A SERVICE OF

logo

Open as PDF
next previous
For instructions on how to do this, see “Replacing an Existing Certicate” on page 71.
Distributing a CA Public Certicate to Clients
If you’re using self-signed certicates, a warning appears in most user applications
saying that the CA is not recognized. Other software, such as the LDAP client, refuses
to use SSL if the server’s CA is unknown.
Mac OS X Server ships only with certicates from well-known commercial CAs. To
prevent this warning, your CA certicate must be distributed to every client computer
that connects to the secure server.
To distribute your certicate to your clients:
1 Copy the self-signed CA certicate (the le named ca.crt) onto each client computer.
This is preferably distributed using nonrewritable media, such as a CD-R. Using
nonrewritable media prevents the certicate from being corrupted.
2 Open the Keychain Access tool by double-clicking the ca.crt icon where the certicate
was copied onto the client computer.
3 Drag the certicate to the System keychain using Keychain Access.
Authenticate as an administrator, if requested.
4 Double-click the certicate to get the certicate details.
5 In the details window, click the Trust disclosure triangle.
6 From the pop-up menu next to “When using this certicate,” select “Always Trust.”
You have now added trust to this certicate, regardless of who it is signed by.
From the command line
After copying the certicate to the target client computer, perform the following
where <certicate> is the le path to the certicate:
sudo /usr/bin/security add-trusted-cert -d -k /Library/Keychains/System.
keychain <certificate>
You can use the security tool to save and restore trust settings as well. For more
information on using the security tool, see the security man page.
Deleting a Certicate
When a certicate has expired or been compromised, you must delete it.
To delete a certicate:
1 In Server Admin, select the server that has services that support SSL.
2 Click Certicates.
3 Select the Certicate Identity to delete.
4 Click the Remove (-) button and select Delete.
70 Chapter 4 Enhancing Security