Personal Security Manager Release Notes
Author: Sean Cotter

#

## Netscape Personal Security Manager

## Release 1.3

## 9/18/2000

These release notes contain the most recent information about this release of Netscape Personal Security Manager. Please read these notes before using the software.

These notes include information for IS professionals who are thoroughly familiar with security and public-key infrastructure (PKI) issues.

Use of this product is subject to the terms detailed in the license agreement accompanying Netscape 6 PR3.

## Contents

Documentation
Changes Since Personal Security Manager 1.2
Software/Hardware Requirements
Installing Personal Security Manager
Using Personal Security Manager
Known Bugs/Issues for Personal Security Manager 1.3
Feedback

## Documentation

The following documentation is available with Personal Security Manager:

- Personal Security Manager Help -- This online help system can also be accessed by clicking the Help button in any personal Security Manager window.
- JavaScript API for Client Certificate Management -- This reference describes a new Javascript API for performing user certificate management operations with Personal Security Manager, including one-click issuance, forced certificate backup by end users, and automatic archival of encryption private keys.

For the latest release notes, deployment guide, and other information, see http://docs.iPlanet.com/docs/manuals/psm.html.

## Changes Since Personal Security Manager 1.2

The Transport Layer Security (TLS) protocol is turned on by default in Personal Security Manager 1.3. TLS is an IETF standard based on the Secure Sockets Layer (SSL) protocol.

Most other changes since Personal Security Manager 1.2 involve minor bug fixes and optimizations.

Netscape 6 and Mozilla do not supported signed or encrypted email. For this reason, features related to email certificates are not available in this release.

#### Software/Hardware Requirements

Operating systems supported: Windows NT, Windows 95, Windows 98 Windows 2000; Solaris 2.6, 2.7, 2.8; and Red Hat Linux 6.1.

Other software requirements: This release has been tested with Mozilla and Netscape 6. It is not intended for use with Communicator.

## Installing Personal Security Manager

Personal Security Manager 1.3 is installed with Netscape 6 PR3. To install Personal Security Manager 1.3 with Mozilla, see http://docs.iplanet.com/docs/manuals/psm/psm-mozilla/index.html.

The sections that follow describe how the Personal Security Manager files are installed with Netscape 6 PR3.

### Installing on Windows 95/98/2000/NT

When you install Netscape 6 PR3 on Windows, Personal Security Manager is installed in the directory `C:\Program Files\Common Files\Netscape Shared\Security\`.

All Windows users: Personal Security Manager 1.3 works with Mozilla and Netscape 6, but it is not currently supported for Communicator 4.x. Therefore, you should not attempt to run Personal Security Manager 1.3 with Communicator 4.x.

If you have Personal Security Manager 1.2 installed for use with Communicator 4.x and you want to install Netscape 6 PR3, you should first exit Communicator, then rename the directory `C:\Program Files\Common Files\Netscape Shared\Security\` to something else, such as `SecurityC47`. When you install Netscape 6, a new `Security` directory will be created during the installation process.

If you want to run Communicator 4.x with Personal Security Manager 1.2 after Netscape 6 PR3 has been installed, you should first exit Netscape 6, then rename the `Security` directory (which now contains the Personal Security Manager 1.3 files) to something else (such as `SecurityN6`) and rename your `SecurityC47` directory (which contains the Personal Security Manager 1.2 files) to Security. You can then launch Communicator as usual.

### Installing on Unix

When you install Netscape 6 PR3 on Unix, Personal Security Manager is installed in a directory called `psm` in the same directory where the `netscape` executable resides.

### Disabling Personal Security Manager

To disable Personal Security Manager temporarily, exit Netscape 6, then:

- on Unix, remove the directory `psm` from the directory where the `netscape` executable resides.
- on Windows, rename the directory `C:\Program Files\Common Files\Netscape Shared\Security` to something else.

## Using Personal Security Manager

The sections that follow describe how to test some of the features of Personal Security Manager that are available with this release:

- Start Up Personal Security Manager with Netscape 6
- Test Basic SSL
- Get an SSL Client Certificate
- View Your Certificate
- Test Client Authentication
- Validate Certificates Using OCSP

The sections that follow briefly describe how to test some of the features listed above.

For information on the JavaScript API supported by Personal Security Manager, see JavaScript API for Client Certificate Management and the Personal Security Manager Deployment Guide. For the latest versions of these documents, see http://docs.iPlanet.com/docs/manuals/psm.html.

### Use Personal Security Manager with Netscape 6

Personal Security Manager starts automatically the first time Netscape 6 needs to perform some action involving security, such as handling an SSL session.

