#

## Netscape Personal Security Manager

## Release 1.4

## 12/18/2000

These release notes contain the most recent information about this release of Netscape Personal Security Manager. Please read these notes before using the software.

These notes include information for IS professionals who are thoroughly familiar with security and public-key infrastructure (PKI) issues.

Use of this product is subject to the terms detailed in the license agreement at http://docs.iplanet.com/docs/manuals/psm/14/license.txt.

## Contents

Documentation
Changes Since Personal Security Manager 1.3
Software/Hardware Requirements
Installing Personal Security Manager
Using Personal Security Manager
Known Bugs/Issues for Personal Security Manager 1.4
Feedback

## Documentation

The following documentation is available with Personal Security Manager:

- Personal Security Manager Help -- This online help system can also be accessed by clicking the Help button in any personal Security Manager window.
- JavaScript API for Client Certificate Management -- This reference describes a new Javascript API for performing user certificate management operations with Personal Security Manager, including one-click issuance, forced certificate backup by end users, and automatic archival of encryption private keys.

For the latest release notes, deployment guide, and other information,see http://docs.iPlanet.com/docs/manuals/psm.html .

## Changes Since Personal Security Manager 1.3

The Transport Layer Security (TLS) protocol is turned on by default in Personal Security Manager1.4. To turn TLS off, open Personal Security Manager, click the Advanced tab, click Options in the left frame, then deselect the checkbox labeled "Enable TLS."

TLS is an IETF standard based on the Secure Sockets Layer (SSL) protocol. It can be thought of as SSL version 3.1. Some servers that do not implement SSL correctly cannot negotiate the SSL handshake with client software (such as Personal Security Manager) that supports TLS. To allow Personal Security Manager to use SSL with such TLS-intolerant servers, you must disable TLS as described above.

Most other changes since Personal Security Manager 1.3 involve minor bug fixes and optimizations.

This version of Netscape Personal Security Manager ships with Netscape 6 and also works with Mozilla and Communicator 4.7x.

#### Software/Hardware Requirements

Operating systems supported: Windows NT, Windows 95, Windows 98, Windows 2000; Solaris 2.6, 2.7, 2.8; and Red Hat Linux 6.1.

## Installing Personal Security Manager

Netscape Personal Security Manager 1.4 is installed with Netscape 6 and recent versions of Mozilla.

When you install Netscape 6 on Windows, Personal Security Manager is installed in the directory `C:\Program Files\Common Files\Netscape Shared\Security\`.

When you install Netscape 6 on Unix, Personal Security Manager is installed in a directory called `psm` in the same directory where the `netscape` executable resides.

The sections that follow describe how to install the Personal Security Manager files for use with Communicator 4.7x.

### Installing on Windows 95/98/2000/NT for Use With Communicator 4.7x

To install Netscape Personal Security Manager on Windows 95/98/2000/NT for use with Communicator 4.7 or later, save the file in a convenient location with the specified filename, then drag the file's icon into a Navigator window (that is, a browser window displayed by Communicator). Dropping the file's icon over the browser window initiates SmartUpdate, which automatically installs Personal Security Manager. Afterinstallation is complete, exit Communicator and relaunch it. If your copy of Communicator is installed in the default location, SmartUpdate installs the Personal Security Manager files in the directory`C:\Program Files\CommonFiles\Netscape Shared\Security\` and adds the file `cmnav.dll`in the directory `C:\Program Files\Netscape\Communicator\Program`.

### Installing on Unix for Use With Communicator 4.7x

To install Personal Security Manager for use with Communicator 4.7 or later on Unix, you must be logged in as the same Unix user you will be logged in as when you run Communicator. For the Unix installation to succeed, you must have write privileges for both the directory where the Netscape executable resides and the directory where the installation script creates the directory containing the Personal Security Manager files. To install Personal Security Manager for use with Communicator 4.7x, download the tar file for the version of the product that you want to install and follow these steps:

1. Exit Communicator, if it is running.
2. Decompress the downloaded file to some convenient location.
3. Run the psm-install program.

The psm-install program allows you to specify the directory in which Personal Security Manager will be installed. In this release, you must install Personal Security Manager locally. To do so, you can either install it in the default location (`/opt/netscape/security`) or in some other local location. However, if you install Personal Security Manager anywhere other than the default location, Communicator must also be installed locally. To run Personal Security Manager on Unix, you must be logged in as the same Unix user you were logged in as when you installed it.

### Disabling Personal Security Manager

To disable Personal Security Manager temporarily, exit the browser, then:

- on Unix, remove the directory`psm` from the directory where the`netscape`executable resides.
- on Windows, rename the directory `C:\Program Files\Common Files\Netscape Shared\Security` to something else.

## Using Personal Security Manager

The sections that follow describe how to test some of the features of Personal Security Manager that are available with this release:

- Start Up Personal SecurityManager with Netscape 6
- Test Basic SSL
- Get an SSL Client Certificate
- View Your Certificate
- Test Client Authentication
- Validate Certificates Using OCSP

The sections that follow briefly describe how to test some of the features listed above.

For information on the JavaScript API supported by Personal SecurityManager, see JavaScript API for ClientCertificate Management and the Personal Security Manager DeploymentGuide. For the latest versions of these documents, see http://docs.iPlanet.com/docs/manuals/psm.html.

