CoSign 5 Administrator's Guide

CoSign
Version 5.0
--------------------------------
Administrator Guide
Notice
This manual contains information that is proprietary to ARX (Algorithmic Research) Ltd. No part of this manual may be reproduced in any form whatsoever without prior written approval by ARX (Algorithmic Research) Ltd. ARX (Algorithmic Research) Ltd. reserves the right to revise this publication and make any changes without obligation to notify any person of such revisions and changes. For further information, contact ARX (Algorithmic Research) Ltd.
Trademarks
CoSign Central Enterprise, CoSign Central FIPS, CoSign Central Starter, CoSign Desktop, MiniKey, and CryptoKit are trademarks of ARX (Algorithmic Research) Ltd. Other names are trademarks or registered trademarks of respective owners and are used solely for identification purposes.
ARX (Algorithmic Research) Ltd, Tel. 1-866-EASY-PKI (327-9754) Site: www.arx.com
Copyright 2010 ARX (Algorithmic Research), Ltd. All rights reserved.
CoSign Admin Manual Pub. Date 01.10 Pub. No. CSN.INS.ADMN V5.0.01.10
Table of Contents
Chapter 1: Overview ....................................................................................................................................... 1 Requirements for Data Authentication Systems ......................................................................................................... 1 Introduction to CoSign ............................................................................................................................................... 2 Solving PKI Deployment Problems Using CoSign ............................................................................................. 3 CoSign Guides ........................................................................................................................................................... 4 CoSign Appliance Hardware Models......................................................................................................................... 4 Chapter 2: CoSign Architecture and Data Flow ........................................................................................... 7 Enrollment Using a Standard User Management Application ................................................................................... 8 Central Storage of Signing Keys ................................................................................................................................ 8 User Authentication ................................................................................................................................................... 8 Extending User Authentication .................................................................................................................................. 9 Turnkey Solution ....................................................................................................................................................... 9 Directory Independent Environment ........................................................................................................................ 10 Using CoSigns Internal CA .................................................................................................................................... 10 Using CoSign in Manual External CA Mode ........................................................................................................... 10 Using CoSign in Automatic External CA Mode ...................................................................................................... 11 Chapter 3: Installing CoSign ........................................................................................................................ 13 Installing the CoSign Administrative Client ............................................................................................................ 13 Installation Requirements ................................................................................................................................. 14 Installing the CoSign Administrative Client ..................................................................................................... 14 Uninstalling the CoSign Administrative Client ................................................................................................. 15 Installing the CoSign Appliance Hardware .............................................................................................................. 16 Installing the CoSign Central FIPS and Central SSCD Appliance Hardware ................................................... 16 Installing the CoSign Central Enterprise Appliance Hardware ......................................................................... 19 Installing the CoSign Central Starter Appliance Hardware .............................................................................. 22 Installing the CoSign Appliance Software ............................................................................................................... 25 Installing CoSign in a Microsoft Active Directory Environment ...................................................................... 25 Installing CoSign in a Novell-NDS Environment ............................................................................................. 37 Installing CoSign in an LDAP based Environment ........................................................................................... 44 Installing CoSign in a Directory Independent Environment ............................................................................. 52 Installing an Internal Certificate Authority ....................................................................................................... 57 Using an External CA in Manual Mode ............................................................................................................ 61 Using an External World Wide Verifiable CA in Automated Mode ................................................................ 61 Installing CoSign as a Subordinate CA ............................................................................................................. 67 Multi-Language Support ................................................................................................................................... 70 Chapter 4: Deploying the CoSign Client ..................................................................................................... 71 Deploying the Client ................................................................................................................................................ 71 Deployment Options ......................................................................................................................................... 71 Installing the CoSign Client .............................................................................................................................. 72 Uninstalling the CoSign Client ......................................................................................................................... 76 Distributing CoSign Information Through the SCP .......................................................................................... 76 Using the CoSign Control Panel .............................................................................................................................. 79 User Actions ..................................................................................................................................................... 79 Designer Actions .............................................................................................................................................. 80
CoSign Administrator Guide
Administrator Actions ...................................................................................................................................... 80 CoSign Control Panel Menu Bar ...................................................................................................................... 81 CoSign Control Panel Tray Item ................................................................................................................... 81 Operating the Control Panel for a CoSign SSCD Appliance ............................................................................ 82 Directory Independent Environment Options ................................................................................................... 85 Using the Graphical Signature Management Application ........................................................................................ 86 Installing the Graphical Signature Capture Device ........................................................................................... 87 Managing Graphical Signatures ........................................................................................................................ 88 Installing the ROOT Certificate for Validation Purposes ........................................................................................ 92 Extracting the ROOT Certificate to a File ........................................................................................................ 93 Installing the ROOT Certificate ........................................................................................................................ 93 Using CoSign Verifier for Validation Purposes....................................................................................................... 95 Deploying the CoSign Verifier ......................................................................................................................... 96 Installing the CoSign Verifier ........................................................................................................................... 97 Extended Authentication Modes .............................................................................................................................. 97 Chapter 5: Managing the CoSign Appliance .............................................................................................. 99 Prerequisites to Using the CoSign Administration MMC ........................................................................................ 99 Starting the CoSign Administration MMC .............................................................................................................. 99 CoSign Administration MMC Capabilities..................................................................................................... 100 Backing up the CoSign Data .................................................................................................................................. 101 Upgrading CoSign ................................................................................................................................................. 102 Upgrading to Version 5 .................................................................................................................................. 102 Upgrading to Version 4.5 ............................................................................................................................... 103 Upgrading to Version 4.1 ............................................................................................................................... 103 Uploading a Software Update ......................................................................................................................... 103 Synchronizing CoSign with the Directory Service................................................................................................. 104 Synchronizing CoSign with the External CA in Automated mode ........................................................................ 105 Refreshing Certificates........................................................................................................................................... 106 Clearing CA files ................................................................................................................................................... 106 Downloading Log Files.......................................................................................................................................... 107 Shutting Down and Restarting CoSign Services .................................................................................................... 107 Restarting the CoSign Appliance ........................................................................................................................... 108 High Availability ................................................................................................................................................... 108 Renewing the Subordinate CA Certificate ............................................................................................................. 109 Uploading an SSL Certificate ................................................................................................................................ 111 Renewing the ChosenSecurity Authentication Key File ........................................................................................ 112 Monitoring Performance Parameters of the CoSign Appliance ............................................................................. 113 Activating Performance Monitoring ............................................................................................................... 113 Stopping Performance Monitoring ................................................................................................................. 113 Viewing Performance Parameters................................................................................................................... 114 Changing CoSign System Parameters .................................................................................................................... 114 Users Directory Parameters ............................................................................................................................ 115 Key Management Parameters ......................................................................................................................... 117 Certificate Management Parameters ............................................................................................................... 117 Client Security Setting Parameters ................................................................................................................. 120 Auditing and Accounting Parameters ............................................................................................................. 121 Alerts and Notifications Parameters ............................................................................................................... 121 Password Policy.............................................................................................................................................. 122 LDAP.............................................................................................................................................................. 123 Advanced Parameters ..................................................................................................................................... 124 Extended Authentication ................................................................................................................................ 125 Restoring the CoSign Appliance ............................................................................................................................ 128 Restoring the CoSign Appliance in Microsoft Active Directory .................................................................... 128
ii
Table of Contents
Restoring the CoSign Appliance in a Novell NDS Environment .................................................................... 129 Restoring the CoSign Appliance in an LDAP Environment ........................................................................... 130 Restoring the CoSign Appliance in a Directory Independent Environment .................................................... 131 Using the Users Management Utility ..................................................................................................................... 131 Activating the Users Management Utility ....................................................................................................... 132 Users Management Main Window.................................................................................................................. 132 Users Management Menus .............................................................................................................................. 134 Users Management Toolbar ............................................................................................................................ 139 Using Command Line Utilities .............................................................................................................................. 140 GetBackup ...................................................................................................................................................... 140 GetEvt ............................................................................................................................................................. 141 SetSCP ............................................................................................................................................................ 142 Groups ............................................................................................................................................................ 142 Chapter 6: Using the CoSign Console ...................................................................................................... 145 Overview of the CoSign Console ........................................................................................................................... 145 Configuring a Terminal .......................................................................................................................................... 145 Using the USB to Serial Adaptor .................................................................................................................... 146 Using the Console .................................................................................................................................................. 147 Displaying CoSign Status ............................................................................................................................... 148 Enabling DHCP .............................................................................................................................................. 150 Using a Static IP Address ............................................................................................................................... 151 Resetting the Tamper Mechanism (CoSign Enterprise Only) ......................................................................... 151 Restoring Factory Settings .............................................................................................................................. 152 Shutting Down ................................................................................................................................................ 153 Setting Time ................................................................................................................................................... 153 Netware........................................................................................................................................................... 154 Restoring the CoSign Appliance in the Case of an Internal Hard Disk Failure...................................................... 155 Chapter 7: Configuring High Availability .................................................................................................. 157 Overview of High Availability ............................................................................................................................... 157 Installing CoSign Appliances in a High Availability Configuration ...................................................................... 158 Installing the Primary CoSign Appliance ........................................................................................................ 159 Installing an Alternate CoSign Appliance ....................................................................................................... 159 Managing the Alternate CoSign Appliance ............................................................................................................ 163 Managing Data Replication in the Alternate CoSign Appliance ............................................................................ 163 Viewing Replication Status of an Alternate CoSign Appliance ...................................................................... 164 Re-initializing an Alternate CoSign Appliance ............................................................................................... 164 Unsubscribing an Alternate CoSign Appliance............................................................................................... 165 Managing Primary Appliance Failure and Recovery ............................................................................................. 165 Setting an Alternate Appliance to be the Primary Appliance .......................................................................... 165 Setting a Previous Primary Appliance to be an Alternate Appliance .............................................................. 167 Resubscribing an Alternate Appliance with a Primary Appliance ......................................................................... 168 Upgrading Appliances Participating in a High Availability Cluster ...................................................................... 168 Chapter 8: CoSign Configuration Utility ................................................................................................... 169 Overview................................................................................................................................................................ 169 Using the CoSign Configuration Utility ................................................................................................................. 170 CoSign Configuration Utility Menus .............................................................................................................. 171 Running the CoSign Configuration Utility in Admin Mode .................................................................................. 173 Configuration File Operations ........................................................................................................................ 175 Group Policies Operations .............................................................................................................................. 176 Running the CoSign Configuration Utility in End User Mode .............................................................................. 176
iii
Distributing the CoSign Client Configuration........................................................................................................ 177 Distributing the CoSign Configuration Using Configuration Files ................................................................. 177 Distributing the CoSign Configuration Using Group Policy .......................................................................... 178 Setting Admin Configuration ................................................................................................................................. 179 Admin Appliance Installation ...................................................................................................................... 179 Chapter 9: Troubleshooting ...................................................................................................................... 181 Installation Problems ............................................................................................................................................. 181 CoSign IP Address is Invalid .......................................................................................................................... 181 Error When Setting the CoSign IP Address Via the Console Interface .......................................................... 182 Default Values Do Not Appear in the Directory Setup Dialog Box ............................................................... 182 The Appliance is Not in Factory Settings Mode ............................................................................................. 182 Installation Failed ........................................................................................................................................... 183 Progress Bar Stops Advancing ....................................................................................................................... 183 CoSign Appliance Installation Issues ............................................................................................................. 184 High Availability/Load Balancing Alternate Installation............................................................................. 184 CoSign Appliance Problems .................................................................................................................................. 184 CoSign Appliance Does Not Start .................................................................................................................. 184 Console Problems .................................................................................................................................................. 185 Client-Related Problems ........................................................................................................................................ 185 Cannot Enable the Add Digital Signature to Outgoing Messages Checkbox in Outlook ............................ 185 Cannot See Any Certificates in Store ............................................................................................................. 185 Administrative Problems ....................................................................................................................................... 186 CoSign System Parameters Do Not Appear in the CoSign Administration MMC ......................................... 186 All CoSign Administration MMC Operations Fail ......................................................................................... 186 CoSign Does Not Respond ............................................................................................................................. 187 New Users Do Not Receive Certificates ......................................................................................................... 187 Restore Appliance Fails .................................................................................................................................. 188 Backup CoSign Operation Fails ..................................................................................................................... 188 Appendix A: CoSign Installation with Reduced Privileges..................................................................... 189 Overview ............................................................................................................................................................... 189 Regular CoSign Installation ................................................................................................................................... 190 Creating a New Computer Account for the CoSign Appliance....................................................................... 190 Joining the CoSign Appliance to MS Domain ................................................................................................ 190 Creating a Services Connection Point (SCP) .................................................................................................. 190 CoSign User Synchronization ......................................................................................................................... 190 Updating the userCertificate Attribute for Users ............................................................................................ 191 CoSign CA Root Certificate Information ....................................................................................................... 191 CoSign CA CDP (Certificate Distribution Point) ........................................................................................... 191 CoSign Installation with Reduced Privileges ......................................................................................................... 191 Preliminary Action Adding the CoSign Computer to the Domain ............................................................... 192 Installing CoSign in a Reduced Privileges Environment ................................................................................ 192 Complementing the CoSign Installation with Missing Capabilities ................................................................ 193 Appendix B: Centralized Installation from Active Directory................................................................... 196 Installing the Client in an Active Directory Environment ...................................................................................... 196 CoSign MSI Files ........................................................................................................................................... 196 Index............................................................................................................................................................. 199
iv
Chapter 1: Overview
Over the last four decades, the biggest challenge of IT departments in many organizations was moving to a paperless work environment. Seemingly, there was tremendous success in this regard. Today, most transactions in the business world are performed electronically: Documents are written using word processing programs. Messages are sent via email. Inventories and purchases are tracked using Enterprise Resource Planning (ERP) systems. Medical information is stored in Electronic Medical Record (EMR) systems. Although these transactions are performed in a paperless environment, organizations have still not managed to find an easy way to get rid of the paper used for data authentication (signing the authenticity of the data). Today, although organizations have invested large amounts of funds and other resources in creating paperless environments, their workers are still printing every transaction, signing it, and saving the printed copy. These organizations require a digital method for data authentication. By moving to a viable electronic data authentication system, organizations can reduce their printing, archiving, shipping, and handling costs. In addition, better and more competitive customer service can often be provided.
Requirements for Data Authentication Systems

A viable data authentication system must meet the following specifications: Security The system must ensure that no one other than the data creator can tamper with or change the data in any way. Third-party validation The system must enable any third party to validate the authenticity of the data. If a dispute arises between the parties (the data creator and recipient), any third party must be able to validate the data authenticity in order to settle the dispute. System independence Data authentication must be independent of the system that created the data. Users must be able to validate the authenticity of the data using a known standard that is independent of any specific system. Validation over time Users must be able to validate data authenticity at any point in time. Authenticity cannot expire at any point. Currently, the only data authentication method known to support all of these requirements is the Public Key Infrastructure (PKI) method of authenticating data, simply called digital signatures.
1
Introduction to CoSign
CoSign is a PKI-based, off-the-shelf digital-signature solution that can be integrated with a wide range of applications. In this way, CoSign enables organizations to embed digital signatures in various documents, forms, and transactions. CoSign is a turnkey, hardware-based solution that is easily and quickly deployed in the network and provides cost-effective digitalsignature capabilities for the organization. CoSign includes all the components needed for PKI-based digital-signature deployment. You do not need to install any other device or integrate any other component for the system to work. CoSign integrates with leading user management systems, including Microsoft Active Directory, Novell NDS, and a variety of LDAP (Lightweight Directory Access Protocol) based directories, such as IBM Tivoli. This integration ensures no overhead in managing the digital-signature system and signature credentials (i.e., the private keys that are needed in a PKI environment), solving one of the main problems of legacy digital-signature systems. System managers, network managers, and end-users can continue to use the IT infrastructure in the same manner as before CoSign was installed. CoSign stores the signature credentials in a secure server, ensuring that the signer has exclusive access to his or her signature credentials, while still maintaining a centrally managed solution. This is necessary in order to fulfill the security requirement of the data authentication system. An increasing number of applications can work with CoSign as their digital-signature layer without needing any further integration, including: Microsoft Office 2007 (Word, Excel, and PowerPoint) Microsoft Office XP/2003 (Word, Excel, and PowerPoint) Microsoft InfoPath Adobe Acrobat Microsoft SharePoint XML TIFF files Word Perfect Microsoft Outlook and Outlook Express Adobe Server forms (for signing web forms) AutoCAD Lotus Notes Microsoft BizTalk FileNet eForms
Overview
1
Verity Liquid Office ERP systems (e.g., SAP) Crystal Reports OpenOffice (Writer, Calc, etc.) StarOffice (Writer, Calc, etc.) Web applications For information on using CoSign with other applications, contact ARX technical support. CoSign also leads the development of Signature API (SAPI), an API that enables application developers to easily integrate with CoSign. For more information about integrating with CoSign, refer to the CoSign Programmer Guide. In addition, CoSign provides an interface that is based on Web Services. Web Services enables any platform that executes a SOAP client to interface with CoSign for digital signature operations. Through Web Services, CoSign also enables Adobe Reader and Adobe Acrobat to digitally sign documents using a Roaming ID profile. In this mode, there is no need to install any software in the end users PC, and the CoSign appliance is accessed by Adobe Reader/Adobe Acrobat through a Web Services interface. For more information about CoSign Web Services, refer to the CoSign Programmer Guide. Another product in the CoSign family of products is the CoSign Desktop. This standalone installation enables users to locally sign documents for their personal use. In this type of installation, the provided certificate is based on a World Wide Verifiable CA. CoSign includes the following components: The CoSign appliance hardware and software, connected to the organizations network. For more information, refer to Chapter 3: Installing CoSign. The CoSign Client software, installed on the users computers. For more information, refer to Chapter 4: Deploying the CoSign Client. The CoSign Administrative software that includes the CoSign Microsoft Management Console (MMC) snap-in, installed on the administrative computer. For more information, refer to Chapter 5: Managing the CoSign Appliance.
Solving PKI Deployment Problems Using CoSign

CoSign is an innovative digital-signature tool that offers a new approach to implementing PKI-based digital signatures. This approach solves most of the PKI deployment and maintenance problems and dramatically reduces TCO. CoSign is best suited to environments in which organizations already know the signing parties, such as for internal organizational use by employees or within a group of organizations that exchange information among themselves.
The CoSign PKI solution eliminates many hidden PKI costs and includes the following benefits:
PKI in a nutshell CoSign provides a complete, ready-to-use PKI system in a single

hardware component. CoSigns patent-pending features mark CoSign as the leader for a new generation of PKI solutions.
Central storage of signature credentials CoSigns innovative patent-pending technology

keeps all signature credentials in one physically secure environment, while still leaving them under the personal control of the owner or user. Worldwide legal recognition CoSign is the first digital-signature product designed with global e-signature regulations in mind. Documents digitally signed by CoSign are legally recognized worldwide.
CoSign Guides
CoSign documentation includes the following guides: CoSign Administrator Guide Provides all the information necessary for an administrator to install and manage the CoSign appliance in the various environments in which CoSign can operate. CoSign User Guide Provides all the information necessary for an end user to use CoSign. Includes information about special add-ins for various applications such as Microsoft Office. CoSign Desktop User Guide Provides all the information necessary for using CoSign Desktop. Includes information about special add-ins for various applications such as Microsoft Office. CoSign Programmer Guide (SAPI) Provides all the information necessary for a developer to interact with CoSign. Three application interfaces (API) are available: An interface for C/C++ applications. An interface for COM based applications. An interface based on Web Services to be used by Application Servers.
CoSign Appliance Hardware Models

There are several available hardware models of the CoSign appliance. All the models are easyto-deploy and easy-to-use digital-signature appliances that integrate with leading applications. They enable organizations to embed digital signatures that can include a graphical (handwritten) signature. The models differ in functionality, as follows: CoSign Central Enterprise This is the most commonly used CoSign appliance. The hardware is based on a rack-mountable 1U box packaged in a standard commercial casing.
Overview
1
CoSign Central FIPS This 4U rack-mountable box is based on a sealed, tamper-response casing. The hardware box is FIPS 140-2 level 3 certified. CoSign Central SSCD The CoSign Central SSCD is very similar to the CoSign Central FIPS model. The major difference is that all end users private keys are located inside an array of SmartCard chips, and the RSA signature operation is performed inside a SmartCard. Each users key can be used only if a dedicated password is provided for accessing the key. Thus, the end users private key is considered more protected than in the CoSign FIPS model. The CoSign SSCD appliance provides a solution that is compliant with the Common Criteria SSCD protection profile (CWA-14169). CoSign Central Starter CoSign Central Starter is a digital-signature turnkey solution that meets the needs of smaller organizations. CoSign Central Starter is limited to organizations of no more than 50 users. Note: Throughout this manual, the term CoSign refers to all hardware models (Enterprise, FIPS, SSCD, and Starter), unless stated otherwise.
Chapter 2: CoSign Architecture and Data Flow

CoSign is a hardware appliance that is installed on the network. The appliance includes all the necessary components for PKI-based digital signatures. CoSign integrates with the organizations user management system to eliminate overhead associated with managing users in a digital-signature system. To prevent a malicious user from signing with the credentials of a user whose desktop was left running, user authentication is performed by either the signing application or the desktop operating system. Once a user is authenticated, CoSign signs all of the users signing requests using the users signing credentials. Figure 1 illustrates the CoSign architecture.
Figure 1 CoSign Architecture
Enrollment Using a Standard User Management Application

With CoSign, enrollment in the digital-signature system (i.e., creating the signature credentials) is performed automatically when a new user joins the system, using one of the supported user management systems. A users signature credentials are renewed automatically if the user is part of the system at the yearly renewal time. Once a user is removed from the users list (for example, upon leaving the organization), the users signature credentials are revoked and the user can no longer perform a digital signature operation. This enables CoSign to eliminate the costs associated with managing users in two systems, both in the regular user management system and in the digital-signature system.
Central Storage of Signing Keys

In traditional PKI systems, users can choose to store their signing keys in personal software or hardware tokens. This creates many management problems and significantly increases the systems Total Cost of Ownership (TCO). In CoSign, the signature credentials are stored in a central, secure repository. The following are several advantages of this scheme: Users have access to their signature credentials from any computer they are working with, without having to import or export signature credentials. There is no need for distributing signature credentials since all credentials are centrally managed. There is no need for issuing temporary credentials or handling forgotten tokens. Signature credentials cannot be lost or stolen. With CoSigns central, secure repository, the security level is not affected. The repository is like a huge collection of network-attached virtual SmartCards that combine with the organizations user management and authentication system. Note: In the CoSign SSCD appliance model, the users private keys are stored within a physical SmartCard device and are protected using several methods.
User Authentication
In the CoSign environment, user authentication can be performed using the same authentication method as was used by the organization prior to the installation of the CoSign appliance. If the organization has chosen to use a certain authentication method, such as a user password, this method will also be used when performing digital signature operations.
CoSign Architecture and Data Flow
Once a user is authenticated, the following data flow illustrates how documents are digitally signed: 1. In a paperless environment, a user requires a digital signature. 2. The users application sends a request to CoSign with the users credentials (in the case of Microsoft Active Directory, credentials are sent automatically). 3. CoSign finds the correct signing key for the user and signs the document with this key. 4. CoSign returns the signature to the requesting application.
Extending User Authentication

You can configure CoSign to prompt the end user for credentials upon every digital signature attempt. This functionality provides a solution for organizations that would like to enhance the security of the digital signature operation, beyond using a regular user ID and password. If authentication is successful, CoSign allows accessing the users key and performing the digital signature operation. The following mechanisms can be used as part of extended user authentication: One Time Password (OTP) The user uses an OTP mechanism such as an RSA SecureID. In this mechanism the password is based on a fixed PIN and an additional password that is replaced every several seconds. SmartCard The user uses a SmartCard for authentication. Biometric Device The user uses a biometric device for authentication.
Turnkey Solution
CoSign provides a complete and integrated digital-signature system. CoSign integrates the different components required by a digital-signature system along with a graphical signature capture mechanism. Since CoSign uses the organizations existing user management system, no extra overhead is needed to manage the users in the digital-signature system. In addition, CoSign easily integrates with many of the leading applications that are digital-signature enabled, such as Microsoft Word and Adobe Acrobat, without requiring any additional development.
2
Directory Independent Environment
CoSign can also be used by organizations that maintain their own proprietary usermanagement system. When CoSign is installed in a Directory Independent environment, the organizations administrator can either use CoSigns users management utility or an application developed by the organization to create CoSign users and consequently generate keys and certificates for the new CoSign users. These CoSign users are just like CoSign users in a Microsoft Active Directory environment, Novell NDS environment, or LDAP environment, and they can use digital signature enabled applications such as Microsoft Word and Adobe Acrobat to perform digital signature operations. A Directory Independent environment can also be used by organizations that do not have a user directory that is supported by CoSign (currently, Microsoft Active Directory, Novell NDS directory, or LDAP-based directory). CoSign enables these organizations to manage the CoSign users through GUI-based user management utilities.
Using CoSigns Internal CA