Follow these steps to view your security settings and confirm that Personal Security Manager is running:

1. Launch Netscape 6.
2. Choose Security & Privacy from the Tasks menu, then choose Security Manager to view your Personal Security Manager settings.
3. Close the Personal Security Manager window.
4. Go to the page psmtest.html (in the same directory as these release notes), then choose Page Source from the View menu to see the JavaScript code that a web programmer can use to detect Personal Security Manager and its version number.

Note that the version number has two parts. The first is the version of the PSM client library, and the second is the version of the PSM server library.

### Test Basic SSL

Go to any online store, banking service, brokerage account, or other web site that supports SSL. Verify that the lock in the lower-left corner of the browser window is closed when you reach the pages for which SSL should be enabled, for example a page where you are asked to give your credit card number.

### Get an SSL Client Certificate

Go to any public or private CA and apply for an SSL client certificate.

To test one-click certificate issuance, dual key-pair certificates, and other Personal Security Manager features, system administrators should download, install, and configure Netscape Certificate Management System. For complete CMS documentation and other information, see http://docs.iPlanet.com/docs/manuals/cms.html. To download the latest version of CMS, see http://www.iplanet.com/downloads/download/.

### View Your Certificate

After you have obtained a certificate, follow these steps to view it:

1. Click the Security icon in the Navigator toolbar.
2. Click the Certificates tab.
3. Click to select your certificate.
4. Click View.

You should see information about your new certificate.

### Test Client Authentication

Personal Security Manager allows the SSL server and client to negotiate which certificate to use, and in most cases they can agree on a single correct certificate for the client to present. When this happens, the user can access an SSL site that requires client authentication with zero additional clicks.

To test client authentication with Netscape Enterprise Server, system administrators should follow these steps:

- Install an Enterprise Server and configure it for client authentication as described in Appendix D, Using SSL with Enterprise Server 3.x, of Netscape Certificate Management System Installation and Deployment Guide.
- Test the Enterprise Server installation as described at the end of Appendix D using Personal Security Manager.

### Validate Certificates Using OSCP

Personal Security Manager supports the use of the On-Line Certificate Status Protocol (OSCP) to check the validity of certificates in real time. Information about this protocol and how configure Personal Security Manager 1.2 and a forthcoming version of Certificate Management System to support it will be available from http://docs.iPlanet.com/docs/manuals/psm.html.

It's important to note that Personal Security Manager will accept signatures from responders only under the following conditions:

- The response was signed by a delegated responder--that is, the responder's certificate was signed by the same CA as the certificate you're trying to verify and has the `extendedKeyUsage` bit set indicating that the certificate is an OCSP response signer. The certificate should be the same as a CA certificate with the addition of the `extendedKeyUsage` bit.
- The user has designated a default responder in the OCSP Settings dialog box (available from the Advanced tab under Options).

Common problems include the following:

- Time drift between the client and server machine. Personal Security Manager expects the time of the response to be within the past 24 hours. If there is a difference in the clocks between the machine used to sign the response, so the response looks to Personal Security Manager like it was signed in the future, Personal Security Manager interprets this as an error. Run ntp on both machines to fix this problem.
- The response doesn't include the certificates required to complete the chain needed to verify the signer's certificate. The client frequently doesn't have all the certificates in the database that are needed to verify the signer's certificate, in which case Personal Security Manager can't verify the signer's certificate and OCSP fails. Make sure the entire chain is included with every response. This is the safest way to avoid this problem.
- If you are using ValiCert, misconfiguration may cause the Validation Authority not to send the certificate chain (including the CA root certificate and the OCSP responder's certificate) correctly.

## Known Bugs/Issues for Personal Security Manager 1.3

- To run Personal Security Manager on Unix, you must be logged in as the same Unix user you were logged in as when Netscape 6 was installed.
- FORTEZZA is not guaranteed to work with this release. [# 94220]
- In some unusual circumstances you may encounter problems such as valid certificates not being verified or Netscape 6 freezing up. If you encounter a problem that doesn't appear to have a logical explanation, try the following as a last resort:

1. Exit Netscape 6, then relaunch it. If necessary, use Control-Alt-Delete on Windows 95/98/2000/NT to bring up the Task Manager and click End Process for both `psm.exe` and `netscp6.exe`.
2. Warning: Before taking this step, back up your own certificates stored internally by Personal Security Manager. If exiting and relaunching Netscape 6 doesn't take care of the problem, in some rare cases it may work to exit Netscape 6, then delete or rename your `cert7.db` and `key3.db` files (located in your user profile directory on Windows 95/98/2000/NT, or in the directory in which the Netscape or Mozilla executable resides on Unix) and relaunch the Netscape 6. You should also look for all other files in the same directory that begin with `cert` or `key` and end in `.db` and delete those files as well before relaunching Netscape 6.

## Feedback

To send feedback to the Personal Security Manager development team, send email to psmfeedback@netscape.com. Feedback back sent to this address will be read by the team, but you will not receive a personal response.