be revoked because an unauthorized person
has gained access to the certificate's private key. A compromised
certificate can allow an unauthorized person (or website) to pretend to be
the certificate owner.</p>
<p>One way to combat this threat would be for Certificate Manager to check a
previously downloaded certificate revocation list (CRL) as part of the
verification process. However, those lists may be large and need to be
updated frequently in order to remain current and thus useful.</p>
<p>The preferred way to combat the threat of compromised certificates is to use
a special server that supports the Online Certificate Status Protocol (OCSP).
Such a server can answer client queries about individual certificates (see
<a href="#configuring_ocsp">Configuring OCSP</a>, below).</p>
<p>The server, called an OCSP responder, receives an updated CRL periodically
from the CA that issues the certificates to be verified. You can configure
Certificate Manager to submit a status request for a certificate to the OCSP
responder, and the OCSP responder confirms whether the certificate is
valid.</p>
<p>[<a href="#controlling_validation">Return to beginning of section</a>]</p>
<h2 id="configuring_ocsp">Configuring OCSP</h2>
<p>The settings that control OCSP are part of Certificates preferences. To view
Certificates preferences, follow these steps:</p>
<ol>
<li>Open the <span class="mac">&brandShortName;</span>
<span class="noMac">Edit</span> menu and choose Preferences.</li>
<li>Under the Privacy & Security category, click Certificates. (If no
subcategories are visible, double-click Privacy & Security to expand
the list.)</li>
</ol>
<p>For information about the OCSP options available, see
<a href="certs_prefs_help.xhtml#ocsp">Privacy & Security Preferences -
Certificates, OCSP</a>.</p>
<p>[<a href="#controlling_validation">Return to beginning of section</a>]</p>
</body>
</html>
|