CoSign can be installed with an internal CA. The internal CA is initiated during installation and a new CA ROOT key is generated. For every new signer, CoSign generates a new key and the internal CA generates a certificate for the key. When the signers account is deleted, the signature key is deleted and the users certificate is revoked. In addition, if certain user attributes (such as user name or email address) are changed, a new certificate is automatically issued for the user. The users certificate is valid for a year and includes basic attributes necessary for performing a digital signature operation. This certificate will be automatically renewed close to its expiration date. If a CA system is already installed within the enterprise, it is possible to have the CoSigns internal CA certificate certified by the organizations CA, thus CoSign acts as a subordinate CA.
Using CoSign in Manual External CA Mode

CoSign can be installed in a manual external CA mode, in which each end user is allocated an empty account, and must manually enroll for a certificate from an external CA. Certificate enrollment for each user is performed using an external certificate enrollment or RA application software. This application software uses standard Cryptographic APIs to access CoSign, and is not part of the CoSign solution.
10
CoSign Architecture and Data Flow
When CoSign is installed in manual external CA mode, CoSign does not install its internal CA, so users are not automatically provided with a certificate. During the enrollment: The enrollment application software requests that the CoSign appliance generate a new signature key for the specific user. The key is generated within the CoSign appliance and under the specific user account in a non-extractable manner. A certificate request is sent to the external CA. The external CA issues an X-509 certificate and sends it back to the enrollment application software. The enrollment application software uploads the certificate to the users CoSign account. The user is now ready to sign with the newly-enrolled certificate. Several signature keys and certificates can be created and stored for any given user, depending on the organizations needs. The main drawback of this mode of work is that it requires manual enrollment for each user. Manual enrollment requires user intervention, as well as substantial management time and effort. Manual enrollment also requires additional efforts spent on certificate renewal and certificate revocation. However, there are cases where you must employ manual enrollment. These include: Cases where it is required that the certificate be provided by a qualified CA of a certain country or the EU. Cases where the certificate must have specific or specialized attributes not provided by the built-in CoSign CA. Cases where the certificate must be provided by a World Wide verifiable CA that is not currently supported by CoSigns automatic external CA. In this case, the verifying partys PC is already installed with the ROOT certificate, so the verifying party does not have to manually install a ROOT certificate. This makes documentation validation easier.
Using CoSign in Automatic External CA Mode

An alternative external certification mode is available that addresses the deficiencies of the manual external certificate enrollment process described above. In Automatic external certification mode, the CoSign appliance automatically interfaces with the external CA during the process of generating a single signature key and certificate for each user. The users certificate is automatically renewed close to its expiration. In addition, if the user account is revoked, the users certificate is also automatically revoked. All communication between the CoSign appliance and the external CA is secured based on the HTTPS protocol. Note that using this mode requires an outbound network connection from the CoSign appliance to the Internet.
11
Starting from CoSign version 5, two optional certificate authorities can be used for this purpose: Comodo and ChosenSecurity. The certificate authority that will serve as the Automatic External CA is selected during the CoSign appliance installation process.
12
Chapter 3: Installing CoSign

The following chapters describe how to install and uninstall CoSign, manage the CoSign system, and connect to and use the CoSign console. CoSign installation consists of several steps: Installing the CoSign administrative client. The CoSign administrative client includes various administrative utilities, as well as the Microsoft Management Console (MMC), CoSigns administration snap-in. The CoSign administrative client installation is described in this chapter. Installing the CoSign Central Enterprise/ CoSign Central FIPS/CoSign Central SSCD/CoSign Central Starter appliance hardware. Appliance hardware installation is described in this chapter. Installing the CoSign appliance software, in either a Microsoft-Active Directory, NovellNDS environment, LDAP based directory, or Directory Independent environment. Appliance software installation is described in this chapter. Deploying the CoSign Client, in a Microsoft-Active Directory environment, Novell-NDS environment, LDAP based directory, or Directory Independent environment. This is described in Chapter 4: Deploying the CoSign Client. Using the CoSign console. This is described in Chapter 6: Using the CoSign Console. Using the graphical signature management application that enables setting a graphical signature for users of the organization. This is described in Using the Graphical Signature Management Application Optionally setting up the organization in a high availability configuration, in which several CoSign appliances are set up to provide load balancing and redundancy. This is described in Chapter 7: Configuring High Availability. Note: CoSign installation differs slightly depending on whether CoSign is being installed in a Microsoft Active Directory environment, Novell NDS environment, LDAP based environment, or Directory Independent environment. These differences are mentioned where applicable.
Installing the CoSign Administrative Client

The CoSign administrative client includes various administrative utilities. The CoSign administrative client enables you to administrate the following CoSign components: Administrate CoSign appliances, using the CoSign Administration MMC. For more information, refer to Chapter 5: Managing the CoSign Appliance Administrate CoSign users. For more information, refer to Using the Users Management Utility.
13
Set end users configuration. For more information, refer to Chapter 8: CoSign Configuration Utility. Set graphical signatures for users. For more information, refer to Using the Graphical Signature Management Application.
Installation Requirements
The CoSign administrative client requires the administrative station to have one of the following operating systems: Windows XP Professional. Windows 2003 Server. Windows VISTA. Windows 2008/Windows 2008 R2. Windows 7. Note: The CoSign client can be also be installed in any 64 bit variant of the above operating systems, such as Windows Vista 64 bit or Windows 7 64 bit. When installing the CoSign administrative client in a Microsoft Active Directory environment, the administrative station must be joined to the Microsoft Domain. In addition, the administrator who is installing the CoSign administrative client must have domain administrative rights. Note: It is possible for a user with limited permissions to install CoSign in an Active Directory environment. This situation is relevant for organizations where CoSign serves only certain organizational units. This type of installation requires performing certain preparations prior to installing CoSign, as well as performing certain actions after CoSign was installed. Refer to Appendix A: CoSign Installation with Reduced Privileges for detailed information on how to install CoSign using a user with limited permissions. Note: The administrative client software installs the CoSign administrative client along with other administrative components, such as the graphical signature management capabilities and administrative utilities.
Installing the CoSign Administrative Client

Note: You must install the CoSign administrative client on your administrative station before installing the CoSign appliance. To install the CoSign administrative client: 1. Insert the ARX CoSign CD into the CD drive. The ARX CoSign Client Installation screen appears:
14
Installing CoSign
Figure 2 ARX CoSign Client Installation screen
2. Select the following components: ARX CoSign Client. ARX CoSign Admin. 3. Click Install Now. When installation is complete, a success message appears.
Uninstalling the CoSign Administrative Client

To uninstall the CoSign administrative client, uninstall all ARX CoSign components, as follows: 1. Open the Start menu and select Programs ARX CoSign Uninstall CoSign
Components.
2. A confirmation box appears. Click Yes to uninstall. The uninstalling process begins. 3. When the CoSign Client is uninstalled from the workstation, a message box appears to inform you that the system finished uninstalling. Click OK. The CoSign administrative client is uninstalled from the workstation.
15
3
Installing the CoSign Appliance Hardware
The following sections provide instructions for installing the various CoSign appliance models. Installing the CoSign Central FIPS and Central SSCD Appliance Hardware. Installing the CoSign Central Enterprise Appliance Hardware. Installing the CoSign Central Starter Appliance Hardware.
Installing the CoSign Central FIPS and Central SSCD Appliance Hardware
Note: Throughout this section, the term CoSign Central FIPS refers to both the Central FIPS and the Central SSCD models, unless otherwise noted. The CoSign Central FIPS appliance hardware (shown in Figures 3 and 4) includes: A vent for the inner fan. A protective metal door with a lock. Three LEDs Power, Hard Disk, and Tamper. A USB connector for inserting MiniKey tokens. Two power switches (one on the front panel of the appliance and one in the back of the appliance). A built-in console, consisting of a display and 4-button keypad. A power connector. An Ethernet connector for connecting to the network. Internal SmartCard arrays (CoSign Central SSCD appliance only).
Figure 3 CoSign Central FIPS Front Panel
16
Installing CoSign
Figure 4 CoSign Central FIPS Back Panel
Figure 5 CoSign License MiniKey Token
The following table lists the physical dimensions of the CoSign Central FIPS appliance.
Width Length (Depth) Height Weight 48.3 cm (19") 44.7 cm (17.6") 17.8 cm (7") 15 kg (33 lb)
To install the CoSign Central FIPS appliance hardware: 1. Verify that you have all the necessary sets of keys and MiniKey (USB) tokens, as follows: Two backup MiniKey tokens. Each of the backup MiniKey tokens contains identical secrets, which include several triple DES Keys that are generated during the installation of the CoSign appliance software. These keys are used for encrypting the backup file and the private keys in the database. The keys also serve a role in database replication, which is an integral component of a High Availability configuration (refer to Chapter 7: Configuring High Availability). Note: The backup MiniKey token that is supplied with CoSign version 5 is not compatible with older versions of the CoSign appliance, and therefore must not be used to install older versions of the CoSign appliance. One license MiniKey token. The license MiniKey token must be inserted while operating the CoSign appliance. If the license MiniKey token is not inserted, the
17
appliance automatically shuts down after two hours. In this case, the Event Log and the console display messages indicating that the license MiniKey token is not inserted. Note: The license MiniKey limits the number of end-users that may use the CoSign appliance. If you require additional user licenses, please contact your ARX sales representative. A physical key for front panel locking. 2. The CoSign Central FIPS box is rack mountable. Install CoSign Central FIPS in the rack as follows: Insert a rack shelf in the rack. Follow the instructions in the racks guide to properly attach the shelf to the rack. Carefully place the CoSign Central FIPS box on the shelf. Use a screw driver, 4 screws, 4 washers, and 4 nuts to secure the CoSign Central FIPS box to the front vertical rail of the rack. Use the four holes in the front of the CoSign Central FIPS box. 3. Connect the appliance to the power supply. 4. Connect the appliance to the network using the Ethernet connector and a standard Ethernet cable. CoSign supports 10/100/1000 Mbits/sec Ethernet connections.
Caution: Use shielded network cables. 5. On the DHCP server, you can set up a specific IP address for the CoSign appliance based on the appliances MAC address. The appliances MAC address is located on the back panel of the appliance (refer to Figure 4). Note: To use a static IP address, you must set the appliances network parameters using the console. For more information on using the console, refer to Chapter 6: Using the CoSign Console. 6. On the back panel of the appliance, turn on the power switch. 7. On the front panel of the appliance, press the ON/OFF power switch. Caution: There is a risk of explosion if the battery is replaced with an incorrect type of battery. Dispose of used batteries according to the manufacturers instructions.
18
Installing CoSign
Environmental Conditions
The following table lists the environmental conditions:
Operating Ambient Temperature 41 to 95F 5 to 35C 20 to 80 % (non-condensing) Non-operating - 4 to 149F - 20 to 65C 10 to 90 % (non-condensing)
Relative Humidity
Caution: Make sure that the temperature inside the rack does not exceed 35C / 95F.
CoSign Central FIPS Certificates

The CoSign Central FIPS appliance complies with the following certificates: UL file No: E192352, with the following conditions: Indoor usage only. The box has been judged on the basis of the required spacing in the Standard for Safety of Information Technology Equipment, including Electrical Business Equipment. Electrical rating of power supply: Voltage: 100-240 Vac Frequency: 60/50 Hz Current: 10 A The following warning is presented: DANGER! Incorrect replacement of battery can cause explosion. Replace only with the same or equivalent type of battery recommended by the manufacturer. Dispose of used batteries according to the manufacturers instructions. FIPS 140-2 level 3 validation: Certificates number 887,1208.
Installing the CoSign Central Enterprise Appliance Hardware

The CoSign Central Enterprise appliance hardware (shown in Figures 6 and 7) includes: Power supply and cable. A recessed power button on the front panel. An Ethernet connector for connecting to the network in the back panel. A serial connector for connecting a terminal in the back panel. Front panel USB connectors for inserting MiniKey tokens.
19
3
Note: Do not connect any of the other interfaces.
Figure 6 CoSign Central Enterprise Front Panel
Figure 7 CoSign Central Enterprise Back Panel
20
Installing CoSign
3
Width Length (Depth) Height Weight 47.9 cm (18.8") 55.88 cm (22") 4.45 cm (1.75") 12.7 kg (25.4 lbs)
The following table lists the dimensions of the CoSign Central Enterprise appliance.
To install the CoSign Central Enterprise appliance hardware: 1. Verify that you have all the necessary sets of keys and MiniKey (USB) tokens, as follows: Two backup MiniKey tokens. Each of the backup MiniKey tokens contains identical secrets, which include several triple DES keys that are generated during the installation of the CoSign Enterprise appliance software. These keys are used for encrypting the backup file and the private keys in the database. License MiniKey token. The license MiniKey token must be inserted while operating the CoSign Central Enterprise appliance. If the license MiniKey token is not inserted, the appliance automatically shuts down after two hours. In this case, the Event log displays messages indicating that the license MiniKey token is not inserted. Note: The license MiniKey limits the number of end-users that may use the CoSign Central Enterprise appliance. If you require additional user licenses, contact your ARX sales representative. 2. Connect the power cable to the CoSign Central Enterprises power connector, and then connect the power cable to the power supply. 3. Connect the appliance to the network using the Ethernet connector and a standard Ethernet cable. CoSign Central Enterprise supports 10/100/1000 Mbits/sec Ethernet connections. Caution: Use shielded network cables. 4. On the DHCP server, you can set up a specific IP address for the CoSign Central Enterprise appliance based on the appliances MAC address. The appliances MAC address is located on the back panel of the appliance. Note: To use a static IP address, first connect the console terminal to the serial connector of the CoSign Central Enterprise appliance. For more information on using the console, refer to Chapter 6: Using the CoSign Console. 5. On the front panel of the appliance, press the recessed power button.
21
3
Operating Ambient Temperature 50 to 95F 10 to 35C 8 to 80 % (non-condensing)
Non-operating -40 to 140F -40 to 60C 8 to 80 % (non-condensing)
Relative Humidity
Installing the CoSign Central Starter Appliance Hardware

The CoSign Central Starter appliance hardware (shown in Figures 9 and 10) includes: Power supply and cable. ON/OFF power switch on the back panel. Power switch on the front panel. An Ethernet connector for connecting to the network in the back panel. A serial connector for connecting a terminal in the back panel. Front panel USB connectors for inserting MiniKey tokens. Note: Do not connect any of the other interfaces.
22
Installing CoSign
Figure 9 CoSign Central Starter Front Panel
Figure 10 CoSign Central Starter Back Panel
23
3
Width Length (Depth) Height Weight 44.45cm (17.5") 41.4cm (16.3") 14cm (5.5") 9.5kg (20.95 lbs)
The following table lists the dimensions of the CoSign Central Starter appliance.
To install the CoSign Central Starter appliance hardware: 1. Verify that you have all the necessary sets of keys and MiniKey (USB) tokens, as follows: Two backup MiniKey tokens. Each of the backup MiniKey tokens contains identical secrets, which include several triple DES keys that are generated during the installation of the CoSign appliance software. These keys are used for encrypting the backup file and the private keys in the database. License MiniKey token. The license MiniKey token must be inserted while operating the CoSign appliance. If the license MiniKey token is not inserted, the appliance automatically shuts down after two hours. In this case, the Event log displays messages indicating that the license MiniKey token is not inserted. Note: The license MiniKey limits the number of end-users that may use the CoSign appliance. If you require additional user licenses, please contact your ARX sales representative. 2. Connect the power cable to the CoSign Central Starters power connector, then connect the power cable to the power supply. 3. Connect the appliance to the network using the Ethernet connector and a standard Ethernet cable. CoSign Central Starter supports 10/100/1000 Mbits/sec Ethernet connections. Caution: Use shielded network cables. 4. On the DHCP server, you can set up a specific IP address for the CoSign appliance based on the appliances MAC address. The appliances MAC address is located on the back panel of the appliance. Note: To use a static IP address, first connect the console terminal to the serial connector of the CoSign Central Starter appliance. For more information on using the console, refer to Chapter 6: Using the CoSign Console. 5. On the back panel of the appliance, press the ON/OFF power switch. 6. On the front panel of the appliance, press the power switch.
24
Installing CoSign
Operating Ambient Temperature 41 to 95F 5 to 35C 20 to 80 % (non-condensing) Non-operating - 4 to 149F - 20 to 65C 10 to 90 % (non-condensing)
Relative Humidity
Installing the CoSign Appliance Software

CoSign can be installed in either a Microsoft Active Directory environment, Novell NDS environment, LDAP environment, or in a Directory Independent Environment.
Figure 12 CoSign Installation Options
Note: The following software installation instructions apply for all CoSign Central hardware models, unless otherwise noted.
Installing CoSign in a Microsoft Active Directory Environment

The CoSign interface to Microsoft Active Directory assists both administrators and end users in the following aspects: Administrators The administrator does not need to manage users in CoSign since CoSign can be instructed to automatically synchronize with the users located in the Microsoft Active Directory. Depending on CoSigns configuration, each time a new user is created in the Active Directory, the CoSign appliance generates a new user account. Additionally, depending on the CoSign Internal certificate authority configuration, a private key and a certificate are generated for the user. When certain attributes in the user record in the directory are modified (such as the user's email address), a new certificate is generated for the user by the CoSign appliance. When the user is deleted from the directory, the user is also be deleted from the CoSign appliance and his/her certificate is revoked.
25
In addition, the CoSign appliance also publishes information in the domain, enabling the user to easily access it automatically. For example, the availability status of the CoSign appliance or the CoSign Root CA certificate is published at the Microsoft Active Directory as well.
Users When using active directory, CoSign can employ the Kerberos ticketing
mechanism to enable users to automatically logon to the CoSign appliance using the credentials supplied at the beginning of the user's session in the Microsoft Domain. In this case, it is mandatory that the user's machine be joined to the Microsoft domain. You can install CoSign in a multiple trusted Active Directory (AD) environment, where a single CoSign appliance installed in a certain AD Domain can accept users from other domains that have mutual trust with CoSigns domain. In this mode of work, users synchronization works differently: upon first access of a new user, CoSign automatically creates an account for the user and, depending on the configuration, also generates a key and a certificate for the user. Upon an update of the user information in the domain, an updated certificate is generated for the user, depending on the updated parameters. When the user is deleted from the domain, the user account is deleted from CoSign, and his/her certificate is revoked. In order to manage CoSign after installation, you must be either a member of the administrators group and be a valid CoSign user (as defined in the Directory Setup dialog box, shown in Figure 15), or be the built-in CoSign appliance administrator.
Permission Considerations
Since the installation of the CoSign appliance requires access to Microsoft Active Directory in several locations in the Directory, special care must be taken in using the appropriate administrator accounts. Regarding the permissions of the administrator installing CoSign in a Microsoft Active Directory environment, there are three approaches: Straightforward installation by an administrator with full permissions. The CoSign appliance software is installed from the CoSign Appliances Management application. In this installation scenario, the administrator logged on to the administration workstation that is running the CoSign administrative client is a member of both the Enterprise admins and Domain admins groups. This is because one of the operations that are performed during the installation is the creation of a new computer entry in the Microsoft Active Directory. Installation by an administrator with limited permissions. This situation is relevant to organizations where CoSign serves only certain organizational units. This type of installation requires performing certain preparations prior to installing CoSign, as well as performing certain actions after CoSign was installed. Refer to Appendix A: CoSign Installation with Reduced Privileges for detailed information on how to install CoSign using a user with limited permissions. Installation by an administrator who may not have full permissions. If the administrator does not have permissions for all Active Directory related activities that occur during the installation, a window appears, detailing the exact problem. The exact returned error is displayed in the bottom of the window.
26
Installing CoSign
Figure 13 Switching to a Different Administrator
You can switch to another administrator account that may have the permissions to perform the failed operation. You can also specify whether to continue using the new administrator account for the next operations. For example, if CoSign is installed in a child domain environment, the installation can start with an administrator of the child domain using a workstation that is joined to the child domain. During the installation, it is required to also access the parent domain for updating the parent domain with information such as the CoSign CA certificate and the CoSign CA CRL. If the administrator of the child domain does not have parent domain permissions, the window shown in Figure 13 appears, requesting the user to supply an administrator account with administrative permissions in the parent domain.
Installation Instructions
To install the CoSign software: 1. Activate the CoSign Control Panel by opening the Start menu and selecting Programs ARX CoSign CoSign Control Panel. The CoSign Control Panel appears. 2. Select Appliances Management. The ARX CoSign Appliance Management window appears. 3. Right-click CoSign appliances and select All Tasks Install New Active Directory appliance. The CoSign License Agreement appears. 4. Accept the license agreement and click Next. The Network Setup dialog box appears.
27
Figure 14 Network Setup Dialog Box
5. Enter the IP address of the CoSign appliance. This parameter is necessary for enabling basic communication to and from the CoSign appliance. Note: For information on setting up the IP address of the CoSign appliance, refer to Using a Static IP Address and Enabling DHCP. Note: Make sure that your DHCP server is set up to allocate the correct DNS server address for the domain. If it is not set up, use the console to set a DNS server address before installing CoSign (refer to Using a Static IP Address). 6. Click Next. The CoSign Administrator User dialog box appears.
28
Installing CoSign
Figure 15 CoSign Administrator User Dialog Box
7. Enter a user name and a password of a built-in administrator who will manage the CoSign appliance. You will need to enter the password again for confirmation. The built-in administrator is very useful in cases where the Active Directory-based administrator has a problem connecting to CoSign. Note: Make sure to select an appropriate password for this user since the administrator user name and password that you enter in this dialog box are used for appliance management. During installation, a new user is generated in CoSign with this user name and password. Make sure not to forget this password, since without it you will not be able to perform any administrative task.
29
8. Click Next. The Active Directory Admin Account dialog box appears.
Figure 16 Active Directory Admin Account Dialog Box
Note: The Active Directory Admin Account dialog box includes default values based on the administrative user who is currently logged on. You can change the default values if desired. If default values do not appear, the DNS configuration of the administration station may be problematic and the installation procedure may fail (refer to Default Values Do Not Appear in the Directory Setup Dialog Box). 9. Enter an administrative account that has permission to join the CoSign appliance to the Domain.
30
Installing CoSign
10. Click Next. The Directory Setup dialog box appears.
Figure 17 Directory Setup Dialog Box
Note: The Directory Setup dialog box includes default values based on the administrative user who is currently logged on. You can change the default values if desired. If default values do not appear, the DNS configuration of the administration station may be problematic and the installation procedure may fail (refer to Default Values Do Not Appear in the Directory Setup Dialog Box). Note: If CoSign is intended to be installed in a regional domain of a forest, set the above fields to include information of the regional domain and not of the ROOT domain. 11. Enter the following information: Domain/Tree name The name of the domain that contains the CoSign appliance. CoSign container The location in the Active Directory where the CoSign appliance computer will be contained. A new computer entry will be created in this location. You can click Browse to browse to the appropriate location. The Directory Object Selection Tree dialog box appears.
31
Figure 18 Directory Object Selection Tree Dialog Box
Note: If the CoSign Administration MMC is being used on the domain machine, the displayed default values will be different than those for a regular machine. Modify these values as required. Users Synchronization Settings If you do not select this option, the CoSign appliance will work in a multiple Active Directory environment. This means that users from several domains that have trust between the domains can use CoSign to perform signature operations. The user must belong to the specified signers group. The first attempt of the user to access the CoSign appliance will automatically generate an account for the user and, depending on the system configuration, will also generate a key and a certificate for the user. If you do select this option, then using the values you enter in the Directory Setup dialog box (Figure 15), the CoSign appliance selects the users of the domain who will be considered CoSign users and thus will be able to sign documents. The selection is performed as follows: In the first stage, all users defined in the Users Container can be potential users of the CoSign appliance. In the next stage, if Use Signers Group is selected, only users who belong to the specified group are valid CoSign users. Note that in the Signers group it is possible to define additional subgroups to ease the selection of CoSign users. For example, the administrator can define that the Signers group include the Sales and Marketing groups. Users container The general scope of users who can access CoSign, based on a subtree of users in the Active Directory.
32
Installing CoSign
3
Use Signers Group Select this option to specify that only users who belong to the Signers group be defined as CoSign users. Signers Group Name The full distinguish name of the Signers Group. Click Browse to browse to the location of the Signers Group. Remember to specify the name of the Signers Group in addition to the location of the group. Automatically synchronize CoSign with the directory to create user database If this option is selected, CoSign will automatically generate accounts for each signer and, depending on the CA configuration, generate a key and a certificate for each signer. If this option is not selected, the administrator should perform a manual synchronization. This option should be used in cases where it is required to change settings after installation, but before user accounts are created. Note: In addition to the default CoSign administrator, you can define additional CoSign administrators who are valid Active Directory users. If you do so, the CoSign administrator must also be located in this subtree and the Signers Group in order to be a valid CoSign user. Otherwise the administrator will not be able to administrate CoSign. Important: In the case of a regular AD installation, do not modify the name of the sub-tree of CoSign users in the Active Directory. Such a modification can lead to deleting all the users and their information inside the CoSign appliance. Note: If you move a user from the CoSign OU (CoSign container) to a different location, the user is not automatically deleted from the CoSign Appliance. The next manual synchronization operation will delete the user from the CoSign appliance. This means that the users key, certificate, and graphical signature are deleted. Note: If you move a user from the Signers group in the Active Directory, the user is not automatically deleted from the CoSign Appliance, but the users will be unable to connect to CoSign. The next manual synchronization operation will delete the user from the CoSign appliance. Note: In a multiple AD domain environment, user synchronization is based on two considerations: - If the user is updated in the domain in a parameter that is relevant to CoSign (i.e., email address), the user will be updated in CoSign as well. - If the user is deleted from the domain, the user will be deleted from CoSign as well and his/her certificate will be revoked.
12. Click Next. If the requested Signers groups does not exist, you are queried whether the installation procedure should create this group inside Active Directory. After clicking Yes or No, the CA setup dialog box appears. Note: If a Signers group is created, valid CoSign users are created only after assigning users to the Signers group.
33
Figure 19 CA Setup Dialog Box
If you want the CoSign appliance to use an internal Certificate Authority (CA) for generating end-user certificates, refer to Installing an Internal Certificate Authority for detailed explanations of the CA setup dialog box. After setting up the internal CA in the CA setup dialog box, continue with Step . 9 If you want the CoSign appliance to use a World Wide Verifiable Certification Authority (CA) for automatically generating end-user certificates, refer to Using an External World Wide Verifiable CA in Automated Mode for detailed explanations of the CA setup dialog box. After configuring the World Wide verifiable CA in the CA setup dialog box, continue with Step . 9 If you do not wish the CoSign appliance to use an internal CA, select the Without CA option in the CA type drop-down box. In this case, you will be using CoSign in manual external CA mode. It is highly recommended to read the section Using CoSign in Manual External CA Mode before installing CoSign with this option. 13. Click Next. The CoSign installation begins. A status bar displays the status of the installation operation. During the installation, status messages appear on both the console display and the CoSign Administration MMC display. 14. At the Please insert a backup Minikey prompt, insert the first backup MiniKey token.
34
Installing CoSign
15. At the Please insert a second backup Minikey prompt, remove the first MiniKey token and insert the second backup MiniKey token. The second backup MiniKey is a duplicate of the first backup MiniKey. 16. At the Please insert your License Minikey prompt, insert the license MiniKey token. If you selected the option Install as Subordinate CA in the CA Setup dialog box (refer to Installing an Internal Certificate Authority) , several dialog boxes appear, necessitating various operations. For detailed instructions, refer to Installing CoSign as a Subordinate CA. If you selected the CA Type to be ChosenSecurity World Wide Verifiable CA in the CA Setup dialog box, several dialog boxes appear, necessitating various operations. For detailed instructions, refer to Using an External World Wide Verifiable CA in Automated Mode ChosenSecurity. In all other cases, your part in the installation is complete. If you did not select Automatically synchronize CoSign with the directory to create user database in the Directory Setup dialog box (Figure 17), a message appears, reminding you to perform a manual synchronization. If you did select that option, the installation will generate user accounts and automatically generate keys and certificates for all created users. A progress bar continues to display the progress of the operation. The time needed for creating the users, keys, and certificates depends on the number of users and the selected key length. 17. Click Finish. Note: If the first stage of installation was unsuccessful, the CoSign appliance returns to its factory settings. This enables you to rerun the installation. In this case, the status bar displays that installation was unsuccessful and you can click the Back buttons to modify settings before rerunning the installation. If the installation was unsuccessful and you are unable to rerun the installation, restore CoSign to factory settings and then try again. For more information about restoring factory settings, refer to Restoring Factory Settings. Note: Clicking Cancel does not stop the installation process, it only closes the progress bar on the administration machine (unless you specified a subordinate CA installation). 18. In the CoSign Administration MMC window, right-click CoSign appliances and select Refresh from the popup menu. The window refreshes and displays the newly installed appliance. You will need to login and then you can manage CoSign using the CoSign Administration MMC (refer to Chapter 5: Managing the CoSign Appliance). Note: Keep the license MiniKey token plugged into the device at all times. Unplugging the license MiniKey for several hours may shut down the service. Periodically check the number of appliance users. If the number of users is approaching the license limit, contact ARX for a replacement license MiniKey token.
35
Note: In a high availability environment, the licenses of all the CoSign appliances in the high availability site should have an identical limitation on the number of appliance users. Note: Store the backup MiniKey in a separate, secure place (for example, a safe). In case of disaster, you can use the backup MiniKey and the backup file of the CoSigns database to safely recover and restore CoSign data. For more information on how to backup and restore the CoSigns database, refer to Backing up the CoSign Data. If you lose the backup MiniKey, you will not be able to perform some critical functions, such as restoring the CoSign appliance (even if you a have a backup file), adding an alternate appliance, and performing a reset tamper operation. Therefore, make sure that the backup MiniKey, as well as the second backup MiniKey, will be available when needed. The following table provides a summary of the users involved in the installation procedure and CoSign operation. The table also describes the actions and permissions of each of these users. For more information on how CoSign interfaces with Active Directory, refer to Appendix A: CoSign Installation with Reduced Privileges.
Table 1 Users Involved in the Installation and Operation of CoSign
User Domain Administrator
Actions Running the CoSign Administration MMC for performing installation.
Active Directory Operations Update the Active Directory as follows: Register the CoSign appliance as a workstation, and create the following objects: SCP objects, a CA object, a CA AIA object, and a CA CRL object. Join the CoSign appliance to the domain.
Permissions Permission to create objects in Active Directory and enable the CoSign appliance to update them during operation.
Suggested Permission Group Enterprise admins and Domain admins
Administrator user (name and password are provided during installation) CoSign Administrator
Registering the CoSign appliance as a member of the domain during installation. Performing CoSign administrative operations.
Permission to register the appliance as a member of the domain.
Enterprise admins and Domain admins in the domain.
None
Only Active Directory administrators and the built-in administrator can administrate the CoSign appliance.
administrators groups in the domain.
36
Installing CoSign
Installing CoSign in a Novell-NDS Environment