### Use Personal Security Manager with Netscape 6

Personal Security Manager starts automatically the first time Netscape 6 needs to perform some action involving security, such as handling anSSL session.

Follow these steps to view your security settings and confirm that Personal Security Manager is running:

1. Launch Netscape 6.
2. Choose Security & Privacy from the Tasks menu, then choose Security Manager to view your Personal Security Manager settings.
3. Close the Personal Security Manager window.
4. Go to the page psmtest.html (in the same directoryas these release notes), then choose Page Source from the View menu tosee the JavaScript code that a web programmer can use to detect Personal Security Manager and its version number.

Note that the version number has two parts. The first is the version ofthe PSM client library, and the second is the version of the PSM serverlibrary.

### Test Basic SSL

Go to any online store, banking service, brokerage account, or other website that supports SSL. Verify that the lock in the lower-left corner ofthe browser window is closed when you reach the pages for which SSL shouldbe enabled, for example a page where you are asked to give your creditcard number.

### Get an SSL Client Certificate

Go to any public or private CA and apply for an SSL client certificate.

To test one-click certificate issuance, dual key-pair certificates,and other Personal Security Manager features, system administrators shoulddownload, install, and configure Netscape Certificate Management System.For complete CMS documentation and other information, see http://docs.iPlanet.com/docs/manuals/cms.html.To download the latest version of CMS, see http://www.iplanet.com/downloads/download/.

### View Your Certificate

After you have obtained a certificate, follow these steps to view it:

1. Click the Security icon in the Navigator toolbar.
2. Click the Certificates tab.
3. Click to select your certificate.
4. Click View.

You should see information about your new certificate.

### TestClient Authentication

Personal Security Manager allows the SSL server and client to negotiatewhich certificate to use, and in most cases they can agree on a singlecorrect certificate for the client to present. When this happens, the usercan access an SSL site that requires client authentication with zero additionalclicks.

To test client authentication with Netscape Enterprise Server, systemadministrators should follow these steps:

- Install an Enterprise Server and configure it for client authentication as described in AppendixD, Using SSL with Enterprise Server 3.x, of Netscape Certificate Management System Installation and Deployment Guide.
- Test the Enterprise Server installation as described at the end of AppendixD using Personal Security Manager.

### Validate Certificates UsingOSCP

Personal Security Manager supports the use of the On-Line Certificate Status Protocol (OSCP) to check the validity of certificates in real time. Information about this protocol and how configure Personal Security Manager 1.3 andNetscape Certificate Management System 4.2 to support it is available from http://docs.iPlanet.com/docs/manuals/psm/12/psmdply.htm

It's important to note that Personal Security Manager will accept signatures from responders only under the following conditions:

- The response was signed by a delegated responder--that is, the responder's certificate was signed by the same CA as the certificate you're trying to verify and has the `extendedKeyUsage` bit set indicating thatthe certificate is an OCSP response signer. The certificate should be thesame as a CA certificate with the addition of the `extendedKeyUsage`bit.
- The user has designated a default responder in the OCSP Settings dialog box (available from the Advanced tab under Options).

Common problems include the following:

- Time drift between the client and server machine. Personal Security Managerexpects the time of the response to be within the past 24 hours. If thereis a difference in the clocks between the machine used to sign the response, so the response looks to Personal Security Manager like it was signed inthe future, Personal Security Manager interprets this as an error. Runntp on both machines to fix this problem.
- The response doesn't include the certificates required to complete thechain needed to verify the signer's certificate. The client frequently doesn't have all the certificates in the database that are needed to verify the signer's certificate, in which case Personal Security Manager can'tverify the signer's certificate and OCSP fails. Make sure the entire chainis included with every response. This is the safest way to avoid this problem.
- If you are using ValiCert, misconfiguration may cause the Validation Authoritynot to send the certificate chain (including the CA root certificate andthe OCSP responder's certificate) correctly.

## Known Bugs/Issues for Personal Security Manager 1.4

- To run Personal Security Manager on Unix with Netscape 6 or Communicator, you must be logged in as thesame Unix user you were logged in as when the browser was installed.
- FORTEZZA is not guaranteed to work with this release. [# 94220]
- In some unusual circumstances you may encounter problems such as valid certificates not being verified or the browser freezing up. If you encounter a problem that doesn't appear to have a logical explanation, try the following as a last resort:

1. Exit the browser, then relaunch it. If necessary, use Control-Alt-Delete on Windows 95/98/2000/NT to bring up the Task Manager and click End Process for both `psm.exe` and `netscp6.exe`.
2. Warning: Before taking this step, back up your own certificates stored internally by Personal Security Manager. If exiting and relaunching the browser doesn't take care of the problem, in some rare cases it maywork to exit the browser, then delete or rename your `cert7.db` and`key3.db`files (located in your user profile directory on Windows 95/98/2000/NT, or in the directory in which the Netscape or Mozilla executable resideson Unix) and relaunch the browser. You should also look for all otherfiles in the same directory that begin with `cert` or`key`and end in `.db` and delete those files as well before relaunchingthe browser.

## Feedback

To send feedback to the Personal Security Manager development team, send email to psmfeedback@netscape.com. Feedback back sent to this address will be read by the team, but you will not receive a personal response.