The CoSign interface to Novell NDS Directory is intended mainly to synchronize the CoSign users with users in the Novell NDS directory. The users will normally need to login to CoSign by presenting their User ID and password. The administrator does not need to manage users in CoSign, since CoSign can be instructed to automatically synchronize with the users located in the Novell NDS Directory. Depending on CoSigns configuration, each time a new user is created in the Novell NDS directory, the CoSign appliance generates a new user account. Additionally, depending on the CoSign Internal certificate authority configuration, a private key and a certificate will be generated for the user. When certain attributes in the user record in the directory are modified (such as the user's email address), a new certificate is generated for the user by the CoSign appliance. When the user is deleted from the directory, the user is also deleted from the CoSign appliance and his/her certificate is revoked. In addition, the CoSign appliance also publishes information in the domain, enabling the user to easily access it automatically. For example, it publishes the availability status of the CoSign appliance. Note: The following software installation instructions apply for both CoSign Central FIPS and CoSign Central Starter, unless otherwise noted. You install the CoSign appliance software from the CoSign Administration MMC. In order to manage CoSign after installation, you must either be a member of the administrators group or be the built-in appliance administrator. Note: You can define a built-in administrator who is not a Novell NDS user, but can nevertheless manage the CoSign appliance. Note: Managing users, groups, and stations are features of Novell NDS Directory. Novell NDS enables you to define which actions users are permitted to perform. While following this installation procedure, make sure that all user permissions are correctly defined in the Novell NDS Directory, as specified in the procedure. For more information regarding Novell NDS, refer to Novells web site: http://www.novell.com. To install the CoSign software: 1. Activate the CoSign Administration MMC by opening the Start menu and selecting Programs ARX CoSign CoSign Control Panel. The CoSign Control Panel appears. 2. In the CoSign Control Panel select Appliances Management. The ARX CoSign Appliance Management window appears. 3. Right-click CoSign appliances and select All Tasks Install New Novell NDS appliance. The CoSign License Agreement appears. 4. Accept the license agreement and click Next. The Network Setup dialog box appears.
37
5. Enter the CoSign appliance IP address. This parameter is necessary for enabling basic communication to and from the CoSign appliance. Note: For information on setting up the IP address of the CoSign appliance refer to Using a Static IP Address and Enabling DHCP.
38
Installing CoSign
6. Click Next. The CoSign administrator user dialog box appears.
7. Enter a user name and a password of a built-in administrator who will manage the CoSign appliance. You will need to enter the password again for confirmation. The built-in administrator is very useful in cases where the Novell NDS-based administrator has a problem connecting to CoSign. Note: Make sure to select an appropriate password for this user since the administrator user name and password that you enter in this dialog box are used for appliance management. During installation, a new user is generated in CoSign with this user name and password. Make sure not to forget this password, since without it you will not be able to perform any administrative task.
39
3
8. Click Next. The User Setup dialog box appears.
Figure 22 User Setup Dialog Box
9. Enter the CoSign user name (login name), CoSign password, Confirm CoSign Password, and CoSign group name. Note: Make sure to select an appropriate password for this user since the CoSign user name and password that you enter in this dialog box are used both for appliance installation and operation. During installation, a new user is created with this user name and password. During appliance operation, the user name and password are used for authentication of the CoSign appliance to the Novell NDS Server. Note: The CoSign group name defines the administrators group. Any user that is a CoSign user and belongs to the administrators group can administrate CoSign. Note: Do not change the CoSign password after installation.
40
Installing CoSign
10. Click Next. The Directory Setup dialog box appears.
Figure 23 Directory Setup Dialog Box
Note: The Directory Setup dialog box includes default values based on information gathered from the administration client. You can change the default values if desired. 11. Enter the following information: Domain/Tree name Name of the Novell NDS context that includes the CoSign appliance. CoSign container Location of the CoSign workstation in the NDS context. Specifying this information enables the CoSign clients to get information such as the IP address of the CoSign appliance. Users container The group of users who can access CoSign, based on a sub-tree of users in the NDS context. The CoSign appliance will generate keys and certificates only for users located in this specified location. (All the users that exist in this subtree are referred to as CoSign users.) Note: The CoSign administrators must also be located in this sub-tree. If not, they will be unable to administrate CoSign. 12. Automatically synchronize CoSign with the Directory to create user database If this option is selected, CoSign will automatically generate accounts for each user and, depending on the CA configuration, generate a key and a certificate for each signer. If this option is not selected, the administrator should perform a manual synchronization.
41
3
13. Click Next. The CA setup dialog box appears.
This option should be used in cases where it is required to change settings after installation, but before user accounts are created.
If you want the CoSign appliance to use an internal Certificate Authority (CA) for generating end-user certificates, refer to Installing an Internal Certificate Authority for detailed explanations of the CA setup dialog box. After setting up the internal CA in the CA Setup dialog box, continue with Step 4. 1 If you want the CoSign appliance to use a World Wide Verifiable Certification Authority (CA) for automatically generating end-user certificates, refer to Using an External World Wide Verifiable CA in Automated Mode for detailed explanations of the CA setup dialog box. After configuring the World Wide verifiable CA in the CA setup dialog box, continue with Step 4. 1 If you do not wish the CoSign appliance to use an internal CA, select the Without CA option in the CA type drop-down box. It is highly recommended to read the section Using CoSign in Manual External CA Mode before installing CoSign with this option. 14. Click Next. The CoSign installation begins. A status bar displays the status of the installation operation. During the installation, status messages appear on both the console display (or the terminal console, in the case of Central Starter), and the CoSign Administration MMC display.
42
Installing CoSign
15. At the Please insert a backup Minikey prompt, insert the first backup MiniKey token. 16. At the Please insert a second backup Minikey prompt, remove the first MiniKey token and insert the second backup MiniKey token. The second backup MiniKey is a duplicate of the first backup MiniKey. 17. At the Please insert your License Minikey prompt, insert the license MiniKey token. If you selected the option Install as Subordinate CA in the CA Setup dialog box (refer to Installing an Internal Certificate Authority), several dialog boxes appear, necessitating various operations. For detailed instructions, refer to Installing CoSign as a Subordinate CA. If you selected the CA Type to be ChosenSecurity World Wide Verifiable CA in the CA Setup dialog box, several dialog boxes appear, necessitating various operations. For detailed instructions, refer to Using an External World Wide Verifiable CA in Automated Mode ChosenSecurity. If you did not select Automatically synchronize CoSign with the directory to create user database in the Directory Setup dialog box (Figure 17), a message appears, reminding you to perform a manual synchronization. If you did select that option, the installation will generate user accounts and automatically generate keys and certificates for all created users. A progress bar continues to display the progress of the operation. The time needed for creating the users, keys, and certificates depends on the number of users and the selected key length. 18. Click Finish. Note: If the first stage of installation was unsuccessful, the CoSign appliance returns to its factory settings. This enables you to rerun the installation. In this case, the status bar displays that the installation was unsuccessful, and you can click the Back buttons to modify settings before rerunning the installation. If the installation was unsuccessful and you are unable to rerun the installation, restore CoSign to factory settings and then try again. For more information about restoring factory settings, refer to Restoring Factory Settings. Note: Clicking Cancel does not stop the installation process, it only closes the progress bar on the administration machine (unless you specified a subordinate CA installation). 19. In the CoSign Administration MMC window, right-click CoSign appliances and select Refresh from the popup menu. The window refreshes and displays the newly installed appliance. You can now manage CoSign using the CoSign Administration MMC (refer to Chapter 5: Managing the CoSign Appliance).
43
Note: Keep the license MiniKey token plugged into the device at all times. Unplugging the license MiniKey for several hours may shut down the service. Periodically check the number of appliance users. If the number of users is approaching the license limit, contact ARX for a replacement license MiniKey token. Note: In a high availability environment, the licenses of all the CoSign appliances in the high availability site should have an identical limitation on the number of appliance users. Note: Store the backup MiniKey in a separate, secure place (e.g., a safe). In case of disaster, you can use the backup MiniKey and the backup file of the CoSigns database to safely recover and restore CoSign data. For more information on how to backup and restore the CoSigns database, refer to Backing up the CoSign Data. If you lose the backup MiniKey, you will not be able to perform some critical functions, such as restoring the CoSign appliance (even if you a have a backup file), adding an alternate appliance, and performing a reset tamper operation. Therefore, make sure that the backup MiniKey, as well as the second backup MiniKey, will be available when needed.
Installing CoSign in an LDAP based Environment

The solution for LDAP is different from the solution for Microsoft Active Directory or Novell NDS. The creation of a new user account is based on a first access performed by the end user. When the user accesses the CoSign appliance and presents his/her password, the CoSign appliance accesses the LDAP server and presents these credentials. Upon a successful LDAP access, CoSign generates a new account for the user and, depending on the CoSign configuration, generates also a key and a certificate for the end user. When certain attributes in the user record in the directory are modified (such as the user's email address), a new certificate is generated for the user by the CoSign appliance. When the user is deleted from the directory, the user is also deleted from the CoSign appliance and his/her certificate is revoked. In addition, the CoSign appliance also publishes information in the domain, enabling the user to easily access it automatically. For example, it publishes the availability status of the CoSign appliance. The following directories are supported: IBM Tivoli. For more information refer to http://www.ibm.com/software/tivoli/products/directory-server/ Note: The identification of the user in the directory is based on the uid attribute. The common name of automatically generated user certificates is based on the givenName and sn attributes. SUN Directory Server. For more information refer to http://www.sun.com/software/products/directory_srvr_ee/dir_srvr/index.xml
44
Installing CoSign
3
Note: The identification of the user in the directory is based on the uid attribute. The common name of automatically generated user certificates is based on the cn attribute.
Oracle OID (Oracle Internet Directory). For more information refer to http://www.oracle.com/technology/products/oid/index.html Note: The identification of the user in the directory is based on the uid attribute. The common name of automatically generated user certificates is based on the givenName and sn attributes. Note: The following software installation instructions apply for all CoSign Central models, unless otherwise noted. You install the CoSign appliance software from the CoSign Administration MMC. In order to manage CoSign after installation, you must either be a member of the administrators group or be the built-in appliance administrator. Note: Managing users, groups, and stations are features of the LDAP based directory. The LDAP based directory enables you to define which actions users are permitted to perform. While following this installation procedure, make sure that all user permissions are correctly defined in the Directory, as specified in the procedure. To install the CoSign software: 1. Activate the CoSign Administration MMC by opening the Start menu and selecting Programs ARX CoSign CoSign Control Panel. The CoSign Control Panel appears. 2. In the CoSign Control Panel select Appliances Management. The ARX CoSign Appliance Management window appears. 3. Right-click CoSign appliances and select All Tasks Install New LDAP appliance. The CoSign License Agreement appears. 4. Accept the license agreement and click Next. The Network Setup dialog box appears.
45
5. Enter the CoSign appliance IP address. This parameter is necessary for enabling basic communication to and from the CoSign appliance. Note: For information on setting up the IP address of the CoSign appliance refer to Using a Static IP Address and Enabling DHCP. 6. Click Next. The CoSign administrator user dialog box appears.
46
Installing CoSign
7. Enter a user name and a password of a built-in administrator who will manage the CoSign appliance. You will need to enter the password again for confirmation. The built-in administrator is very useful in cases where the LDAP based administrator has a problem connecting to CoSign. Note: Make sure to select an appropriate password for this user since the administrator user name and password that you enter in this dialog box are used for appliance management. During installation, a new user is generated in CoSign with this user name and password. In addition, do not forget this password, since without the password you will not be able to perform any administrative task. 8. Click Next. The Directory Server Information dialog box appears
47
Figure 27 Directory Server Information Dialog Box
9. Enter the following information: Schema The commercial name of the LDAP server. This parameter directs CoSign to the differences between the LDAP implementations when the CoSign appliance interacts with the LDAP Server. Address The DNS name or IP address of the LDAP server. Port The port number of the LDAP server. Usually the port number is 389 or 636 (if LDAP over SSL is used). SSL Select this option if the desired communication between the CoSign appliance and the LDAP server is based on SSL. Authentication Select whether the users password is transmitted to the LDAP server in the clear or using the digest-MD5 method. Base Users DN The base root of the users tree that determines the scope of users in CoSign. 10. Click Next. The CA setup dialog box appears.
48
Installing CoSign
If you want the CoSign appliance to use an internal Certificate Authority (CA) for generating end-user certificates, refer to Installing an Internal Certificate Authority for detailed explanations of the CA setup dialog box. After setting up the internal CA in the CA Setup dialog box, continue with Step 1. 1 If you want the CoSign appliance to use a World Wide Verifiable Certification Authority (CA) for automatically generating end-user certificates, refer to Using an External World Wide Verifiable CA in Automated Mode for detailed explanations of the CA setup dialog box. After configuring the World Wide verifiable CA in the CA setup dialog box, continue with Step 1. 1 If you do not wish the CoSign appliance to use an internal CA, select the Without CA option in the CA type drop-down box. It is highly recommended to read the section Using CoSign in Manual External CA Mode before installing CoSign with this option. 11. Click Next. The CoSign installation begins. A status bar displays the status of the installation operation. During the installation, status messages appear on both the console display (or on the terminal console, for Central Enterprise and Central Starter) and the CoSign Administration MMC display. 12. At the Please insert a backup Minikey prompt, insert the first backup MiniKey token.
49
13. At the Please insert a second backup Minikey prompt, remove the first MiniKey token and insert the second backup MiniKey token. The second backup MiniKey is a duplicate of the first backup MiniKey. 14. At the Please insert your License Minikey prompt, insert the license MiniKey token. If you selected the option Install as Subordinate CA in the CA Setup dialog box (refer to Installing an Internal Certificate Authority), several dialog boxes appear, necessitating various operations. For detailed instructions, go to Installing CoSign as a Subordinate CA. If you selected the CA Type to be ChosenSecurity World Wide Verifiable CA in the CA Setup dialog box, several dialog boxes appear, necessitating various operations. For detailed instructions, refer to Using an External World Wide Verifiable CA in Automated Mode ChosenSecurity. In all other cases, your part in the installation is complete. 15. Click Finish. Note: If the first stage of installation was unsuccessful, the CoSign appliance returns to its factory settings. This enables you to rerun the installation. In this case, the status bar displays that the installation was unsuccessful, and you can click the Back buttons to modify settings before rerunning the installation. If the installation was unsuccessful and you are unable to rerun the installation, restore CoSign to factory settings and then try again. For more information about restoring factory settings, refer to Restoring Factory Settings. Note: Clicking Cancel does not stop the installation process, it only closes the progress bar on the administration machine (unless you specified a subordinate CA installation). 16. In the CoSign Administration MMC window, right-click CoSign appliances and select Refresh from the popup menu. The window refreshes and displays the newly installed appliance. You can now manage CoSign using the CoSign Administration MMC (refer to Chapter 5: Managing the CoSign Appliance). Note: Keep the license MiniKey token plugged into the device at all times. Unplugging the license MiniKey for several hours may shut down the service. Periodically check the number of appliance users. If the number of users is approaching the license limit, contact ARX for a replacement license MiniKey token. Note: In a high availability environment, the licenses of all the CoSign appliances in the high availability site should have an identical limitation on the number of appliance users.
50
Installing CoSign
Note: Store the backup MiniKey in a separate, secure place (e.g., a safe). In case of disaster, you can use the backup MiniKey and the backup file of the CoSigns database to safely recover and restore CoSign data. For more information on how to backup and restore the CoSigns database, refer to Backing up the CoSign Data. If you lose the backup MiniKey, you will not be able to perform some critical functions, such as restoring the CoSign appliance (even if you a have a backup file), adding an alternate appliance, and performing a reset tamper operation. Therefore, make sure that the backup MiniKey, as well as the second backup MiniKey, will be available when needed. In Microsoft Active Directory or Novell NDS, user keys and certificates are generated during the installation of the CoSign appliance. In the case of LDAP based installation, only the administrator account is generated. A new CoSign user is generated when this user attempts to access the CoSign appliance. After successfully authenticating the user against the LDAP server, the CoSign appliance generates an account for the user and may generate a key and a certificate for the user, depending on the CoSign appliance configuration. Note: In a Sun One directory installation, you will need to update some system parameters for enabling CoSign to access the LDAP based directory. Connect to the appliance administration using the local CoSign administrative account. Fill in the parameters LDAP CoSign User Name and LDAP CoSign User Password with an administrative account that can perform queries to the directory. For more information, refer to LDAP in Changing CoSign System Parameters.
51
3
Installing CoSign in a Directory Independent Environment
The cases where CoSign is installed in a Directory Independent environment fall into two categories: CoSign is integrated into a product that has its own user management capabilities. User management of the product is not based on Microsoft Active Directory, Novell NDS, or LDAP. In this case, CoSign provides an external API called SAPI (Signature API) that enables the integrator to insert a user into CoSign upon the creation of a new user in the system. All other user management APIs such as updating a user, deleting a user, etc., are supported through SAPI. For information on SAPI, refer to the CoSign Programmer Guide. CoSign is integrated into a product with no user management capabilities. In these cases, the administrator will use a CoSign GUI utility to manage the internal CoSign users. Refer to Using the Users Management Utility. To install the CoSign software: 1. Activate the CoSign Administration MMC by opening the Start menu and selecting Programs ARX CoSign CoSign Control Panel. The CoSign Control Panel appears. 2. In the CoSign Control Panel select Appliances Management. The ARX CoSign Appliance Management window appears. 3. Right-click CoSign appliances and select All Tasks Install New Directory Independent appliance. The CoSign License Agreement appears. 4. Accept the license agreement and click Next. The Network Setup dialog box appears.
52
Installing CoSign
5. Enter the CoSign appliance IP address. This parameter is necessary for enabling basic communication to and from the CoSign appliance. Note: For information on setting up the IP address of the CoSign appliance, refer to Using a Static IP Address and Enabling DHCP.
53
6. Click Next. The CoSign Administrator User dialog box appears.
7. Enter the CoSign Admin user name and Admin password, then enter the password again for confirmation. This user will perform the administrative tasks. Note: Make sure to select an appropriate password for this user since the administrator user name and password that you enter in this dialog box are used for the appliance management. During installation, a new user is generated in CoSign with this user name and password. 8. Click Next. The CA setup dialog box appears.
54
Installing CoSign
If you want the CoSign appliance to use an internal Certificate Authority (CA) for generating end-user certificates, refer to Installing an Internal Certificate Authority for detailed explanations of the CA setup dialog box. After setting up the internal CA in the CA setup dialog box, continue with Step . 9 If you want the CoSign appliance to use a World Wide Verifiable Certification Authority (CA) for automatically generating end-user certificates, refer to Using an External World Wide Verifiable CA in Automated Mode for detailed explanations of the CA setup dialog box. After configuring the World Wide verifiable CA in the CA setup dialog box, continue with Step . 9 If you do not wish the CoSign appliance to use an internal CA, select the Without CA option in the CA type drop-down box. It is highly recommended to read the section Using CoSign in Manual External CA Mode before installing CoSign with this option. 9. Click Next. The CoSign installation begins. A status bar displays the status of the installation operation. During the installation, status messages appear on both the console display (or on the terminal console, for Central Enterprise and Central Starter) and the CoSign Administration MMC display. 10. At the Please insert a backup Minikey prompt, insert the first backup MiniKey token.
55
11. At the Please insert a second backup Minikey prompt, remove the first MiniKey token and insert the second backup MiniKey token. The second backup MiniKey is a duplicate of the first backup MiniKey. 12. At the Please insert your License Minikey prompt, insert the license MiniKey token. If you selected the option Install as Subordinate CA in the CA Setup dialog box (refer to Installing an Internal Certificate Authority), several dialog boxes appear, necessitating various operations. For detailed instructions, refer to Installing CoSign as a Subordinate CA. If you selected the CA Type to be ChosenSecurity World Wide Verifiable CA in the CA Setup dialog box, several dialog boxes appear, necessitating various operations. For detailed instructions, refer to Using an External World Wide Verifiable CA in Automated Mode ChosenSecurity. In all other cases, your part in the installation is complete. 13. Click Finish. Note: If the first stage of installation was unsuccessful, the CoSign appliance returns to its factory settings. This enables you to rerun the installation. In this case, the status bar displays that the installation was unsuccessful, and you can click the Back buttons to modify settings before rerunning the installation. If the installation was unsuccessful and you are unable to rerun the installation, restore CoSign to factory settings and then try again. For more information about restoring factory settings, refer to Restoring Factory Settings. Note: Clicking Cancel does not stop the installation process, it only closes the progress bar on the administration machine (unless you specified a subordinate CA installation). 14. In the CoSign Administration MMC window, right-click CoSign appliances and select Refresh from the popup menu. The window refreshes and displays the newly installed appliance. You can now manage CoSign using the CoSign Administration MMC (refer to Chapter 5: Managing the CoSign Appliance). 15. Activate the ARX CoSign Users Management utility to add users and automatically generate keys and certificates for these users (refer to Using the Users Management Utility). The created CoSign users can connect to Cosign and perform digital signature operations. Note: Keep the license MiniKey token plugged into the device at all times. Unplugging the license MiniKey for several hours may shut down the service. Periodically check the number of appliance users. If the number of users is approaching the license limit, contact ARX for a replacement license MiniKey token.
56
Installing CoSign
Note: In a high availability environment, the licenses of all the CoSign appliances in the high availability site should have an identical limitation on the number of appliance users. Note: Store the backup MiniKey in a separate, secure place (e.g., a safe). In case of disaster, you can use the backup MiniKey and the backup file of the CoSigns database to safely recover and restore CoSign data. For more information on how to backup and restore the CoSigns database, refer to Backing up the CoSign Data. If you lose the backup MiniKey, you will not be able to perform some critical functions, such as restoring the CoSign appliance (even if you a have a backup file), adding an alternate appliance, and performing a reset tamper operation. Therefore, make sure that the backup MiniKey, as well as the second backup MiniKey, will be available when needed.
Installing an Internal Certificate Authority

The CA Setup dialog box appears during the course of CoSign software installation. It enables setting up the CoSign appliance to use an internal Certificate Authority (CA) for generating end-user keys and certificates. This section describes in detail the various options available in the dialog box.
To specify an Internal CA: 1. Specify Internal CA in the CA type field.
57
3
2. Enter the following information:
CA name The identifying name of CoSigns internal CA. This name will also be displayed as the Issuer Name in the certificates issued by the CoSign appliance. Organization The CAs organization. This field is included in the CAs certificate. This field is optional.
Organizational Unit The organizational unit of the CA. This field is included in the
CAs certificate. This field is optional. Note: The Organizational Unit parameter in the certificate does not have to be identical with the OU selection of users field in the Microsoft Active Directory or Novell NDS Directory, which is provided during the Directory Setup. Country The CAs country. This field is included in the CAs certificate. Users key size (bits) The size, in bits, of the end-users generated keys. Bigger RSA keys result in larger digital signatures and higher security. However, this results in an slower overall performance. Currently, the maximum user key size is 4096 bits. If the CoSign hardware type is CoSign Central SSCD, you can define either 1024 or 1792 for the key size. Key type The default Key Type is Secure. If the CoSign hardware type is CoSign SSCD, you can select the key type as SSCD. In this case, the users key will be generated on an internal SmartCard upon user enrollment. For more information about user key enrollments in SSCD hardware, refer to Chapter 4: Deploying the CoSign Client. In a regular CoSign appliance the option Secure is the only option. Use Default Settings for CDP and AIA Locations Select whether to use the default settings for the AIA (Authority Information Access) and CDP (CRL Distribution Point) locations. If you choose not to use the default settings, enter the desired settings: AIA Location AIA (Authority Information Access) is put into the end users certificate and specifies where the CoSign CA certificate is located in the organizations network. The AIA can be accessed using either HTTP protocol, LDAP protocol, a file in the organizations network, or a local file in the end users hard disk. The value entered in this field will be included in every end users certificate that is generated by CoSign. Deselecting the Use Default Settings for CDP and AIA Locations option while leaving this entry empty, triggers a null AIA in the end users certificate. The default value in the case of Active Directory or Novell NDS includes the LDAP location. If the default is not modified, the CoSign installation will also put the CoSign ROOT certificate in the proper LDAP location. In a Directory Independent environment, the default is an empty entry. If the administrator decides to change the AIA default value, the administrator must place the CA certificate in the location specified in the AIA. In addition,
58
Installing CoSign
whenever the CA certificate is renewed, the administrator must place it in the location specified in the AIA. CDP Location CDP (CRL Distribution Point) is put into the end users certificate and specifies where the CoSign CAs CRL (Certificate Revocation List) is located in the organizations network. The CDP can be accessed using either HTTP protocol, LDAP protocol, a file in the organizations network, or a local file in the end users hard disk. The value entered in this field will be included in every end users certificate that is generated by the CoSign. Deselecting the Use Default Settings for CDP and AIA Locations option while leaving this entry empty, triggers a null CDP in the end user certificate. The default value in the case of Active Directory or Novell NDS includes the LDAP location. If the default is not modified, CoSign will constantly update the CDP with the updated CRL. In a Directory Independent environment, the default is an empty entry. If the administrator decides to change the CDP default value, the administrator must place the CRL in the location specified in the CDP.
For details on obtaining the CoSign AIA and CRL, refer to Changing CoSign System Parameters. CA key size (bits) The size of the key of the CA. Install as Subordinate CA Select this option if you wish to install the CoSign CA as a subordinate CA. You can install the CoSign CA as a subordinate CA of another CA (who can be a subordinate CA of another CA, etc.). This option is useful if you are installing CoSign in an organization with an existing CA or in cases where a national CA certifies organizational CAs, and you wish to integrate into the existing infrastructure. Note: Selecting the Install as Subordinate CA option will necessitate performing various tasks before installation is complete. These tasks are described in detail in Installing CoSign as a Subordinate CA. After completing CA Setup, return to the software installation procedure as follows: If you are installing CoSign in a Microsoft Active Directory Environment, continue with Step 3. 1 If you are installing CoSign in a Novell-NDS Environment, continue with Step 4. 1 If you are installing CoSign in an LDAP based Environment, continue with Step 1. 1 If you are installing CoSign in a Directory Independent Environment, continue with Step . 9
59
3
Advanced Settings
The Advanced option available from the CA Setup dialog box enables the administrator to control additional configuration parameters used by the CoSign installation. These parameters enable sending email notifications to end users during and after installation, and defining SSL proxy parameters that are relevant when CoSign is configured to use a Worldwide Verifiable External CA in automated mode.
Figure 33 Advanced Settings Dialog Box
Enable Email Notification Check this option to direct CoSign to send email notifications to end users. Enter the following information: Mail server name IP address or DNS name of the organizations mail server. Mail server port The port number of the organizations mail server. Email from address The address from which to send email notifications to users. Enable the server to use proxy for internet access check this option to enable CoSign to communicate with the internet through an SSL proxy. This option is relevant for cases where CoSign is configured to use a Worldwide Verifiable CA in automatic mode, and the organization communicates via the Internet through an SSL proxy. As of version 5, you can use proxies that require a user name and password authentication before communicating with the external HTTPS server. Proxys address The IP address or DNS name of the organizations SSL proxy.
60
Installing CoSign
3
Port The port number of the organizations SSL proxy. User name The identity of the user being verified by the proxy. User password The password of the user being verified by the proxy.
Using an External CA in Manual Mode

If CoSign is installed in an environment where an external CA is used in manual mode, the CoSign appliance will generate an empty account for the signing users, but will not generate signature keys or certificates. Each authenticated user of the appliance will need to manually enroll for a certificate. The certificate generation process is as follows: The user communicates with the certificate enrollment pages of the CA using client tools that are executed in the end-users PC. One example of such a tool is a regular browser. During enrollment, a command to generate a key is sent from the CoSign client to the CoSign appliance. The CoSign appliance securely generates a signature key for the user, and a certificate request is sent by the CoSign client to the external CA using the CA interface. The CA interface is usually a web-based interface. The external CA generates a certificate and sends it to the user. The user imports the certificate to the CoSign appliance using the CA application. This is usually a web-based application. After the certificate is uploaded to the CoSign appliance, the user can sign normally using the newly uploaded certificate. In this mode of work, the user must repeat this procedure upon certificate renewal.
Using an External World Wide Verifiable CA in Automated Mode

The CA Setup dialog box appears during the course of CoSign software installation. It enables setting up the CoSign appliance to use an external CA whose ROOT certificate is automatically installed in many workstations. In this way, a document that is signed using CoSign can be properly verified without having to install CoSign ROOT certificate in all third-party workstations that need to verify the signature of the document. In this work mode, the end users keys are generated inside the CoSign appliance. Immediately after the key is generated, a certificate request is sent to the external CA. The external CA replies with the user certificate. After the certificate is returned to the CoSign from the external CA, the end user can start signing documents. Two external World Wide Verifiable CAs are available in automated mode: Comodo.
61
3
ChosenSecurity.
The following sections explain how to specify each as the external World Wide Verifiable CA.
Using an External World Wide Verifiable CA in Automated Mode - Comodo

The CA Setup dialog box appears during the course of CoSign software installation. It enables setting Comodo as the external World Wide Verifiable CA in automated mode.
Figure 34 CA Setup Comodo World Wide Verifiable CA Dialog Box
To specify the Comodo Word Wide Verifiable CA: 1. Specify Comodo World Wide Verifiable CA in the CA type field. 2. Enter the following information: CA User Name Contact ARX for a special user ID for communication with the external CA.
CA User Password Contact ARX for a password for authenticating the organization
to the external CA. Users key size (bits) The size, in bits, of the end-users generated keys. Bigger RSA keys result in larger digital signatures and higher security. However, this results in slower overall performance. Currently, the maximum user key size is 4096 bits. If the CoSign hardware type is CoSign SSCD, you can specify either 1024 or 1792 for the key size.
62
Installing CoSign
3
Key type The default Key Type is Secure. If the CoSign hardware type is CoSign SSCD, you can select the key type as SSCD. In this case, the users key will be generated on an internal SmartCard upon user enrollment. For more information about user key enrollments in SSCD hardware, refer to Chapter 4: Deploying the CoSign Client.
After completing CA Setup, return to the software installation procedure as follows: If you are installing CoSign in a Microsoft Active Directory Environment, continue with Step 3. 1 If you are installing CoSign in a Novell-NDS Environment, continue with Step 4. 1 If you are installing CoSign in an LDAP based Environment, continue with Step 1. 1 If you are installing CoSign in a Directory Independent Environment, continue with Step . 9
Using an External World Wide Verifiable CA in Automated Mode ChosenSecurity

The CA Setup dialog box appears during the course of CoSign software installation. It enables setting ChosenSecurity as the external World Wide Verifiable CA in automated mode. Note: The process of setting ChosenSecurity as the external World Wide Verifiable CA involves direct interaction with ChosenSecurity (http://www.chosensecurity.com). For more information on ChosenSecurity, refer to the TC TrustCenter ID Store Administrator Manual.
Figure 35 CA Setup ChosenSecurity World Wide Verifiable CA Dialog Box
63
3
To specify the ChosenSecurity Word Wide Verifiable CA:
1. Specify ChosenSecurity World Wide Verifiable CA in the CA type field. 2. Enter the following information: Users key size (bits) The size, in bits, of the end-users generated keys. Bigger RSA keys result in larger digital signatures and higher security. However, this results in slower overall performance. Currently, the maximum user key size is 4096 bits. If the CoSign hardware type is CoSign SSCD, you can specify either 1024 or 1792 for the key size. Key type The default key type is Secure. If the CoSign hardware type is CoSign SSCD, you can select the key type as SSCD. In this case, the users key will be generated on an internal SmartCard upon user enrollment. For more information about user key enrollments in SSCD hardware, refer to Chapter 4: Deploying the CoSign Client. The following prompt appears:
At this stage the installation is postponed until an authentication key is uploaded to the CoSign appliance. No user information is generated, and thus no user can perform a digital signature operation until the installation is complete. 3. Create a new account for the organization in ChosenSecurity, as described in Creating a New Account for the Organization in ChosenSecurity. 4. Enable CoSign to interface with the ChosenSecurity Service, as described in Enabling CoSign to Interface with the ChosenSecurity Service. 5. Upload CA information to CoSign, as described in Uploading CA Information to CoSign. At the end of the process, CoSign will be fully interfaced with the ChosenSecurity service for the purpose of automatically managing CoSign users certificates.
Creating a New Account for the Organization in ChosenSecurity
To create a new account for the organization in ChosenSecurity: 1. Contact ChosenSecurity (http://www.chosensecurity.com) and request an account initiation. You will receive an account name. Usually the name of the account indicates your organization. You will also be provided with a special web link to your organizational account in the ChosenSecurity portal. In addition, you will receive an administrative profile. The profile is supplied with an initial login password.
64
Installing CoSign
2. Login to your administrative profile and change your password. 3. You can optionally enhance the security of accessing the portal by using a smartcard or software token installed in your local PC. Contact ChosenSecurity for details on this option. The administrative profile enables you to view the status of all certificates that are linked to this account. You should not perform any direct action on these certificates. These certificates are managed solely by the CoSign interface.
Enabling CoSign to Interface with the ChosenSecurity Service
To enable CoSign to interface with the ChosenSecurity Service: You now have to define parameters that will enable your CoSign appliance to communicate with the ChosenSecurity service automatically. 1. In the ChosenSecurity portal, create a new dedicated user, with UserName = apiUser. This user represents the CoSign appliance, and the new account is the CoSign account. 2. Set a login password for apiUser. Your contact at ChosenSecurity will make sure that this user has the necessary access rights to enable CoSign to interact with the ChosenSecurity service. 3. For the CoSign account, coordinate the following administrative issues with your ChosenSecurity contact: The maximum number of overall generated certificates. The product type. The product defines the default certificate template that should be used for digital signature operations. It is recommended to use the product ID that permits an empty email value. Note: For any other certificate template requirement, contact ARX, since any usage of a non default value may affect your ability to interface with the external CA. 4. Logon to the ChosenSecurity portal with user apiUser and request an authentication certificate, as follows: Select the Request Certificate tab Select the product TC , Business ID, recoverable, 1yr. Make sure that you select the product containing the word recoverable. You will receive two emails, one containing a protection password and the other containing a link for downloading a secured authentication key file in PKCS#12 format . The protection password will be required when downloading the key file. 5. Save the PKCS#12 authentication key file to your hard disk. 6. Connect to the apiUser profile in the ChosenSecurity portal and select the My Profile section. Select Authentication Details and set the Login Certificate field to contain the Distinguished Name of the PKCS#12 authentication key file.
65
3
Uploading CA Information to CoSign
You should now upload the CA information to CoSign using the CoSign Administration MMC. 1. Open the Start menu and select Programs ARX CoSign CoSign Control Panel. 2. In the CoSign Control Panel, select Appliances Management. The ARX CoSign Appliance Management window appears, showing all installed CoSign appliances (Figure 36). Note that the current state of the CoSign installation is Waiting for PFX from CA.
Figure 36 ARX CoSign Appliance Management Window Waiting for PFX From CA
3. Right-click the CoSign appliance, and select All Tasks Upload CA Information. The Upload CA Information window appears:
Figure 37 Upload CA Information Window
4. Enter the following information: PKCS#12 file (.pfx) Browse to the PKCS#12 authentication key file provided by the ChosenSecurity portal. File Password Enter the protection password provided by the ChosenSecurity portal. Account Name Enter the exact name of your account at ChosenSecurity. Account Owner Email Enter the email address of the administrative profile.
66
Installing CoSign
5. If either Active Directory or Novell NDS is used, perform a manual synchronization (refer to Synchronizing CoSign with the Directory Service). This operation will result in CoSign generating a signature key for each user and receiving a certificate for this user from ChosenSecurity. In a Directory Independent environment, you must activate the Users Management utility to create CoSign users and generate keys and certificates for them (refer to Using the Users Management Utility). Note: In an LDAP environment or Active Directory multiple domain environment, a new account is generated when the end user first attempts to connect to CoSign. Note: It is very important to save the Account Name and Account Owner Email of your organizational account (shown in Figure 37). You will need these when your authentication key file expires and you need to renew it. For more information on how to renew your authentication key file, refer to Renewing the ChosenSecurity Authentication Key File. .Note: Make sure to keep the password of the apiUser profile. The password will be needed at the renewal stage. At that stage, you will need to logon to the apiUser profile and request a new authentication key.
Installing CoSign as a Subordinate CA

This section applies to users who selected the option Install as Subordinate CA in the CA Setup dialog box (refer to Installing an Internal Certificate Authority). The sections describing the software installation process in each of the four environments (Active Directory, Novell, LDAP, and Directory Independent) refer you to this section just before the end of the installation process, after inserting the license MiniKey token. You are prompted to perform the following tasks, after which CoSign installation is complete: 1. A File Selection dialog box appears, prompting you to supply the name of the file that will contain the Certificate Request (CRQ) that should be submitted to the ROOT CA. Prior to this step, the CoSign appliance internally generated a key for the CoSign CA, and then created a certificate request based on the generated key. CoSign then exported the CRQ that should be sent to the ROOT CA. 2. Specify the name of the CRQ file. The Subordinate CA Installation dialog box appears:
67
Figure 38 Subordinate CA Installation Dialog Box
The Subordinate CA Installation dialog box lists the tasks you still need to perform before CoSign users can be created. The following steps describe those tasks. 3. Exit the CoSign Administration MMC. 4. Submit the Certificate Request to the ROOT CA by providing the CRQ file. The files you will eventually receive back from the ROOT CA include a group of files that constitute the complete chain of CA certificates, and the Certificate Reply file that contains the new CoSign subordinate CA certificate. The CoSign subordinate CA certificate can also be packaged in certificate format (.cer) and not necessarily in a certificate reply format (.crp). Note that if a ROOT CA certified CoSign, the complete chain of CA certificates includes only the ROOT CA certificate. Note: Make sure that the certificate reply contains only the CoSign certificate and does not contain any of the certificates that are part of the certificate chain. The certificates in the certificate chain are loaded separately. Note: The file formats of the certificate and certificate chain must be ASN.1(DER) encoded. If the files are encoded in BASE64 format, they must be converted. If the CoSign subordinate CA certificate is encoded in BASE64 format, you can use the Microsoft standard certificate information utility to browse to that BASE64 certificate, and use the copy to file option to save the certificate to a DER encoded certificate. 5. Once you receive the files from the ROOT CA, activate the CoSign Administration MMC by opening the Start menu and selecting Programs ARX CoSign CoSign Control Panel. Select Appliances Management, and the ARX CoSign Appliance Management window appears. 6. For each file in the chain of CA certificates, perform the following:
Right-click the relevant CoSign appliance and select All Tasks Subordinate CA
Load ROOT Cert Chain.
68
Installing CoSign
Figure 39 Subordinate CA Installation Loading the CA Certificates
A file selection window pops up. Specify the path and file name of the CA certificate. After each certificate is loaded, the following message appears: Uploading root certificate
chain finished successfully.
7. Right-click CoSign appliances and select All Tasks Subordinate CA Upload Certificate Reply. A dialog box appears, prompting you to specify the Certificate Reply file, which contains the new CoSign subordinate CA certificate. 8. Specify the path and file name of the Certificate Reply. A message appears: Waiting for the CA service to restart and soon after CoSign proceeds with the installation process. In an Active Directory or Novell-NDS environment, CoSign now automatically creates CoSign users and generates keys and certificates for them. In a Directory Independent environment, you must activate the Users Management utility to create CoSign users and generate keys and certificates for them (refer to Using the Users Management Utility). Note: In an LDAP environment or Active Directory multiple domain environment, a new account is generated when the end user first attempts to connect to CoSign. At the end, the following message is displayed: Uploading certificate reply finished successfully. The created CoSign users can now connect to CoSign and perform digital signature operations. Note: Keep in mind that setting up CoSign as a subordinate CA requires further administrative attention. The subordinate CA certificate should be renewed according to the ROOT CA policy. It is recommended to start the renewal process a month before certificate expiration.
69
3
Multi-Language Support
You can deploy CoSign in environments that allow the use of non-ASCII characters in fields such as the users common name in the certificate, etc. However, due to system limitations, there are cases where multi-language environments cannot be supported. For more information about these limitations, refer to the CoSign release notes.
70
Chapter 4: Deploying the CoSign Client

This chapter describes how to: Deploy the CoSign Client, in a Microsoft-Active Directory environment, Novell-NDS environment, LDAP based environment, or a Directory Independent environment. Use the CoSign Control Panel. Use the graphical signature management application that enables setting a graphical signature for users of the organization. Install the ROOT certificate to validate CoSign signatures in an organization without CoSign. Use CoSign Verifier to validate digital signatures that were attached to Microsoft Office documents using CoSign. Note: The installation of CoSign differs slightly depending on whether it is being installed in a Microsoft Active Directory environment, Novell NDS environment, LDAP based environment, or Directory Independent environment. These differences are mentioned where applicable.
Deploying the Client

CoSign enables the end-user to digitally sign transactions, documents, and other types of data. In order to perform these tasks, the CoSign client must be installed. The CoSign client enables applications (e.g., Microsoft Word) to use CoSign for generating digital signatures. For more information on generating signatures in third-party applications, refer to the CoSign User Guide. The CoSign client may be installed on a machine using one of the following operating systems: Windows XP Professional. Windows 2003. Windows VISTA. Windows 2008/Windows 2008-R2 Windows 7 Note: The CoSign client can be also be installed in any 64 bit variant of the above operating systems, such as Windows Vista 64 bit or Windows 7 64 bit
Deployment Options
The CoSign client can be deployed on an end-user machine, a terminal server, a Web server, or an application server.
71
4
On an End-User Machine
Deploying the client on an end-user machine enables end-users to use CoSign for generating digital signatures on documents, transactions, or other types of data. Each client installation generally services one end-user.
On a Terminal Server
Deploying the client on a terminal server (e.g., Citrix Server or Microsoft Terminal Server) enables multiple users to concurrently use CoSign for signing and validating signatures. This circumvents the need to install the client on each end-users machine. End-users connect to the terminal server and use the installed applications (e.g., Microsoft Word or Outlook) remotely. If the end-user wishes to sign a document, the signature is attached in the terminal server via the installed CoSign client.
On a Web Server
You can deploy the CoSign client on a Web server. This enables multiple end-users to use CoSign for generating signatures in Web applications without deploying the client on every end-users machine, and without requiring the end-user machines to be part of the domain. ARX provides a digital signature API through a C/C++ interface or COM interface. This API is called Signature API (SAPI) and is explained in detail in the CoSign Programmer Guide. When the end-user wants to add a digital signature, the Web application prompts the end-user for a login name and password. Through the SAPI-COM interface, the Web server creates a signature using CoSign by providing the end users credentials (User ID, password, and domain name). The digital signature value can then be attached to the signed data by the Web application. In addition, a web server can use CoSign through a Web Services interface, which is executed in the CoSign appliance. For more information, refer to the CoSign Programmers Guide.
Installing the CoSign Client

The CoSign Client can either be installed directly from the ARX CoSign CD or automatically using a centralized mechanism. Regardless of how the client is deployed, the client must be installed on the appropriate machine with all the relevant plug-ins. Note: You must have local administrative rights in order to install the CoSign client. Note: If the CoSign internal CA is used for generating end users certificates, then for all environments except Microsoft Active Directory, the ROOT certificate must be manually installed on every workstation on which a CoSign client is installed. Refer to Extracting the ROOT Certificate to a File and Installing the ROOT Certificate.
72
Deploying the CoSign Client
CoSign Client Components

The CoSign Client CD displays a CoSign Client Components Installation screen when the CoSign Client CD is inserted into the CD driver. Each CoSign component is based on several .msi files. The .msi files are based on the Microsoft Software Installation technology. The components include: ARX CoSign Client The standard CoSign client installation without any plug-ins. The installation includes the following .msi files: ARX CryptoKit Provides the basic standard Cryptographic APIs, which include PKCS#11 and MS-CAPI. These API enable off-the shelf products, such as MS Outlook and MS Office XP/2003, to use CoSign without any integration efforts. For more information about ARX CryptoKit, refer to the ARX CryptoKit documentation. The CryptoKit installation file name is ARX CryptoKit Basic.msi. The 64bit CryptoKit installation file name is ARX CryptoKit Basic64.msi. ARX CoSign Client.msi Provides the basic functionality for interfacing with the CoSign appliance. The ARX CoSign client installation file name for 64bit operating systems is ARX CoSign Client64.msi. ARX Signature API.msi Provides signature APIs for enabling OEMs to use CoSign with a minimal development effort. The APIs also include a COM-based interface that enables Web applications to use CoSign. The Signature API installation file name for 64bit operating systems is ARX Signature API64.msi. For more information about the Signature API, refer to the CoSign Programmers Guide. ARX CoSign admin Enables administrators to install and manage CoSign. The installation and management activities are described in Chapter 3: Installing CoSign and Chapter 6: Using the CoSign Console. The ARX CoSign admin component is based on the following .msi files: ARX CoSign Admin Client.msi Includes all the administrative components of CoSign. For example, it includes the CoSign Administration MMC for managing the CoSign Appliance. ARX Signature PAD.msi Includes all the software necessary for installation of the graphical signature pad and the utility that controls the pad. For more information, refer to Using the Graphical Signature Management Application.
73
Microsoft Office (Word, Excel, InfoPath) Three types of plug-ins are supported: ARX Signature Line Provider A digital signature plug-in for Office 2007 for the .docx and .xlsx file types. ARX Legacy Word Add-in A digital signature plug-in for Word XP/2003/2007 and Excel XP/2003/2007 that enables you to sign .doc and .xls files. Digital signature support for Microsoft InfoPath forms. For more information, refer to Signing Microsoft Office Documents and Signing InfoPath Forms in the CoSign User Guide. ARX OmniSign Printer A plug-in for signing any printable data from any application. For more information, refer to OmniSign Sign Any Printable Data, Anywhere in the CoSign User Guide. The ARX OmniSign printer file name for 64 bit operating systems is ARX OmniSign Printer64.msi.
Installation Pre-requisites
To perform signatures using Office 2007 upon .docx or .xlsx files, it is mandatory to install .NET Framework version 2 or above in the client machine. The client installation prompts the end user to automatically install .NET framework 2 if it is not already installed. To perform signatures upon .docx or .xlsx files using SAPI, it is mandatory to install .NET Framework version 3 in the client machine. The installation is not performed automatically by the CoSign client installation and should therefore be performed by the user. To perform signatures upon .xml files using SAPI, it is mandatory to install .NET Framework version 2 in the client machine. The installation is not performed automatically by the CoSign client installation and should therefore be performed by the user. If you intend to use the ARX add-in for Microsoft office, you should include the component called "Visual Basic for applications" when installing Microsoft Office. This component is included in the Microsoft Office installation by default.
Installing the Client Directly from the CD

To install the CoSign client directly from the CD: 1. Insert the ARX CoSign CD into the CD drive. The following CoSign Client Components Installation screen appears:
74
Figure 40 CoSign Client Components Installation Screen
2. Select the components you wish to install, based on the designation of the current workstation. Keep in mind the following: The ARX CoSign Client component is always selected. If the workstation is an administrative workstation, select the ARX CoSign Admin component. If the workstation is a user workstation, select the applicable components: Microsoft Office, or ARX OmniSign Printer. Note: The Microsoft Office component is automatically selected if Microsoft Office is installed in the end-user machine. Note: The OmniSign Printer component installs a new virtual printer in the end-users machine. 3. Click Install Now. When installation is complete, a appears next to each of the installed components. In case of a failure, an X appears next to the relevant components and a summary information box appears. Alternatively, you can place the contents of the CoSign CD on the network so that end users can install the CoSign Client through the network. While this method eliminates the need to use the CD for each installation, it does not facilitate automatic installations of the software.
75
4
Automatically Deploying the Client in Active Directory
Refer to Appendix B: Centralized Installation from Active Directory for information on how to automatically deploy the CoSign Client on end user platforms that are joined to the Microsoft Domain.
Uninstalling the CoSign Client

Uninstall the CoSign client either locally, or automatically using Microsoft Active Directory.
Uninstalling the CoSign Client locally:

To uninstall the CoSign client locally: 1. Open the Start menu and select Programs ARX CoSign Uninstall CoSign
Components.
2. A confirmation box appears. Click Yes to uninstall. The uninstalling process begins. 3. When the CoSign Client is uninstalled from the workstation, a message box appears to inform you that the system finished uninstalling. Click OK.
Uninstalling the Client in an Active Directory Environment

Refer to Appendix B: Centralized Installation from Active Directory for information on how to centrally instruct all clients to uninstall their CoSign client installation.
Distributing CoSign Information Through the SCP

The CoSign client requires some basic information about the CoSign appliance in order to be able to communicate with it. For example, it must know the IP address of the CoSign appliance. When CoSign is installed in Microsoft Active Directory or Novell NDS environments, all CoSign appliances update a specific location in the directory called SCP (Service Connection Point) with the necessary information. The CoSign Client automatically updates itself with the necessary information from the SCP. The following sections provide a description of SCP usage in Microsoft Active Directory and Novell NDS. In an LDAP or Directory Independent environment, you must manually configure each CoSign client with the necessary information using the Configuration Utility (refer to Chapter 8: CoSign Configuration Utility). If you wish, you can also use the Configuration Utility to manually configure each CoSign client in an Active Directory or Novell-NDS environment. Note: You can use the administrative configuration utility to generate a configuration and distribute it to clients using either a group policy or through other mechanisms such as a login script. For more information, refer to Appendix B: Centralized Installation from Active Directory.
76
Microsoft Active Directory SCP

To view the CoSign SCP in a Microsoft Active Directory: 1. In the CoSign Administration MMC, navigate to Active Directory Sites and Services Services NetServices. The list of CoSign appliances in the network is displayed. Each CoSign appliance is listed under the name CoSign Service Connection Point For CSN00001 where CSN0001 is the specific CoSign serial number.
Figure 41 Active Directory SCP
Each entry in the list represents a CoSign appliance. The following information is available about each CoSign appliance (the information can not be viewed through the Net Services window): CoSign IP address. CoSign listening port number. CoSign availability status (Up or Down). Note: In rare cases where the CoSign availability status does not reflect the actual status of the appliance, you can manually set the Up/Down state of a CoSign appliance using the setscp utility. Refer to SetSCP in Chapter 5: Managing the CoSign Appliance. CoSign prompt for logon parameter value Directs the client whether to present a logon popup window for accessing CoSign, or whether to use Microsoft mechanisms. CoSign prompt for sign parameter value Directs the client whether to display a password window for every signature operation.
77
The SCP information is updated by each CoSign appliance upon installation and upon any modification. If a CoSign appliance is replaced by another appliance or removed from the organizational network, it is recommended to delete the appropriate entry. This ensures that CoSign clients will not attempt to connect to irrelevant appliances.
Novell NDS SCP

In Novell there is a similar infrastructure that manages a list of all installed CoSign appliances and includes necessary client information. All data is listed in the NetSVC infrastructure.
78
Using the CoSign Control Panel

All client-based operations are activated through the CoSign Control Panel.
Figure 42 CoSign Control Panel
Some Control Panel options are always active, while others are active depending on the status of the CoSign appliance (Installed/Not Installed) or the type of CoSign appliance installation (Microsoft Active Directory, Novell NDS, LDAP, or Directory Independent). The following sections describe the actions available from the CoSign Control Panel:
User Actions
Client Configuration This option enables the end user to configure the CoSign client settings. Refer to Chapter 8: CoSign Configuration Utility for more information.
79
Graphical Signatures This option enables both end users and administrators to manage personal graphical signatures. For more information, refer to Using the Graphical Signature Management Application. Change Password This option is relevant only in the case of a Directory Independent environment. For more information, refer to Directory Independent Environment Options. OmniSign Settings This option activates the OmniSign application in configuration mode. In this mode the user can setup the appearance and other parameters related to the digital signature created using OmniSign. For more information related to OmniSign, refer to OmniSign Sign Any Printable Data, Anywhere in the CoSign User Guide. Logoff This option logs off from the session. This option is relevant when CoSign is installed in a Directory Independent environment, Novell NDS environment, or any other configuration where the user needs to login manually.
Designer Actions
Design InfoPath Templates This option is relevant for the design of InfoPath templates that include CoSign based digital signatures. Refer to Signing InfoPath Forms in the CoSign User Guide.
Administrator Actions
Note: The Administrator Actions are relevant only if the administrative client is installed. Appliances Management This option displays the CoSign Administration MMC. Using the CoSign Administration MMC it is possible to install or restore the appliance, or manage it in operation mode. Refer to Chapter 3: Installing CoSign and Chapter 5: Managing the CoSign Appliance for more information related to the CoSign Administration MMC. Users Management This option activates the CoSign Users Management application. This application is mandatory when CoSign is installed in a Directory Independent environment, but can also help the administrator to view users statuses in all other installation environments. Client Configuration Management This option activates the CoSign Configuration Utility in administrative mode. For more information, refer to Chapter 8: CoSign Configuration Utility.
80
CoSign Control Panel Menu Bar
Figure 43 CoSign Control Panel Menu Bar
The User, Designer and Admin options of the CoSign Control Panel menu bar display all the options that can be activated from the Control Panel. In addition, the Tools option includes two options. Options This enables you to configure CoSign Control Panel settings. When you select Options from the Tools menu, the following dialog box appears:
Figure 44 CoSign Control Panel Settings
Show CoSign Control Panel in system tray Check this option to display the CoSign Control panel in the system tray when the Control Panel is activated. Personal graphical signature management Check this option to activate the graphical signature application in user mode. If the option is unchecked and the CoSign administrative client is installed, the graphical signature application will operate in administrative mode. Refer to Using the Graphical Signature Management Application. Refresh Panel This option updates the icons in the control panel according to the updated state of the CoSign appliance.
CoSign Control Panel Tray Item

The CoSign control panel icon appears in the tray if the option Show CoSign Control Panel in system tray is selected. Right-click the icon to display a popup that enables you to perform the following operations: Open control panel Maximizes the control panel. Change password Relevant only for a Directory Independent environment. Refer to Directory Independent Environment Options.
81
4
Logoff Refer to the description of Logoff in User Actions. Exit Closes the CoSign control panel.
SSCD Key Enrollment Relevant only for a CoSign SSCD appliance. Refer to Operating the Control Panel for a CoSign SSCD Appliance.
Operating the Control Panel for a CoSign SSCD Appliance

When CoSign SSCD hardware is used, the procedure of generating a key and a certificate for a user is different from the one followed for a regular CoSign appliance. This is due to the requirement that only the end user can select the password that protects the users key. Note: Keep in mind that the passwords that protect each of the SSCD-based users keys are different from the password that protects the user account, which is based on the password of the user in the directory. This section describes the steps necessary to enable you to sign documents using an SSCD key. 1. Upon user creation, either during installation or after the installation, the CoSign appliance generates a user account and sends you an email notification, directing you to enroll for a key.
Figure 45 Request to Enroll
2. Click Enroll. The Activate your Default Signing Key window appears.
82
Note: Alternatively, you can enroll by activating the CoSign Control Panel and clicking Activate your SSCD key. The Activate Your Default Signing Key window appears. In addition, when activating for the first time any application that can potentially sign using CoSign, the Activate your Default Signing Key window appears. 3. In the Activate your Default Signing Key window, enter the password that will protect the SSCD key, and confirm it.
Figure 46 Activate Your Default Signing Key
When you click OK, the key is generated inside the CoSign SSCD hardware. The CoSign appliance may also generate a certificate for you, depending on the certification model. You are informed that the key and certificate are ready for use and you can start signing documents. 4. Whenever you use an SSCD key for a digital signature operation, you are prompted to enter a password.
Figure 47 Password Entry When Signing with an SSCD Key
83
4
Updating SSCD Keys
To update SSCD keys: 1. Click Update your SSCD keys in the CoSign Control Panel. The Change password window appears.
Figure 48 Change Password Updating SSCD Keys
2. Enter a key in the Keys ID field. 3. You can perform the following on the selected SSCD key: Change Password Enter the old password and the new password, and confirm the new password. Delete Key Click Delete to delete the selected SSCD key. If you wish to sign documents, you must enroll for a new key. Note: Deletion of an SSCD key does not automatically delete its matching certificate.
84
Directory Independent Environment Options

The following options are relevant only for a Directory Independent environment.
Figure 49 CoSign Control Panel Directory Independent Environment
Changing the Password

To change your password when CoSign is installed in a Directory Independent environment: 1. Click Change User Password in the CoSign Control Panel (Figure 49). The Change Password window appears.
85
Figure 50 Change Password in a Directory Independent Environment
2. Enter your user name. 3. Enter the old password of the account and the new password of the account. Confirm the new password. 4. Click Change password.
Using the Graphical Signature Management Application

The Graphical Signature Management application enables you to view all your graphical signatures and create a new graphical signature. This graphical signature can be attached to all Microsoft Word, Excel, InfoPath, Tiff, and Adobe Acrobat documents that you sign. The Graphical Signature application is automatically installed together with the ARX CoSign Client component. The Signature application can be used in either of two modes of operation: Administrative Mode An administrator station is used for creating the users graphical signatures, as follows: The user supplies his/her identity and password, after which the user can create and then view his/her own graphical signatures. User Mode The user can create or view his/her own graphical signatures. There are several mechanisms that can be used for capturing a graphical signature: A capturing device such as Topaz pads or Interlink pads. A mouse or a tablet PC. A text-based graphical signature.
86
An image uploaded from a file. The following section details how to capture graphical signatures. If you do not capture a graphical signature, a default graphical signature that is based on your name is used by the signing application, such as Office 2007 or OmniSign.
Installing the Graphical Signature Capture Device

The CoSign appliance is supplied with a graphical signature capture device. However, you can use any of the following types of graphical signature capture devices: Graphical signature capture devices produced by Topaz Systems (http://www.topazsystems.com). Two models are available: SigLite LCD 1x5 USB This model includes an LCD capture device. The entered graphical signature appears on the LCD screen. SigLite 1x5 USB This model does not include an LCD capture device.
Figure 51 SigLite LCD 1x5 USB
Graphical signature capture devices produced by Interlink Electronics (http://www.interlinkelectronics.com). Two models are available: ePad-ink This model includes an LCD capture device. The entered graphical signature appears on the LCD screen. ePad This model does not include an LCD capture device.
87
Figure 52 ePad-ink
Figure 53 ePad
Note: Install the signature capture device only on machines in which the CoSign administrative client is installed. To install the graphical signature capture device: Connect the signature capture pad to the USB port on the workstation. The pads drivers are automatically installed.
Managing Graphical Signatures

To manage your graphical signatures: 1. Open the Start menu and select Programs ARX CoSign CoSign Control Panel. The CoSign Control Panel appears. 2. If the signature application is operating in administrative mode and you would like it to operate in user mode, perform the following:
88
Select Options from the Tools menu in the Control Panel. The Control Panel Settings window appears (Figure 44). Check the Personal graphical signature management option. 3. In the Control Panel, click Graphical Signature. The ARX Graphical Signature Viewer dialog box appears, for managing your graphical signatures. Note: This dialog box can also be activated from a SAPI based application such as OmniSign for the purpose of selecting a graphical signature to incorporate into the digital signature. When selecting, the user can either add a new graphical signature or select a temporary graphical signature (One-time Signature).
Figure 54 ARX Graphical Signatures Viewer Dialog Box
There are three types of graphical signatures that can be used: A regular signature, initials, or a logo. 4. The dialog box contains a list of all the users graphical signatures. For each item in the list, you can view its corresponding graphical image, as well as its type (graphical signature, initials, or logo). 5. You can activate the following buttons: New Creates a new graphical signature. Images can be loaded either from a file, mouse/tablet, script font, or signature pad. Delete Deletes an existing graphical signature. The currently selected graphical signature is deleted.
89
4
Edit A new graphical signature replaces the existing one.
Update Acrobat The graphical signature defines a new appearance with the name ARX Signature - <graphical signature label>. This appearance, which includes the graphical signature, can be selected in every signature operation. If the image is a logo, you can select this option to change the default logo in the existing Adobe Acrobat or Adobe Reader to the selected logo. One-time Signature This option is mainly relevant to cases where the dialog box is invoked from applications such as OmniSign. In this case, you can add a graphical signature that will be used only for the specific digital signature operation. This option invokes the same operation as the Capture Signature option described in the next step. The new graphical signature is deleted when this dialog box is closed. 6. If you click either New or Edit, the Create new graphical signature dialog box appears.
Figure 55 Create new graphical signature Dialog Box
The display area displays the current graphical signature. The following options are available: Load Picture Use this option to load an image file into CoSign. The possible types of images are: monochrome bmp, multicolor bmp, or jpg. Capture Signature The following signature capturing options appear if you specify manual in the Capturing Device ID parameter in the SAPI section. For each option, a dialog box appears, directing you to enter the graphical signature. Click OK in the dialog box to load the graphical signature you create into CoSign. Using a pad, Topaz, or ePad Use this option when it is required to enter the graphical signature using a signature capture pad. Use the pad as described in Installing the Graphical Signature Capture Device. If you are using a signature capture device with no LCD display, you will be able to see the signature only on
90
the PC screen during editing. If you are using a signature capture device with an LCD display, you will be able to see the signature both on the device and on the PC screen during editing.
Using a mouse or Tablet PC Use a tablet PC and a pen or a regular PC mouse to
enter a new graphical signature. Any movement of the mouse or pen in the tablet PC is drawn in the Capture Signature window that appears. Click Clear to restart the capture. Note: You will be able to use the mouse on a regular PC only when using Vista or when Microsoft Office 2003/2007 is installed.
Figure 56 Capture Signature Dialog Box Using a Mouse or a Tablet PC
Using a script font Specify a script font and an input text for generating a graphical signature. In the Capture Signature window that appears, enter the desired text and click Font to select a script font. The displayed text is the new graphical signature.
Figure 57 Capture Signature Dialog Box Using a Script Font
Select Color In the case of a monochrome bmp image, you can select the color of the graphical signature. If you click this button, a standard Microsoft color selection window appears, enabling you to select the desired color of the graphical signature.
91
Save Default Signature A default graphical signature that is based on the user name is generated for the user. The graphical signature uses a default font. If you would like to generate a new graphical signature, you can keep the default graphical signature by selecting Save Default Signature. Both the newly generated graphical signature and the former default graphical signature can be chosen to be used as part of the digital signature operation. This option will not appear when generating another graphical signature. Note: Graphical signatures are stored in the CoSigns users database as graphical objects. Note: A graphical signature is limited to 29KB. You can use up to a maximum of 140KB for your entire set of graphical signatures. Note: The first time you create a signature using a signature capture device, you must have local administrative rights. Afterwards, any user can create a signature.
Installing the ROOT Certificate for Validation Purposes

This procedure for installing the ROOT certificate is not required in the following cases only: CoSign is installed in a configuration where an external CA is used (if the users certificates are provided by a World Wide verifiable CA, the ROOT certificate is already installed in the verifiers PC). The organization is deploying a CoSign Verifier home page (refer to Using CoSign Verifier for Validation Purposes). The end user already uses these pages to install the organization ROOT certificate. The sections below describe how to install the ROOT certificate. An end user in an organization without CoSign who wishes to validate signatures that were originated by CoSign, must obtain the ROOT certificate of the organization that signed the document. The ROOT certificate is a .cer file that is installed on the end users workstation. After extracting the ROOT certificate to a file and installing it on his workstation, the end user can validate the signature. These procedures are described in the following sections. Note: In all environments except Active Directory, the ROOT certificate must be manually installed on every workstation on which a CoSign client is installed. Note: If CoSign is installed as a subordinate CA, you must make sure that the ROOT CA certificate is installed in the end users machine.
92
Extracting the ROOT Certificate to a File

To extract the ROOT certificate to a file: 1. Use the client configuration utility to download the CoSign ROOT certificate to a file. Use the Download CoSign CA Certificate option in the CA menu (refer to CoSign Configuration Utility Menus).
Installing the ROOT Certificate

The ROOT certificate needs to be installed on the end users workstation to enable proper validation of signatures. There are two methods for installing the ROOT certificate: Direct installation. Adding the ROOT certificate to a trusted CA list in the Active Directory of the domain of the organization that does not have CoSign.
Direct Installation of the ROOT Certificate

To install the ROOT certificate: 1. On the end users workstation, double-click the .cer file and follow the instructions in the wizard that appears. 2. When the Certificate dialog box appears, click Install Certificate (Figure 58).
93
Figure 58 Certificate Dialog Box
3. Click Yes in the Root Certificate Store dialog box.
Figure 59 Root Certificate Store Dialog Box
The ROOT CA Certificate is installed on your PC, enabling you to validate signatures.
Adding the ROOT Certificate to a Trusted CA List (Active Directory only)

It is possible to add the ROOT certificate to a trusted CA list in the Active Directory of the domain. Every workstation connected to the domain automatically obtains the ROOT certificate and places the certificate in its local trusted ROOT CA list.
94
To add the ROOT certificate to a trusted CA list, use the Microsoft utility certutil.exe. The utility is part of Windows Server 2003 and Windows Server 2008. It is also available as part of the Microsoft Windows Server 2003 Administration Tools Pack which can be downloaded from http://support.microsoft.com. Execute certutil.exe as follows: certutil.exe -dspublish -f <file name> RootCA where:
-f forces the creation of the object if it doesnt exist, and <file name> is the certificate file name.
Note: The user who runs certutil.exe needs permissions for creating an object under Services\public key services\Certificate authorities and under Services\public key services\AIA..
Using CoSign Verifier for Validation Purposes

If you are not using CoSign, you can still validate digital signatures that were attached to Microsoft Office documents using CoSign. To do so, you need to install the CoSign Verifier. The CoSign Verifier is installed via a web interface. It can be installed either by connecting to ARXs web page http://www.arx.com/support/cosign-digital-signature, or by connecting to the organizations web page, which you can set up as described in Deploying the CoSign Verifier. Installation of the CoSign Verifier provides the following functionality: Installation of an Office verifier capable of verifying Word and Excel digital signatures. For more information on verifying Word or Excel documents, refer to Signing Microsoft Office Documents in the CoSign User Guide. Installation of an organizational ROOT certificate. Automatically setting Adobe 6, 7, 8 and 9 configuration parameters to enable signature verification without having the end user manually set any parameters. For more information, refer to Signing Adobe Acrobat Documents in the CoSign User Guide. Note: If you install the CoSign verifier from the www.arx.com site, the ROOT of ARX is installed. It is therefore recommended to deploy the web-based installation as part of the organization web site, and use the organization ROOT certificate. The deployment is described in Deploying the CoSign Verifier. Note: If a World Wide verifiable external CA is used, there is no need to install the ROOT certificate since it is already installed in the verifiers PC.
95
Note: Validating a signature in Adobe Acrobat 6/7/8/9 does not require a plug-in, and is based on the internal comprehensive digital signature functionality of Adobe Acrobat 6/7/8/9. Note: Validating a signature in Office 2007 does not require a plug-in, and is based on the internal digital signature functionality of Office 2007. The following sections provide information on how to deploy the CoSign Verifier in the customer web site, and how to install the CoSign Verifier from the web site.
Deploying the CoSign Verifier

The deployment consists of copying .html and other files from the ARX CoSign CD into the organizations web server, and then configuring and customizing the files to fit the organizations requirements. To deploy the CoSign Verifier: 1. Set the organizational ROOT certificate as follows: Open the file variables.js and set the URL of the location of the ROOT certificate as the value of the ROOT_CERT_LOCATION parameter. Currently this parameter points to the ARX ROOT certificate. As part of the CoSign Verifier installation, the ROOT certificate can be installed on the verifiers PC. This is required only if CoSign is installed using an internal CA. 2. Customize the CoSign Verifier installation, as follows: In order to define which components to install, edit the variables.js and set the value of the parameter MASK_VALUE as the mask of the following parameters: Do not verify CRL Value=1 If this flag is set, the installation automatically unsets the value of Require Certificate Revocation checking for validation in Adobe Acrobat or Acrobat Reader Verify Signature preferences. Trust windows store Value=2 If this flag is set, the installation automatically sets the value of Enable importing entities from the windows certificate store in Adobes Verify Signature preferences. Load Root Certificate Value=4 If this flag is set, the installation automatically installs the ROOT certificate whose URL is specified in the above ROOT_CERT_LOCATION url. Install Office package Value=8 If this flag is set, the installation installs the Office verification package that enables the client to verify Word or Excel documents signed using the CoSign client. Install Tiff package Value=16 If this flag is set, the installation installs the Tiff verification package that enables the client to verify Tiff files that were signed using the CoSign client.
96
For example: To install the Office package and Tiff package, calculate the sum 8 + 16 = 24, and accordingly set MASK_VALUE = 24.
Installing the CoSign Verifier

To install the CoSign Verifier: 1. Click the CoSign Verifier deployment web page. For example, if you choose to download the CoSign Verifier from the ARX web site, click http://www.arx.com/support/cosigndigital-signature, and then click the link to download the CoSign Verifier. 2. Acknowledge the verifier installation by right-clicking the upper section of the web page and activating the Install Active X option. The Internet Explorer Security Warning window appears.
Figure 60 Internet Explorer Security Warning
3. Click Install to continue with the installation. An Installation Progress window appears, showing the progress of the installation. When installation is complete, an Installation Complete message appears. Note: If you are using VISTA/Windows 7 in user mode, you must turn off the Enable Protected Mode flag in the Security tab of the Internet Options dialog box. You can turn the flag on after the installation is over.
Extended Authentication Modes

CoSign enables the use of extended authentication modes, in addition to the regular authentication mode which is based on a User ID and password authentication. The extended authentication mode is required in more sensitive user environments, where the digital signature process requires the end user to prove his/her identity based on additional devices such as OTP (One Time Password) devices, SmartCard for authentication, or a Biometric device. Depending on the configured Extended Authentication, the end user is prompted during the digital signature operation to supply information according to the Extended Authentication mode used.
97
4
The following Extended Authentication modes are supported:
OTP based on Radius authentication The end user is prompted to provide the OTP during the digital signature operation. The CoSign appliance interfaces with the OTP server using a Radius protocol. The Radius protocol enables the CoSign appliance to interact with the OTP server and send the user ID and the OTP in a secret manner. The OTP is sent as is to the RADIUS server. There are some RADIUS servers whose password is based both on static and dynamic passwords. In these cases, both the static and dynamic password are passed to the RADIUS server for authentication. If the user is approved by the OTP server, CoSign continues to perform the digital signature operation. For more information about the various parameters that require configuration in order to interface to the RADIUS server, refer to Extended Authentication. Note: CoSign supports a maximum password length of 16 characters. Authentication SmartCard The end user enters the authentication SmartCard in a dedicated smart card reader device. The user is prompted for a PIN to access the SmartCard, and the SmartCard is used to prove the user identity to the CoSign appliance. The CoSign appliance authenticates the user, and if the user is approved, CoSign continues to perform the digital signature operation. This solution requires a special component in the CoSign Client. For more information, contact ARX support at http://www.arx.com/support/supportrequest. Biometric Device The end user uses a biometric device. A proof of identity is sent to the CoSign appliance as part of the digital signature operation. The CoSign appliance checks the identity of the user, and if approved, CoSign continues to perform the digital signature operation. This solution requires a special component in the CoSign Client. For more information, contact ARX support at http://www.arx.com/support/supportrequest. To configure CoSign to use extended authentication, refer to Extended Authentication.
98
Chapter 5: Managing the CoSign Appliance

The CoSign appliance is managed via the CoSign Administration Microsoft Management Console (MMC). This chapter describes how to use the CoSign Administration MMC for the most efficient CoSign management. This chapter also describes ARXs Users Management GUI utility, which provides easy users management for cases where CoSign is installed in a Directory Independent environment or other environments. It is also possible to manage users in this environment through an API (Application Programming Interface) called SAPI MNG (Signature API Management). SAPI documentation is located in the SAPI\doc folder of the SDK CD. Note: Managing CoSign differs slightly depending on whether it is installed in a Microsoft Active Directory, Novell NDS, LDAP, or Directory Independent environment. These differences are mentioned throughout the chapter.
Prerequisites to Using the CoSign Administration MMC

The CoSign Administration MMC enables you to efficiently manage the CoSign appliance. In order to use the CoSign Administration MMC, you must have the following qualifications: 1. You must be the built-in administrator defined during CoSign installation; Or You must belong to the domains administrative group as well as a valid CoSign user. For example, in a typical Active Directory installation, you must belong to the CoSign Signers group. The administrative group is defined by the system parameter Administrator Group, as described in Users Directory Parameters. In the case of a Directory Independent environment, you must be defined with Cosign Admin appliance management rights. 2. Before performing any appliance administrative activity, you must manually login to CoSign using either the built-in administrator or another valid administrator account.
Starting the CoSign Administration MMC

To start the CoSign Administration MMC: 1. Open the Start menu and select Programs ARX CoSign CoSign Control Panel. 2. Select Appliances Management. The ARX CoSign Appliance Management window appears, showing all installed CoSign appliances (Figure 61).
99
Figure 61 ARX CoSign Appliance Management Window
3. Right-click the CoSign appliance you wish to administrate. 4. From the popup menu, login to CoSign as an appliance administrator by selecting All Tasks Login Login, or All Tasks Login Login built-in user.
Figure 62 ARX CoSign Appliance Management Window Logging in to CoSign as an Appliance Administrator
Note that in the regular login option you can use your Active Directory/Novell NDS/LDAP/Directory Independent admin user for connecting to CoSign. If you choose to use the built-in user login, you must provide the account name and password.
CoSign Administration MMC Capabilities

Once you are logged in to the CoSign Administration MMC, you can perform the following operations, described in detail below: Back up the current CoSign data. Upload software updates provided by ARX. Manually synchronize CoSign with your Microsoft Active Directory, Novell NDS directory, or LDAP directory.
100
Managing the CoSign Appliance
Synchronize CoSign with the External CA. This option is relevant when CoSign is interfacing with an external CA automatically for producing users certificates. Refresh Certificates. Clear CA files. This option is relevant when CoSign is using an internal CA for producing certificates. This option clears internal CA information. This option is not relevant for CoSign 4.4 and above. Download log files from the CoSign appliance. Restart or shut down CoSign. Configure high availability options. Manage the Subordinate CA Certificate. This option is used when installing or renewing a subordinate CA certificate. Upload a new SSL Server certificate to be used as part of the CoSign Web Services offering. Upload information if an automated external CA is used. Extract technical performance figures on the internal activity of the appliance. View and modify system parameters. Restore the CoSign appliance from backup data. Install a new CoSign appliance (refer to Installing the CoSign Appliance Software). Install an alternate CoSign appliance (refer to Installing an Alternate CoSign Appliance).
Backing up the CoSign Data

You can back up the entire CoSign database (which includes all the users keys, certificates, and graphical signatures), the internal CA files, and all the CoSign configuration data, to a file located on your local network. The generated backup file is encrypted and can only be decrypted by the CoSign appliance. The CoSign key is generated and stored on the backup MiniKey token during appliance installation. After generating the backup file, you can save it to a disk or CD to store in case of data loss. This file can then be used to restore the CoSign appliance if necessary. For more information on restoring the CoSign appliance, refer to Restoring the CoSign Appliance. To back up the CoSign database: 1. In the ARX CoSign Appliance Management window(Figure 61), right-click the CoSign appliance you wish to back up. 2. From the popup menu, select All Tasks Backup. The Select a File dialog box appears. 3. Select a local backup file and click Save. The CoSign backup in progress status bar appears. When the backup operation is complete, the following message appears:
101
5
Backup finished successfully.
Very Important: The format of the backup file in version 5 is different from the format of the backup file of older versions. For organizations that upgrade the CoSign appliance to version 5, it is highly recommended to generate a new backup that is based on version 5 software. Note: You can also perform backup using the command line utility GetBackup (refer to Using Command Line Utilities). Very Important: You must perform a backup procedure periodically to enable quick recovery in the case that important information, such as users graphical signatures, is removed from the CoSign appliance, or in the case of any appliance hardware problem. Note: In the case of a CoSign SSCD model, the keys kept inside the SmartCard arrays are not backed up. Only non cryptographic information such as graphical signatures or users certificates is backed up. Upon restoration, CoSign matches information from the backup with the keys existing inside the SmartCard arrays.
Upgrading CoSign
You can upload CoSign software updates provided by ARX. The software updates are signed by ARX to ensure security. Software updates can be either a major version upgrade or a software patch. The same procedure is used in both cases. Before uploading an upgrade or a patch, use the CoSign Consoles Status menu to verify the existing appliance software version (refer to Displaying CoSign Status). Note the following: If you wish to upgrade CoSign from version 4.1, you must first upgrade to version 4.5 and only then upgrade to version 5. If you wish to upgrade CoSign from version 3.1, you must first upgrade to version 4.1, then upgrade to version 4.5, and only then upgrade to version 5. Note: For information on how to upgrade CoSign appliances in a high availability environment, refer to Upgrading Appliances Participating in a High Availability Cluster.
Upgrading to Version 5
CoSign version 5 includes a software upgrade from CoSign version 4.5 to version 5. The upgrade consists of the following file: verupd50.dlm. To upgrade from version 4.5 to version 5: 1. Load verupd50.dlm from the CoSign version 5 CD.
102
2. Follow the instructions listed in Uploading a Software Update. The upgrade runs instantly. 3. Use the CoSign Consoles Status menu to verify that the software version is SW5.0. (refer to Displaying CoSign Status).
Upgrading to Version 4.5

CoSign version 4.5 includes a software upgrade from CoSign version 4.1 to version 4.5. The upgrade consists of two files: isp4_5.dlm and verupd45f.dlm . To upgrade from version 4.1 to version 4.5: 1. Contact ARX support at http://www.arx.com/support/supportrequest and request the CoSign 4.5 upgrade files. 2. Load isp4_5.dlm. 3. Follow the instructions listed in Uploading a Software Update. The upgrade takes approximately 10 minutes. 4. Generate a CoSign report using the Create Report option in the Help menu of the CoSign configuration utility. Refer to Create report. 5. In the CoSign report, verify that the value of the Master Disk version parameter in the Server tab is 4.3. 6. Load verupd45f.dlm. 7. Follow the instructions listed in Uploading a Software Update. The upgrade takes several minutes. 8. Use the CoSign Consoles Status menu to verify that the software version is SW4.5. (refer to Displaying CoSign Status).
Upgrading to Version 4.1

As part of CoSign version 4.1, ARX includes a software upgrade to version 4.1 from CoSign version 3.1. The file is named verupd41.dlm and is located in the CoSign CD in the main folder. In addition, a file called csnsp1.dlm is included as part of the CoSign version 4.1 upgrade. You must upgrade this file after the verupd41.dlm file is successfully upgraded. To upload an upgrade, follow the instructions listed in Uploading a Software Update.
Uploading a Software Update

To upload a software update: 1. In the ARX CoSign Appliance Management window (Figure 61), right-click the CoSign appliance to which you wish to upload the software. 2. From the popup menu, select All Tasks Upload Software. The Select a File dialog box appears.
103
3. Select a local software update file and click Open. The CoSign Uploading Software in progress status bar appears. When the upload operation is complete, the following message appears:
Software uploaded successfully.
Note: Since most of the upload operation is carried out after the success message is displayed, it is recommended to view the new version number in the CoSigns console or view the log files to validate the success of the operation.
Synchronizing CoSign with the Directory Service

Note: This option is not relevant in a Directory Independent environment. CoSign monitors and retrieves information directly from the directory service. During CoSign installation, the CoSign users are defined either by defining a ROOT OU of all the signers or by defining a signers group (relevant only to Active Directory installations). When a user is added to the directory service and is classified as a signer, CoSign automatically generates a key and a certificate for the user, depending on the certificate model used. When a user is deleted from the directory service, CoSign automatically removes the user and the users key and certificate from the CoSign appliance. When a users information is updated in the directory service (e.g., the users email address is modified), CoSign automatically generates a new certificate for the user. In this way, CoSign and the directory service remain synchronized. In certain cases, however, CoSign may lose synchronization with the directory service. This may occur if you run CoSign with a license for fewer users than necessary, or if the directory service is restored from an old backup. Once the license issue is resolved or the restore operation complete, you can use the Sync with the Directory option to manually trigger synchronization of CoSign with the directory service. Another case requiring manual synchronization of the directory is the case where an Active Directory environment is used, and CoSign users are based on a dedicated Signers group defined in the Active Directory. When users are removed from the Signers group in the Active Directory, they are not automatically deleted from CoSign to prevent users losing their keys and graphical signatures in cases where users are removed and immediately entered back into the Signers group. These users will not be able to sign using CoSign, but if it is required to remove these users from CoSign, it is necessary to perform the manual synchronization operation. Note: In CoSign version 5, during installation the appliance administrator can unselect the option to create user accounts and generate keys and certificates for users. If the administrator unselects this option, manual synchronization is required for the initial creation of users account, keys and certificates.
104
Note: CoSign may lose synchronization also if you modify the CoSign OU (Organizational Unit) in the Active Directory environment. Keep in mind that performing a synchronization operation after renaming the CoSign OU may cause deletion of all the users in the CoSign appliance, including deleting their key, certificates, and graphical signatures. ARX therefore recommends not modifying the CoSign users OU after installation. Note: If CoSign is installed in a Novell NDS, LDAP, or AD Multiple Domains environment, full synchronization is automatically performed periodically. The frequency of synchronization depends on a system parameter (refer to Changing CoSign System Parameters). Note: In the case of LDAP or AD Multiple Domains installations, running Directory synchronization only updates users information in CoSign or deletes users from CoSign. Any addition of new users to CoSign requires the user to access the CoSign appliance. The Sync with the Directory option compares CoSign users to directory service users, adding and deleting CoSign users, keys, and certificates where necessary. To manually trigger synchronization of CoSign with the directory service: 1. In the ARX CoSign Appliance Management window(Figure 61), right-click the desired CoSign appliance. 2. From the popup menu, select All Tasks Synchronize Sync with the Directory. The following message appears:
Do you really want to sync with the Directory?
3. Click OK to confirm the operation. When the synchronization operation begins, the message Sync with the Directory started appears. Note: The synchronization operation may take a long time. This message only indicates that the operation started. A message in the Event log indicates when the operation is complete.
Synchronizing CoSign with the External CA in Automated mode

If you are using an external CA in automated mode, you can synchronize the CoSign database and the external CA. This option can be used when interfacing with the Comodo CA or ChosenSecurity CA. Use this option in the following cases: There are some users who no longer sign documents and apparently do not exist in the CRL (Certificate Revocation List) of the CA. There are valid CoSign users who are in the process of receiving an external CA certificate, but have not yet received the certificate.
105
5
To synchronize CoSign with the external CA:
1. In the ARX CoSign Appliance Management window (Figure 61), right-click the CoSign appliance you wish to synchronize. 2. From the popup menu, select All Tasks Synchronize Sync with the CA. Synchronization includes the following: Every certificate in the external CA that does not have a matching user in CoSign, is revoked. For every user in CoSign who does not have a certificate in the external CA, a new certificate request is issued to the CA, and the resultant certificate is sent to CoSign.
Refreshing Certificates
This option instructs the CoSign appliance to generate new certificates for all the signers. This option should be used in cases where a certain parameter that affects the content of the certificate has changed (for example, the CRL Distribution point of the certificate), and you want to generate new certificates containing the new value for all end-users. This option can be used also when an automated external CA is configured. To refresh all users certificates: 1. In the ARX CoSign Appliance Management window (Figure 61), right-click the CoSign appliance. 2. From the popup menu, select All Tasks Synchronize Full User Certificate refresh. 3. Confirm the operation. Following synchronization: A new certificate is generated for every end-user, based on the current parameters. If CoSign interfaces an external CA in automated mode, a certificate renewal procedure is run for every end user. Note: The Refresh Certificates option is relevant also when CoSign interfaces an external CA automatically. Keep in mind that this option will revoke all the existing certificates and generate new certificates for all users.
Clearing CA files
This option reduces the size of the files used by the CoSign internal CA. This subsequently reduces the size of a backup operation. Note: This option is not relevant to CoSign 4.5 and above.
106
To clear the CA files: 1. In the ARX CoSign Appliance Management window (Figure 61), right-click the desired CoSign appliance. 2. From the popup menu, select All Tasks Clear CA Files. At the end of the operation a success or failure message appears.
Downloading Log Files

There are three types of CoSign log files that you can download: CoSign appliance Event log Displays signing operations, major errors, and administrative actions, such as performing backups. CoSign appliance Debug log Displays internal debug information. CoSign appliance Install log Displays internal debug information related to the installation process. You can view the Event, Debug, and Install logs. The Debug and Install logs are intended for internal ARX use. When necessary, download them as instructed by ARXs technical support team and send them to ARX. To view the Event log: 1. In the ARX CoSign Appliance Management window (Figure 61), right-click the desired CoSign appliance. 2. From the popup menu, select All Tasks Download Logs CoSign Event Log. 3. Select a file and click OK. 4. Use Microsoft Event Viewer to open and view the Event log you just downloaded. Note: It is recommended to view the Event log on a machine with the CoSign Administration MMC installed so that you can properly view the text of the events. Note: You can also download CoSigns Event log by using the command line utility GetEvt (refer to Using Command Line Utilities).
Shutting Down and Restarting CoSign Services

You can stop and restart the CoSign internal services within the CoSign appliance. To stop and then restart the CoSign services: 1. In the ARX CoSign Appliance Management window(Figure 61), right-click the desired CoSign appliance.
107
2. From the popup menu, select All Tasks Restart Soft Restart.
Restarting the CoSign Appliance

There are several options for restarting or shutting down CoSign services and the CoSign appliance: Hardware Restart Restarts the appliance from a remote location. Shutdown Appliance Shuts down the CoSign appliance. To restart or shut down the CoSign appliance: 1. In the ARX CoSign Appliance Management window (Figure 61), right-click the desired CoSign appliance. 2. From the popup menu, select All Tasks Restart Hardware Restart/Shutdown Appliance.
High Availability
In a high availability site, one appliance is defined as the primary CoSign appliance, and the other CoSign appliances in the site are defined as alternate CoSign appliances. The following high availability options are available to the appliance administrator through the CoSign Administration MMC: Install Alternate Install the alternate CoSign appliance software. Refer to Installing the Alternate CoSign Appliance Software. Subscribe Alternate to Primary Re-subscribe an existing installed appliance to be an alternate appliance of a selected primary appliance. Refer to Resubscribing an Alternate Appliance with a Primary Appliance. Set As Primary Set an existing alternate appliance to be the primary appliance. Refer to Setting an Alternate Appliance to be the Primary Appliance. Subscribe as Alternate If the existing cluster of appliances has more than one primary appliance due to recovery after failure, it is possible to set an appliance previously defined as the primary appliance to be an alternate appliance. Refer to Setting a Previous Primary Appliance to be an Alternate Appliance.
108
Renewing the Subordinate CA Certificate

It is possible to install CoSign so that CoSign acts as a subordinate CA of another ROOT CA in the organizations environment. For more information on installing CoSign as a subordinate CA, refer to Installing CoSign as a Subordinate CA. If the CoSign certificate from the ROOT CA has expired or been revoked, you need to renew the CoSign certificate. It is recommended to start the renewal process at least a month before certificate expiration. It is further recommended to adjust the renewal of the users certificates to after the subordinate CA is renewed, but before it is expired, to avoid cases where an end-users certificate is valid, but the CA certificate is not. To renew the CoSign certificate when the CoSign CA is acting as a subordinate CA: 1. In the ARX CoSign Appliance Management window (Figure 61), right-click the relevant CoSign appliance and select All Tasks Subordinate CA Download Certificate Request.
Figure 63 Subordinate CA Options
2. A File Selection dialog box appears, prompting you to supply the name of the file that will contain the Certificate Request (CRQ) for CoSign as a subordinate CA. CoSign will place the CRQ into this file. 3. Submit the certificate request to the ROOT CA by providing the CRQ file. The files you will eventually receive back from the ROOT CA include a group of files that constitute the complete chain of CA certificates, and the Certificate Reply file that contains the new CoSign subordinate CA certificate. Note that if a ROOT CA certified CoSign, the complete chain of CA certificates includes only the ROOT CA certificate. The CoSign subordinate CA certificate can also be packaged in certificate format (.cer) and not necessarily in a certificate reply format (.crp).
109
Note: Make sure that the certificate reply contains only the CoSign certificate and does not contain any of the certificates that are part of the certificate chain. The certificates in the certificate chain are loaded separately. Note: The file formats of the certificate and certificate chain must be ASN.1 (DER) encoded. If the files are encoded in BASE64 format, they must be converted. If the CoSign subordinate CA certificate is encoded in BAES64 format, you can use the Microsoft standard certificate information utility to browse to that BASE64 certificate, and use the copy to file option to save the certificate to a DER encoded certificate. 4. For each file in the chain of CA certificates, perform the following:
Right-click the relevant CoSign appliance and select All Tasks Subordinate CA
Load ROOT Cert Chain.
A file selection window pops up. Specify the path and file name of the CA certificate. After each certificate is loaded, the following message appears: Uploading root certificate
chain finished successfully.
5. Right-click CoSign appliances and select All Tasks Subordinate CA Upload Certificate Reply. A dialog box appears, prompting you to specify the Certificate Reply file, which contains the new CoSign subordinate CA certificate. 6. Specify the path and file name of the Certificate Reply. Note: In case of an error when uploading the new certificate, CoSign will continue running using its old CA certificate until the certificate expires.
110
Uploading an SSL Certificate

If CoSign is used in Web Services mode, access to Web Services is based on SSL security, that is, the SSL server must use a private key and a certificate. However, the CoSign appliance is installed with a default SSL Server certificate pointing to an SSL Server with the name cosign. This default certificate would require that the organization configure each client as follows: Assign CoSigns IP address to the name cosign. (This can be done by updating the hosts file, located in \windows\system32\drivers\etc or in \etc\hosts). Trust the default certificate. Instead, you can upload your own SSL Server Private Key and certificate which includes the DNS identification of the CoSign appliance. To upload your own SSL Server Private Key and certificate: 1. Generate a private key and request a certificate from a well known certificate authority. 2. Upload the Private Key and Certificates chain that are packaged in a .pfx file to the CoSign appliance. When activating this option, a window pops up requesting you to supply the following:
Figure 64 Upload SSL Certificate
PKCS#12 file (.pfx) Provide the file that includes the Private Key and Certificate chain. File Password Provide the password that protects the Private Key in the PKCS#12 file. This new Private Key and Certificate will replace the existing default Private Key and Certificate. The SSL Server will now use the Private Key and certificate for providing SSL communication based Web Services that match the organization network identities.
111
Renewing the ChosenSecurity Authentication Key File

When using ChosenSecurity as the automatic external CA, the CoSign appliance is authenticated to the ChosenSecurity service using an authentication key and an authentication certificate that are uploaded to CoSign as part of the installation process. Close to the expiration date of the authentication key, you should logon to the ChosenSecurity portal using your organizational account, and request to renew the authentication key. Note: An email message will probably arrive from ChosenSecurity, reminding you to renew your authentication key. To renew your ChosenSecurity authentication key: 1. Logon to the ChosenSecurity portal with user apiUser and request an authentication certificate, as follows: Select the Request Certificate tab. Select the product TC , Business ID, recoverable, 1yr. Make sure that you select the product containing the word recoverable. You will receive two emails, one containing a protection password and the other containing a link for downloading a secured authentication key file in PKCS#12 format. The protection password will be required when downloading the key file. 2. Save the PKCS#12 authentication key file to your hard disk. 3. Connect to the apiUser profile in the ChosenSecurity portal and select the My Profile section. Select Authentication Details and set the Login Certificate field to contain the Distinguished Name of the PKCS#12 authentication key file. 4. In the ARX CoSign Appliance Management window (Figure 61), right-click the relevant CoSign appliance and select All Tasks Upload CA Information. The Upload CA Information window appears. 5. Enter the following information: PKCS#12 file (.pfx) Browse to the PKCS#12 file provided by the ChosenSecurity portal. File Password Enter the protection password provided by the ChosenSecurity portal. Account Name Displays the exact name of your account at ChosenSecurity. Account Owner Email Displays the email address of the administrative profile.
112
Monitoring Performance Parameters of the CoSign Appliance

You can monitor the performance of the appliance. Use this option if the appliance has a heavy load and requires performance evaluation. Consult ARX support before activating this option.
Activating Performance Monitoring

To monitor appliance performance parameters: 1. In the ARX CoSign Appliance Management window (Figure 61), right-click the relevant CoSign appliance and select All Tasks CoSign Performance Monitor Start Monitor. The Setup Performance Monitor Parameters window appears.
::
Figure 65 Setup Performance Monitor Parameters Window
2. Specify the following: Monitor period (in hours) Specify the overall period of monitoring activity. When the monitoring period ends, the monitor service will stop. Sampling frequency (in seconds) Specify how often the monitoring service samples technical parameters. 3. Click OK. Monitoring begins. Monitoring will end at the end of the specified monitor period, or if you manually stop it as described in Stopping Performance Monitoring.
Stopping Performance Monitoring

To stop monitoring of appliance performance parameters: 1. In the ARX CoSign Appliance Management window (Figure 61), right-click the relevant CoSign appliance and select All Tasks CoSign Performance Monitor Stop Monitor.
113
5
Viewing Performance Parameters
To view the appliance performance parameters:
1. In the ARX CoSign Appliance Management window (Figure 61), right-click the relevant CoSign appliance and select All Tasks CoSign Performance Monitor Download Log. The downloaded file contains values for all sampled parameters. You can display the values in Excel. You can consult with ARX to evaluate whether the values are as expected.
Changing CoSign System Parameters

You can easily change the various system parameters using the CoSign Administration MMC. To change system parameters: 1. In the left pane of the ARX CoSign Appliance Management window, click System Parameters for a specific appliance. The parameters are classified according to the context of the parameter. When you select a specific class of parameters, its parameters are displayed in the right pane, as shown in Figure 66.
Figure 66 CoSign System Parameters
2. Double-click a parameter to change the parameters value. A popup dialog box appears with the parameters current value. 3. Change the value and click OK. Note: You must perform a soft restart of the CoSign appliance for the new parameter values to take effect (refer to Restarting the CoSign Appliance).
114
The available parameters are listed below.
Users Directory Parameters

Group of CoSign Users (AD) The identification of the group in the Active Directory that defines the scope of CoSign users. This group is referred to as the Signers Group. This parameter is modifiable and defined during CoSign installation. This parameter should be provided in a Full Distinguished Name format, that is, CN= CoSign Signers, CN = Users, DC= arx, DC=com Note: Set this parameter with great care. All users who do not belong to the new Signers group will be deleted, as well as all their user information. Automatic Deletion of Users If this parameter is TRUE, CoSign automatically deletes a user from CoSign when the user is removed from the Signers group, or when the users group is removed from the Signers group. This can be a problem if the administrator decides to temporarily remove the user from the Signers group. It is recommended to set this parameter to FALSE. Default value: FALSE. Administrator Group The name of the directory services user group that identifies authorized CoSign appliance administrators. Make sure that all users who perform CoSign appliance administrative tasks are assigned to this group. You can choose any name for this group, under the following conditions: In an Active Directory environment, provide the name of the administrative group (.e.g., administrators). In a Novell NDS environment, provide the name of the administrative group. In an LDAP environment, provide this parameter in a Full Distinguish Name format, that is, CN= Administrators, DC= arx, DC=com. Default value: administrators. User Administrator Group The name of the directory services user group that identifies authorized CoSign user administrators. Make sure that all users who perform CoSign user administrative tasks are assigned to this group. You can choose any name for this group, under the following conditions: In an Active Directory environment, provide the name of the administrative group, for example, administrators. In a Novell NDS environment, provide the name of the administrative group. In an LDAP environment, provide this parameter in a Full Distinguish Name format, that is, CN= Administrators, DC= arx, DC=com. Default value: administrators. Directory Synchronization Timer How often (in seconds) the system should scan for updates in the directory services user databases in order to generate keys and certificates for new users, update user certificates due to changes such as email address changes, or delete users.
115
Note: A low value (i.e., several seconds) increases CoSign synchronization with the directory service, but may decrease CoSign performance levels. Default value: 40 seconds. Create Group Keys Indicates whether a key and certificate are automatically generated for every group in the directory service. If this option is activated, every end user can digitally sign using his group certificates. If a user belongs to several groups, the user can use the certificates of all the groups to which the user belongs. Note: If an External CA is used, use the Groups.exe utility. This utility enables the end user to define the current group. Any creation of keys and certificates by the end user will be automatically assigned to the current group. Note: After updating this value and performing a soft restart of the CoSign appliance, you must manually perform synchronization with the directory for generating keys and certificates for the directory groups. Default value: False. Create Computer Keys Indicates whether a key and certificate are automatically created for each computer in the directory service. This option is relevant for computer-based services that require signature operation. These services perform signature operations using the workstations key. Default value: False. Periodic Directory Sync Timer (Novell NDS, LDAP, and AD Multiple Domains environments) How often (in seconds) the system should perform a full users database synchronization against the Directorys user databases in order to generate keys and certificates for new users, update user keys and certificates due to changes such as email address changes, or delete users. In the case of LDAP and AD Multiple Domains, synchronization only applies to user updates and user deletion. Note: A low value (i.e., several seconds) increases the frequency of CoSign synchronization with the Novell NDS Directory, but may decrease CoSign performance levels. Default value: 1800 seconds. User Certificate Publishing (Active Directory and Novell NDS) Indicates whether to publish the end users certificate to the users account in the domain. This functionality is not necessary when certificates are used for signature operations. Default value: False. Directory Server Search Base (relevant only for LDAP This read-only field indicates the base location in the directory for searching the accounts of the signing users in the LDAP directory. Default value: Empty. Built-in CoSign Admin (relevant for all environments except Directory Independent) This boolean parameter defines whether the only administrator of the system is the built-in
116
administrator. That is, that there are no CoSign administrators from the domain, and the only administrator of the system is the built-in administrator. Setting this value to True improves the performance of any user login operation to the appliance. Default value: False.
Key Management Parameters

Generate Automatic keys In SSCD When a CoSign SSCD Hardware model is used, this parameter directs CoSign whether to generate the automatic private key of the user in the SSCD device (SmartCard). Default: True Key Location (Non Automatic) This parameter is relevant for generated private keys that are non automatic. The parameter indicates where the newly generated key will be located: 1 Locate the key in the SSCD device. 2 Locate the key in the CoSign DB. 3 The CoSign client determines where to locate the key. The decision is based on a special parameter in the CoSign configuration utility. Default: 3. SSCD Minimal Password Length The minimal password length that can be authenticated to the SSCD device. Default: 4 characters. SSCD Max Failed Attempts The number of failed authentication attempts to the SSCD device. After reaching this number of failed attempts, the user is locked and cannot use the SSCD device. In this case, the user needs to re-enroll for a new key. Default: 3. Extractable Keys A read-only parameter. Specifies whether the generated keys of the users can be extracted from CoSign. Note: CoSign cannot be configured to extract signature keys.
Certificate Management Parameters

Certificate Refresh Timer How often (in seconds) the system should scan for certificates that expire shortly, in order to refresh the certificates. Default value: 86400 seconds (24 hours). Certificate Refresh Window The number of days before the assigned refresh date during which CoSign may refresh the certificate.
117
For example, if a certificate was assigned a refresh date of January 20 (based on the specified Certificate Expiration Variance), and the Certificate Refresh Window is 5 days, the certificate may actually be refreshed anywhere between January 16 and January 20. Default value: 7 days. Certificate Expiration Variance The maximum number of days that may be subtracted from the certificates expiration date for the purpose of refreshing the certificate. This variance enables CoSign to spread the refresh activity over a number of days. For example, if 1000 users are added on the same day, their certificates all expire on the same day as well. To avoid overloading the system on the expiration date, you might specify a variance of 10 days. CoSign would then assign a refresh date to each certificate (for example, 100 certificates on January 20, 100 on January 21, etc.). Default value: 1 day. CRL Publishing Frequency How often (in days) the internal CA of CoSign publishes its Certificate Revocation List (CRL) into Microsoft Active Directory or Novell NDS. Note: The CRL contains information regarding revoked users. Default value: 1 day. CRL Validity Period Determine the time (in days) that the generated CRL is valid. Default value: 1 day. AIA Publication Location Starting from version 5 this parameter can be modified.. This parameter specifies the publication location of the AIA (Authority Information Access), which contains the CoSign Internal CA certificate. This parameter is initially set during CoSign installation (refer to Installing an Internal Certificate Authority). If it is not set by the user, it retains its default value. It is recommended to perform a Refresh Certificate operation (refer to Refreshing Certificates) after setting this parameter in order to include the updated parameter value in the generated certificate. Note: Changing either the AIA Publication Location or the CRL Publication Location will automatically set both Use CDP Location Settings and Use AIA Location Settings to false. This means that if CoSign published the AIA or CDP to the domain, it will not continue and publish the certificate or CRL to the domain, and the administrator will need to find another mechanism for publishing the certificate or CRL. CRL Publication Location Starting from version 5, this parameter can be modified. This parameter specifies the publication location of the CRL (Certificate Revocation List), which contains all the identifications of the revoked certificates of the CoSign internal CA. This parameter is initially set during CoSign installation (refer to Installing an Internal Certificate Authority). If it is not set by the user, it retains its default value. It is recommended to perform a Refresh Certificate operation (refer to Refreshing Certificates) after setting this parameter in order to include the updated parameter value in the generated certificate.
118
Note: Changing either the AIA Publication Location or the CRL Publication Location will automatically set both Use CDP Location Settings and Use AIA Location Settings to FALSE. This means that if CoSign published the AIA or CDP to the domain, it will not continue and publish the certificate or CRL to the domain, and the administrator will need to find another mechanism for publishing the certificate or CRL. Use CDP Location Settings A read-only parameter. Specifies whether CoSign will attempt to publish the CRL in the specified location. Default value: TRUE if the value of the CRL Publication Location parameter was not changed during installation. In a Directory Independent environment, the value of this parameter is always FALSE. Use AIA Location Settings A read-only parameter. Specifies whether CoSign will attempt to publish the AIA in the specified location. Default value: TRUE if the value of the AIA Publication Location parameter was not changed during installation. In a Directory Independent environment, the value of this parameter is always FALSE. Certificate Common Name Defines how to set the value of the common name field in the user certificate. 0 According to the common name field of the user in the directory. 1 According to the display name field of the user in the directory. Default value: 0. CPS Object ID Starting from CoSign 5, you can attach a certificate policy attribute to the certificate generated by the CoSign internal CA. The Certificate Policy Statement (CPS) contains a unique object ID (such as 2.16.840.1.113733.1.7.23.3). It is recommended to perform a Refresh Certificate operation (refer to Refreshing Certificates) after setting this parameter and the CPS URI parameter, to include the new parameter values in the generated certificate. Default value: empty. Empty indicates that no CPS attribute is attached to newly generated certificates. CPS URI The URI of the location where the text of the CPS is published. Default value: empty. Empty indicates that no CPS attribute is attached to newly generated certificates. CA Account Name (ChosenSecurity) The identification of the organizations account when interfacing the ChosenSecurity CA. Change this value only in accordance with ARX support. Default value: as defined during installation. CA Service Connection Point (ChosenSecurity) A read only parameter. Indicates the URL of the service connection point of the ChosenSecurity service.
119
CoSign Certificate SN (ChosenSecurity) A read only parameter. Indicates the serial number of the authentication certificate representing the ChosenSecurity authentication key. CA Account Owner Email (ChosenSecurity) The email of the administrative profile of the organizations account when interfacing the ChosenSecurity CA. Change this value only in accordance with ARX support. Default value: as defined during installation. User Certificate Type (ChosenSecurity) The types of certificates generated by the ChosenSecurity service. Each number represents a certificate type. Change this value only in accordance with ARX support. Default value: as defined during installation. External CA User Name (Comodo) The user name representing the organization that enables CoSign to interface the Comodo CA. Change this value only in accordance with ARX support. Default value: as defined during installation. External CA Password (Comodo) The password corresponding to the External CA User Name. Change this value only in accordance with ARX support. Default value: as defined during installation.
Client Security Setting Parameters

Prompt for Logon Indicates whether the user gets a logon prompt (as shown in Figure 67) requiring entry of the user ID, password, and domain name when logging on to CoSign. If set to TRUE, the following dialog box appears once, for every user login session in Windows.
Figure 67 CoSign Logon Prompt
120
Note: In Novell NDS, LDAP, and Directory Independent environments, the Prompt for Logon parameter cannot be modified, and is automatically set to TRUE. Note: If no input is entered into any of the logon dialog fields within the first 10 seconds, a 10-seconds timer appears in the dialog. If no input is entered by the time this timer expires, the logon dialog automatically disappears and the logon operation fails. This parameter can be changed via the CoSign Configuration Utility (refer to the CoSign Configuration Utility chapter in the CoSign User Guide). Default value: False. Prompt for Signature Indicates whether the user gets a prompt (as shown in Figure 67) requiring entry of the users password before each digital-signature creation. When using extended authentication, this parameter must be set to True. Note: The User ID and the domain name are displayed in the popup dialog box. Default value: False. Automatic User Logon This parameter is relevant for all modes that prompt a user to logon (i.e., Directory Independent, LDAP). If this parameter is True, then the user is able to access his/her public information such as the user certificate, without requiring a logon prompt. The logon prompt will appear only during a signature operation or a management operation such as uploading a new graphical signature. Using this option, you can reduce the number of logon pop-ups in applications that only access the local store of users certificates. In the case of Active Directory installation when SSPI mode is used for authentication, setting this parameter to False will improve logon performance. Default Value: True.
Auditing and Accounting Parameters

Report Signatures to Event Log Indicates whether to report signature events to the event log. Disable this option only if very high performance rates are required. Default value: True. Enable User Counters Indicates whether to enable user-based counters that enumerate signature operations. Default value: False.
Alerts and Notifications Parameters

Mail Server Name DNS name or IP address of the SMTP server used for sending email notifications. Default value: No mail server
121
5
Default value: 25.
Mail Server Port The TCP/IP port number of the SMTP server used for sending email notifications. Email From Address The source email address to be used for sending email notifications. Default value: none. Syslog Server IP Address The IP address of the syslog server. If the proper IP is set, all major events are also reported to the syslog server. Without entering the IP address, only events of system up or system down are reported to the syslog server. Default value: 0.0.0.0 (No IP defined).
Password Policy
The following parameters are relevant to a Directory Independent environment. These parameters define a policy for the users passwords. Minimum Password Length The minimal password length of a CoSign user. The minimal length cannot be set to less than 6 characters. Default value: 6. Maximum Password Validity The maximal number of days the existing password is valid. A value of 0 indicates that the validity is indefinite. Default value: 0. Minimum Password Validity The minimal number of days the existing password is valid. During this period the password cannot be changed. A value of 0 means that this policy is not enforced. Default value: 0. Maximum Repeats in password The maximal number a character can be repeated in a password. A value of 0 means that the policy is not enforced. Default value: 0. Maximum Sequence in password The maximal number of ascending/descending characters in a password. A value of 0 indicates that this policy is not enforced. Default value: 0. User Must Change Password Whether the newly created user must change his/her password. Default value: False. Max Password Failed Attempts After the user failed to present his password several times, the user is locked and only an administrator can release the user by setting a new password. This field indicates the maximal number of failed attempts. A value of 0 indicates that this policy is not enforced.
122
LDAP
The following parameters are relevant to an LDAP based installation such as Sun-One, Tivoli, or OID environments. These parameters enable CoSign to properly communicate with the LDAP server for the purpose of user authentication and users synchronization. Primary LDAP server address The DNS name or IP address of the primary LDAP server. Primary LDAP server port The port number of the primary LDAP server. Secondary LDAP server address The DNS name or IP address of the secondary LDAP server. This information enables CoSign to work in a High Availability directory environment. Secondary LDAP server port The port number of the secondary LDAP server. LDAP Authentication Method The method used to authenticate users in the LDAP Server. 0 Simple Authentication. The user and password are sent in clear format. 1 The password is sent using Digest MD5 format. If you specify this option, set LDAP Secure Mode to off. Default value: 0. LDAP Server Realm name The Realm name of the LDAP server, used when the authentication method is Digest-MD5. In a Sun One installation, this is the DNS name of the SUN One server. LDAP Secure mode Whether secure LDAP is used or not. If this parameter is True, then secure LDAP is used, that is, both the user ID and the password are sent encrypted from CoSign to the LDAP server. Take care to also modify the LDAP Server port according to the secure LDAP port, which is in most cases port 636. To upload the Root Certificate of the SSL Server, use the Subordinate CA\Load Root Cert Chain option, and specify the ROOT certificate. If you specify LDAP secure mode, do not set LDAP Authentication Method to 1 (DigestMD5 format). Default value: False. LDAP CoSign user name The full path distinguish name of a user who is allowed to query information from the LDAP directory. In some environment, such as SUN One, this definition is required by default. For example, in Sun One, a parameter such as the following should be provided:
uid=administrator,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot.
In other environments such as OID or Tivoli, this parameter can be left blank. LDAP CoSign User Password The password of the user who can query users information in the LDAP server. Search Base in LDAP Server The search base Distinguish Name for accessing information in the LDAP server.
123
5
Advanced Parameters
It is not recommended to modify any of the following parameters. Modify the parameters only if instructed to do so by ARX support. CoSign Debug Level Modify this parameter only when instructed to do so by ARXs technical support team. Note: Running in debug mode (i.e., CoSign Debug Level is greater than 2) significantly decreases CoSign performance levels. Default value: 2. Clients Inactivity Timeout The time period after which CoSign disconnects inactive clients, in seconds. Note: In environments with thousands of CoSign clients, it is recommend to decrease this value to several minutes. This reduces usage of appliance resources by CoSign clients. Default value: 7200 seconds (2 hours). Use SSL Proxy Set this parameter to true if the CoSign appliance can connect to the Internet only through an SSL proxy. This parameter is necessary if the CoSign appliance must connect to a World Wide Verifiable CA to get users certificates. Default value: false. SSL Proxy IP If CoSign is installed in an organization which allows access to the internet only through an HTTP proxy, CoSign can be configured to use this proxy when accessing external services such as the automatic external CA. Indicates the IP address of the organizations HTTP proxy. Default value: empty. SSL Proxy Port If CoSign is installed in an organization which allows access to the internet only through an HTTP proxy, CoSign can be configured to use this proxy when accessing external services such as the automatic external CA. Indicates the port number of the organizations HTTP proxy. Default value: empty. Web Services Support Indicates whether the CoSign appliance provides a Web Services interface. Default value: true. SSL Proxy User Name If the HTTP proxy through which the organization accesses the internet requires authentication, this field indicates the valid user name of a user in the organization. Default value: empty. SSL Proxy Password If the HTTP proxy through which the organization accesses the internet requires authentication, this field indicates the password corresponding to the user
124
name of a user in the organization Default value: empty.
Extended Authentication
The following parameters are relevant in cases where the regular user authentication during signature operation is extended to use one of the following mechanisms: One Time Password using a Radius Server The end user enters a One Time Password (OTP) using a special device. The One Time Password is checked against a Radius Server, external to the CoSign appliance. The parameters described in Extended Authentication - Radius enable CoSign to communicate with the Radius Server. Smart Card Authentication The user is requested to use a SmartCard as part of the signature approval. As part of the digital signature operation, the CoSign appliance approves a Challenge that is signed by the SmartCard. The parameters described in Extended Authentication - SmartCard enable CoSign to communicate with the SmartCard. To upload the Root Certificate of the authentication certificate of the end user, use the Subordinate CA\Load Root Cert Chain option and specify the ROOT certificate Biometric Authentication An approval is sent to the CoSign as part of the biometric authentication. The parameters described in Extended Authentication - Biometric enable CoSign to communicate with the biometric device. Keep in mind that in extended authentication, the Prompt for Signature parameter must be set to True (refer to Client Security Setting Parameters).
Extended Authentication - General

Extended Authentication Method Define the primary authentication method to be used: 0 Built in: No extended authentication method. CoSign uses the regular password verification mechanism. 1 Radius based extended authentication. 2 SmartCard based extended authentication. 3 Biometric based extended authentication. Default: 0. Alternate Extended Auth mode When defined, if there is a problem during extended authentication, then the CoSign appliance will try using an alternate method. -1 None: CoSign rejects the authentication attempt. 0 Built in: No extended authentication method. CoSign uses the regular user password. 1 Radius based extended authentication. 2 SmartCard authentication based extended authentication. 3 Biometric based extended authentication. Default: -1.
125
5
Extended Authentication - Biometric
Biometric Shared Secret For information contact ARX.
Biometric Authentication Window For information contact ARX.
Extended Authentication - SmartCard

SmartCard Authentication Window The SmartCard authentication is based on a challenge that is signed by the end users SmartCard. The challenge is based on time, which is verified by the CoSign appliance. The Authentication window is the time in seconds that can elapse from the actual signature time. Default: 120. Use SmartCard Auth for Logon Determines whether the login will also be based on SmartCard authentication. This option is relevant mostly for Active Directory deployments that require only a SmartCard for login operation. 0 Login is not based on SmartCard authentication. 1 Login is based on SmartCard authentication. Default: 0. Certificate Issuer Name Validate users who are certified by the specified issue name. If this parameter is empty then any ROOT certificate trusted by the CoSign appliance can certify users. Enforce CRL Validation Indicates that the CoSign appliance will always check the CRL. If there is any access problem to the CRL, the user authentication will fail. URL Retrieval Assists the certificate validation mechanism of the SmartCard authentication certificate. When querying the CRL, this parameter indicates whether to retrieve the CRL from the cache, or it indicates the timeout when retrieving the CRL from the network. 0 Use the default timeout value for retrieving the CRL from the network. 1 Retrieve the CRL from the CRL Cache. Other A timeout in milliseconds for retrieving the CRL. Default: 0
Extended Authentication - Radius

Require Static Password When this value is true, the end user must enter CoSigns static password, followed immediately by the Radius password. If the Radius server has an internal mechanism that combines a static password and a dynamic password, it is advisable to set this parameter to False. In addition, do not get confused between the static password assigned by the Radius server and the static password required by the CoSign appliance Default: False.
126
Default Radius password length If Require Static Password is set to True, this parameter specifies the number of characters in the Radius password. This enables the CoSign appliance to separate the regular password from the Radius password. CoSign will authenticate the user using the CoSign static password, and then send only the Radius password portion to the Radius server for authentication. Default: 6. Radius Server IP Address The IP address of the Radius Server. Radius Server port The port number of the Radius Server. Default: 1812. Alternate Radius Server IP Address This parameter is not applicable. Alternate Radius Server Port This parameter is not applicable. Default: 1812. Radius Server Secret The shared secret between the Radius Server and the CoSign appliance. Radius Server Timeout The time in seconds to wait for the Radius servers response. Default: 5. Radius Server Retries The permitted number of retries when trying to validate the user credentials against the Radius server. Default: 2. Enable the Radius AD attribute If set to True, the user identification that is sent to be approved by the Radius server is based on the value of the Radius customer AD attribute parameter. Default: False. Radius customer AD attribute The name of the attribute in the Microsoft Active Directory to be used as a user identity sent to the Radius server. For example, physicalDeliveryOfficeName. If the content of the field is empty and the value of Enable the Radius AD attribute is True, the user will be rejected.
127
5
Restoring the CoSign Appliance
The Restore operation enables you to restore the CoSign appliance from a previously generated backup file (refer to Backing up the CoSign Data). You may wish to do this if there has been data loss or corruption or if you want to set up a new CoSign appliance with the data from a previously installed appliance. The Restore operation is similar to installation (refer to Installing the CoSign Appliance Software). However, since a backup file is used for restoration, not all information entered during installation needs to be reentered. In addition, the restore operation usually takes less time than installation. The actual length of time depends on the number of users who were created/deleted/updated after the date of the backup, and the selected key length. The following sections provide instructions for restoring the CoSign appliance in Microsoft Active Directory, Novell NDS, LDAP, and Directory Independent environments. Note: If the CoSign hardware is CoSign SSCD, the keys that are kept inside the SmartCard arrays will not be backed up. Only non cryptographic information such as graphical signatures or certificates will be backed up. Upon restoration, CoSign will match information that exists inside the backup to keys that exist inside the SmartCard arrays.
Restoring the CoSign Appliance in Microsoft Active Directory

Note: In order to run the restore operation, you must have permissions similar to those required for installing the CoSign appliance software. Refer to Installing the CoSign Appliance Software for more information. Note: Starting from CoSign version 5, the format of the backup file has changed. Therefore, there are differences in the restore process when restoring from a backup file of version 5 and above compared to restoring from a backup file of a version older than version 5. To restore the CoSign appliance: 1. Make sure the appliance is in Factory Settings mode. You can check whether the Install state is Factory in the consoles Status menu (refer to Displaying CoSign Status). To restore CoSign to its factory settings, refer to Restoring Factory Settings. 2. In the ARX CoSign Appliance Management window (Figure 61), right-click CoSign appliances and select All Tasks Restore from the popup menu. A standard file selection dialog box appears. 3. Browse to the backup file, and click Open. 4. Enter the IP address of the CoSign appliance and click Next. The User setup dialog box appears.
128
5. Click Next. Enter the built-in CoSign administrative user. You must provide the password of the built-in administrative user and confirm the password. 6. Enter the Admin user name and Admin password of an administrator who has permission to join the CoSign appliance to the domain. Note: The Admin user name enables CoSign to register computers as members of the domain during restoration. CoSign does not require these administrative rights for regular use. In the following pages, default settings from the original installation will appear disabled. Click Next at every page. 7. Click Next. CoSign restoration begins. A status bar displays the status of the restore operation. 8. At the prompt, insert the backup MiniKey token that was used when first installing this appliance. CoSign reads the data from the MiniKey token. No writing to the MiniKey token is performed at this stage. 9. At the prompt, insert the license MiniKey token. When the operation is complete, the message Installation of CoSign appliance finished successfully appears above the status bar. Note: It is highly recommended to restart the CoSign appliance and synchronize CoSign with the Active Directory immediately after restoring the CoSign appliance. For more information, refer to Synchronizing CoSign with the Directory Service.
Restoring the CoSign Appliance in a Novell NDS Environment

Note: Starting from CoSign version 5, the format of the backup file has changed. Therefore, there are differences in the restore process when restoring from a backup file of version 5 and above compared to restoring from a backup file of a version older than version 5. To restore the CoSign appliance: 1. Make sure the appliance is in Factory Settings mode. You can check whether the Install state is Factory in the consoles Status menu (refer to Displaying CoSign Status). To restore CoSign to its factory settings, refer to Restoring Factory Settings. 2. In the ARX CoSign Appliance Management window (Figure 61), right-click CoSign appliances and select All Tasks Restore from the popup menu. A standard file selection dialog box appears. 3. Browse to the backup file and click Next. 4. Enter the IP address of the CoSign appliance and click Next. The User setup dialog box appears. 5. Enter the CoSign user name (login name), CoSign password, Confirm CoSign Password, and CoSign group name.
129
6. Click Next. Enter the built-in CoSign administrative user. You must provide the password of the built-in administrative user and confirm the password. In the following pages, default settings from the original installation will appear disabled. Click Next at every page. 7. Click Next. CoSign restoration begins. A status bar displays the status of the restore operation. 8. At the prompt, insert the backup MiniKey token that was used when first installing this appliance. CoSign reads the data from the MiniKey token. No writing to the MiniKey token is performed at this stage. 9. At the prompt, insert the license MiniKey token. When the operation is complete, the message Installation of CoSign appliance finished successfully appears above the status bar.
Restoring the CoSign Appliance in an LDAP Environment

Note: Starting from CoSign version 5, the format of the backup file has changed. Therefore, there are differences in the restore process when restoring from a backup file of version 5 and above compared to restoring from a backup file of a version older than version 5. To restore the CoSign appliance: 1. Make sure the appliance is in Factory Settings mode. You can check whether the Install state is Factory in the consoles Status menu (refer to Displaying CoSign Status). To restore CoSign to its factory settings, refer to Restoring Factory Settings. 2. In the ARX CoSign Appliance Management window(Figure 61), right-click CoSign appliances and select All Tasks Restore from the popup menu. A standard file selection dialog box appears. 3. Browse to the backup file and click Next. 4. Enter the IP address of the CoSign appliance. 5. Click Next. Enter the built-in CoSign administrative user. You must provide the password of the built-in administrative user and confirm the password. In the following pages, default settings from the original installation will appear disabled. Click Next at every page. 6. Click Next. CoSign restoration begins. A status bar displays the status of the restore operation. 7. At the prompt, insert the backup MiniKey token that was used when first installing this appliance. CoSign reads the data from the MiniKey token. No writing to the MiniKey token is performed at this stage. 8. At the prompt, insert the license MiniKey token. When the operation is complete, the message Installation of CoSign appliance finished successfully appears above the status bar.
130
Restoring the CoSign Appliance in a Directory Independent Environment

Note: Starting from CoSign version 5, the format of the backup file has changed. Therefore, there are differences in the restore process when restoring from a backup file of version 5 and above compared to restoring from a backup file of a version older than version 5. To restore the CoSign appliance: 1. Make sure the appliance is in Factory Settings mode. You can check whether the Install state is Factory in the consoles Status menu (refer to Displaying CoSign Status). To restore CoSign to its factory settings, refer to Restoring Factory Settings. 2. In the ARX CoSign Appliance Management window (Figure 61), right-click CoSign appliances and select All Tasks Restore from the popup menu. A standard file selection dialog box appears. 3. Browse to the backup file and click Next. 4. Enter the IP address of the CoSign appliance and click Next. The User setup dialog box appears. 5. Click Next. Enter the built-in CoSign administrative user. You must provide the password of the built-in administrative user and confirm the password. In the following pages, default settings from the original installation will appear disabled. Click Next at every page. 6. Click Next. CoSign restoration begins. A status bar displays the status of the restore operation
7. At the prompt, insert the backup MiniKey token that was used when first installing this appliance. CoSign reads the data from the MiniKey token. No writing to the MiniKey token is performed at this stage. 8. At the prompt, insert the license MiniKey token. When the operation is complete, the message Installation of CoSign appliance finished successfully appears above the status bar.
Using the Users Management Utility

The Users Management utility provides user management operations in cases where CoSign is installed in a Directory Independent environment and also the ability to view and perform some actions upon users when CoSign is installed in Active Directory/Novell NDS/LDAP environment. The Users Management utility enables an administrator to perform the following: Add a new user (only in a DI environment). Delete an existing user (in an LDAP, Multiple AD Domains, and DI environment). Change the password of an existing user (only in a DI environment).
131
5
View users information. Reset global and user-based signature counters.
Note: All these operations can be performed using an API called SAPI-MNG (Signature API Management). For more information on SAPI, refer to the CoSign Programmer Guide.
Activating the Users Management Utility

The Users Management utility is installed as part of the ARX CoSign Admin client component. To activate the Users Management utility: 1. Open the Start menu and select Programs ARX CoSign CoSign Control Panel. The CoSign Control Panel appears. 2. In the CoSign control panel activate the Users Management utility. The Users Management main window appears. 3. Use the Login or Login built-in user option to enable the administrator to login to CoSign. 4. Click Login and enter your user-name and password. The user-name and password is verified by the CoSign appliance. Also, the CoSign appliance checks that the connecting user has user administration access rights.
Users Management Main Window

The main window of the Users Management utility displays existing users in the CoSign database. Management operations can be performed using the drop-down menus, the toolbar, or the right click menu that appears when a user is selected.
132
Figure 68 Directory Independent Users Management Utility - Main Window
The following user details can be displayed: User Name The login name of the user. Email The email address of the user. Common Name The common name of the user. Type The type of user: User, Computer, Group. The Computer and Group types are relevant when working with Computer Keys or Group Keys (refer to Users Directory Parameters). Rights The access rights of the user. The following rights are possible: Regular user. Appliances admin. Users admin. Last Update Time The date and time when the user was last updated. Enrollment Status This field is relevant when the users key is located inside a SmartCard in a CoSign SSCD hardware model. The possible values are: Not relevant/OK. Waiting to enroll. Waiting to renew.
133
5
Not relevant. CN of the user changed. Email of the user changed. User certificate expiration. User was notified.
Enrollment Reason This field is relevant when the users key is located inside a SmartCard in a CoSign SSCD hardware model. The possible values are:
User Status The current status of the user. The possible values are: OK. Disabled The user was removed from the Signers group in Microsoft Active Directory. The user still exists in the CoSign users database, but is not able to sign. Signature Counter Counts how many signatures the user performed. The counter is effective only if the Enable User Counters system parameter is set to True.
Users Management Window Status Bar

The status bar of the Users Management window displays the following information: Display The number of users currently in the display. If a filter is used, the number will include only the users that matched the filter and appear on screen. Total The number of users in the CoSign database. License The number of users in the license token of the CoSign appliance. Signatures The number of digital signatures that were performed using the CoSign appliance. Three signature counters are displayed. The second and third counters can be reset by the administrator. The first counter cannot be reset and displays the overall number of digital signature operations performed by the appliance since it was installed.
Users Management Menus

The following sections describe the menu options available from the Users Management drop-down menus: File, User, View and Help.
File Menu
The following options are available from the File drop-down menu:
Reset System Signature Counter
Enables the administrator to reset the second and third system signature counters. Each of these counters displays the number of signatures performed using CoSign since the counter was last reset.
134
Generate Users report
Enables generating a report for all CoSign users. This report contains all the important CoSign user record fields. The report is output in a format that can be displayed in Microsoft Excel.
Login
Enables the administrator to login to CoSign. The administrator is prompted for his/her user ID and password. If CoSign is installed in an MS Active Directory and the mode of operation is SSPI, the administrator is logged on based on the existing PC login session.
Login built in user
Enables login using the built in administrator. The administrator is prompted to provide a user ID and password.
Logout
Enables the administrator to logoff CoSign.

Exit
Closes the Users Management application.
User Menu
The following options are available from the User drop-down menu. The options are activated upon a selected user.
Reset User signature counter
Enables resetting the first and second signature counters of the user.
New
This option is relevant only when CoSign operates in a Directory Independent environment. This option enables adding a new user to CoSign. When this option is selected, the New User dialog box appears.
Figure 69 Users Management Utility - New User Dialog Box
135
5
Enter the following user parameters: User Name The identification of the new user.
Common Name The Common Name of the user as it will appear in the users certificate. Email The email address of the user, as it will appear in the users certificate. Permissions The users authorizations. Select one or more of the following: User A regular CoSign user. Appliances Management Permission to perform administrator activities, such as downloading the audit log and backing up the database. Users Management Access right to manage CoSign users. Password The password of the user. Confirm Password Confirmation of the users password.
Delete User
Enables deleting a user from the CoSign Appliance. When this option is selected, a confirmation message appears, requiring confirmation for the deletion operation.
Set User Password
Enables updating a users password. When this option is selected, the Set new password dialog box appears. Enter and confirm the new password. Note that this dialog box also enables the administrator to update the permissions of the user.
136
Properties
Enables displaying existing information for a selected user. When this option is selected, the User Data dialog box appears.
Figure 70 Users Management Utility User Data Dialog Box
Note that almost all properties can be viewed in the main window of the users Management utility. The Personal Signatures Counter 1 and Personal Signature Counter 2 displayed in this dialog box indicate the number of digital signature performed by this user since the last time these counters were reset for the user. These counters are active only if the Enable User Counters system parameter is set to True.
View Menu
Toolbar
Enables toggling the view of the toolbar.

Status Bar
Enables toggling the view of the status bar.

Filter
Enables the administrator to filter the user display in the main window. When this option is selected, the Users filter definitions dialog box appears.
137
Figure 71 Users Management Utility Users Filter Definitions Dialog Box
You can filter the users display as follows: Maximum number of users in display Set this number to limit the number of users displayed in the main window. Default: 50. Filtering Criteria Enter a Name, Common Name, or Email in Field, and a string in Greater or equal to. The users list will display only those users whose Name/Common Name/Email is greater or equal to the given string. The greater or equal calculation is based on string comparison.
Refresh
Enables re-applying the filter on the users list. The users list refreshes and displays a users list according to the filter criteria.
List Icon Details
Enables defining the display of users in the main window as follows: List Only user names are displayed. Icon User names are displayed with a big icon. Details Each user is displayed together with some user information. Use the Select Columns option to specify which information will appear.
Select Columns
When this option is selected, the Select Columns dialog box appears. Use the dialog box to define which fields are displayed in the main window when it is defined to display user details.
138
Figure 72 Users Management Utility Select Columns Dialog Box
Help
Displays the About window that specifies the Users Management version and provides a link to the ARX site.
Users Management Toolbar

The Users Management toolbar contains shortcut buttons to the following options, available also from the drop-down menus:
Button Task Login Built-in Login Logout New User Delete User Set User Password View user properties Refresh Users list Filter About window
Right-click User Menu

To activate the User right-click menu, right-click a user in the main window. The options in the right-click menu are Reset user signature counters, Delete, Set Password, and Properties. These options exists in the User drop down menu option of the Users Management utility and are described in User Menu.
139
Figure 73 Users Management Utility Right-click Menu
Using Command Line Utilities

The following command line utilities can be executed from the administration station, and can be used as part of an overall batch script that is periodically activated: GetBackup Backs up a CoSign appliance. GetEvt Retrieves the event log of the CoSign appliance. SetSCP Sets the working state of the CoSign appliance. Groups A Windows utility that enables end users to set their current group. This enables the end user to use group keys. This utility cannot be executed in batch mode. The GetBackup, GetEvt and SetSCP utilities are installed as part of the ARX CoSign Admin component and located under Program files\ARX\ARX CoSign Admin Client. The Groups utility is installed as part of the ARX CoSign Client component, and its files are located under Program Files\ARX\ARX CoSign Client. Note: To display the required parameters for a command, execute the command without any parameters.
GetBackup
The GetBackup command enables you to back up the CoSign appliance to a file located on the local network. Note: This command provides the same functionality as the All Tasks Backup option in the CoSign Administration MMC (refer to Backing up the CoSign Data). The following table describes the available parameters for GetBackup:
Parameter -F <Output File name> Description Output file name of the backup file.
140
5
Description IP address of the CoSign appliance. If this value is omitted, it will be taken from the SCP or from the client configuration. Prompt For Logon value: 1 SSPI 2 Server Side Authentication (AD, Novell NDS) 3 SSPI User/Password Client (AD) 4 User Password. Directory Independent If this value is omitted, it will be taken from the SCP or from the client configuration.
Parameter -IP <IP Address>
-A <1,2,3,4>
-PN <CoSign Principal Name>
Principal name of the CoSign appliance. This is the name of the CoSign appliance in the directory service (i.e., csn000001). This parameter is mandatory in Microsoft Active Directory environments. If this value is omitted, it will be taken from the SCP or from the client configuration.
-U <User Name> -P <User Password> -D <Domain Name>
CoSign administrator user name. Password of the CoSign administrator user. Name of the domain or context.
GetEvt
The GetEvt command enables you to retrieve an event log from the CoSign appliance. Note: This command provides the same functionality as the All Tasks Download Logs CoSign Event option in the CoSign Administration MMC (refer to Downloading Log Files). The following table describes the available parameters for GetEvt:
Parameter -F <Output File name> -IP <IP Address> Description Output file name of the event log file. IP address of the CoSign appliance. If this value is omitted, it will be taken from the SCP or from the client configuration. Prompt For Logon value: 1 SSPI 2 Server Side Authentication (AD, Novell NDS) 3 SSPI User/Password Client (AD) 4 User Password. Directory Independent If this value is omitted, it will be taken from the SCP or from the client configuration.
-A <1,2,3,4>
141
5
Parameter -PN <CoSign Principal Name> Description
Principal name of the CoSign appliance. This is the name of the CoSign appliance in the directory service (i.e., csn000001). This parameter is mandatory in Microsoft Active Directory environments. If this value is omitted, it will be taken from the SCP or from the client configuration.
-U <User Name> -P <User Password> -D <Domain Name>
CoSign administrator user name. Password of the CoSign administrator user. Name of the domain or context.
SetSCP
The SetSCP command enables you to define in the directory whether the appliance is up or down. This enables or disables the appliance, and thus allows CoSign clients to immediately determine whether or not the CoSign appliance is active. Note: In an Active Directory environment you must be joined to the parent domain to activate the SetSCP utility. The utility will not work if the client is joined to the child domain. Note: This utility is not relevant for a Directory Independent or LDAP environment. The following table describes the available parameters for SetSCP:
Parameter -D <Domain Name> -N <Appliance Name> -K <Directory Kind> Description Name of the domain or context. Principal name of the CoSign appliance. This is the name of the CoSign workstation in the directory. Type of directory service. Possible values: A Microsoft Active Directory. N Novell NDS. -S <Working State> Working state of the CoSign appliance. Possible values: Up Down
Groups
Groups is a Windows utility that enables end users to set their current group. Any keys and
certificates that are created by communicating with an external CA are directed to the specified group. Note: You must set the Create Group Keys system parameter in order to use group keys. Refer to Changing CoSign System Parameters.
142
Note: This utility is not relevant for a Directory Independent environment since there is no definition of a group in that type of environment. To set the current group: 1. Run the Groups utility. The CoSign Client Default Group Selection dialog box appears. 2. Select a group from the list in the dialog box. 3. Click OK. Any subsequent enrollment to an external CA (or any other activity that creates keys or certificates) will be directed to this selected group. Note: All users that belong to this group can use the certificates.
143
Chapter 6: Using the CoSign Console

This chapter describes how to connect to and use the CoSign console.
Overview of the CoSign Console

You can use the CoSign console to manage CoSign. The console enables operations that cannot be performed using the CoSign Administration MMC. The CoSign Central FIPS and CoSign Central SSCD appliances have a built-in console display and keypad on the front panel of the appliance. For CoSign Central Enterprise and CoSign Central Starter, an external console terminal must be connected to the appliance serial port using the supplied cable. This chapter describes how to connect a console to the CoSign Central Starter and Central Enterprise appliances, and how to use the console for all CoSign appliances. Note: Throughout this chapter, the term CoSign Central FIPS refers to both the Central FIPS and the Central SSCD models, unless otherwise noted.
Configuring a Terminal
Note: This section applies to the CoSign Central Starter and Central Enterprise appliances. In order to use the CoSign console, you must first configure the console terminal. To configure the terminal: 1. Start CoSign by turning the power switch on. Note: CoSign does not need to be installed at this stage. 2. Using the supplied 9-pin crossed serial cable, connect a PC to CoSign. 3. On the PC, run a terminal emulation application, such as HyperTerminal. Note: HyperTerminal is supplied as part of the standard Microsoft XP/2003 installation and can be found under Start Programs Accessories Communications. 4. Configure the terminal application with the following parameters: COM port The local serial port on the PC to which you connected the cable. Baud rate (bits per second) 9600.
145
6
Data bits 8. Parity None. Stop bits 1. Flow Control None.
5. The main console screen appears on the terminal display. The main console screen displays the main menu.
Figure 74 Main Console Menu
Using the USB to Serial Adaptor

If your PC does not have a serial port, you can use a special USB to Serial adaptor provided with the CoSign Central Starter and Central Enterprise package. To use the adaptor: 1. Attach the adapter to the USB port of your PC and connect the serial side of the adaptor to the CoSign appliance. 2. When prompted to provide a driver, put the supplied CD into the CDROM drive, and specify the CDROM drive. The PC will find the driver on the CD and install it. 3. Configure the terminal application as above. The new adaptor will add a new COM port such as COM3. Use this port as part of the configuration.
146
Using the CoSign Console
Using the Console

The console is constantly running within all CoSign models. To operate the built-in console in a FIPS appliance, use the four buttons (numbered 1, 2, 3, and 4 from left to right) located on the FIPS appliances front panel below the display. To operate the external console terminal for an Enterprise and Starter appliance, use the keyboard keys 1, 2, 3, and 4. 1 and 2 are usually used for moving up and down to locate the desired function, while 3 is usually used for selecting. Note: The bottom line in the display always shows the current function of each key. CoSign Enterprise/Starter refreshes the terminal display every 10 seconds. Therefore, when you first open the console, it may take up to 10 seconds to view the display. To view the display immediately, press any key. The CoSign Central FIPS appliance has a screen saver feature that displays the ARX logo if the console is left idle for more than 10 minutes. Press any button to display the main menu. The bottom right side of the main menu may contain a flashing message. This indicates a state that requires user intervention. The possible messages are: [TAMPER!], [IP Addr], and [License]. Refer to Console Problems for more information.
147
6
Displaying CoSign Status
From the main menu, select Status. The CoSign appliance information appears (Figure 75). Press 1 and 2 to scroll up and down.
Figure 75 CoSign Appliance Information
The following table describes the CoSign appliance information parameters:

Parameter Ser # Description The appliances serial number. This is also the appliances domain computer name. Note: CoSign FIPS and CoSign SSCD appliances are prefixed CSN, and CoSign Enterprise and CoSign Starter appliances are prefixed sig. Date SW Version HW Version ET Service Install The current appliance date and time (PDT time zone). The CoSign appliance software version. The Cosign appliance hardware version. The Ethernet MAC address of the CoSign appliance. The status of the CoSign service. Possible values: Running, Starting, Stopped, Stopping. The installation status of the CoSign appliance. Possible values: Installed, Factory, CRP Wait, REPL Wait. Note: If a number is displayed for this parameter, installation is in progress. The number indicates the installation phase. Addr Mask GW DNS DNS2 DHCP IP address of the CoSign appliance. Subnet mask of the CoSign appliance. IP address of the default gateway. IP address of the DNS server. IP address of an alternate DNS server. Indicates whether DHCP is enabled. Possible values: Enabled, Disabled. Disabled means that the IP address should be entered manually. Enabled means that the IP address is taken from the DHCP server.
148
6
Description The CoSign service state. Possible values: OK, TAMPER!, No IP Address, License Error. Refer to Console Problems in Chapter 9: Troubleshooting for more information.
Parameter State
Link
The network connectivity state. Possible values: 10Mb, 100Mb, 1Gb.
DB size FIPS Mode
The size of the CoSign database files. Indicates whether the appliance is operating in FIPS mode. Possible values: ON (appliance operating in FIPS mode). Off (appliance not operating in FIPS mode). Note: For a more accurate definition of FIPS mode, refer to the value appearing in the CoSign report. To generate a CoSign report, use the Create Report option in the Help menu of the CoSign configuration utility. Refer to Create report.
Admin group Role Signers group SSCD stat
The name of the directory users group whose members are allowed to manage CoSign via the CoSign Administration MMC. The appliances role in the High Availability configuration. Possible values: Primary, Alternate, Standalone. Relevant only to Active Directory environment. Indicates the name of the Signers group in Active Directory. Statistical information that relates to the CoSign SSCD appliance. The following three numbers are displayed: total number of cards, total number of keys, and overall SmartCard utilization (% used). Information that relates to CoSign when users certificates are automatically issued by the Comodo Worldwide verifiable CA. The parameters are displayed in the following format: UUU/VVV Pend W/X/Y/Z, where: UUU is the number of current users in DB. VVV is the maximal number of certificates that can be published for the organization. W is the number of certificates that were requested but not yet approved. X is the number of certificates that were approved but the certificate was not yet downloaded. Y is the number of certificates that were downloaded from the CA. Z is the number of revoked certificates. Any parameters that are persistently non-zero indicate a problem, such as a networking problem. If the problem persists, contact ARX support at http://www.arx.com/support/supportrequest.
WWV Certs (Comodo)
149
6
Parameter WWV Certs (ChosenSecurity) Description
Information that relates to CoSign when users certificates are automatically issued by the ChosenSecurity Worldwide verifiable CA. The parameters are displayed in the following format: WWW CA Service UP UUU/VVV Pend W/X/Y/Z, where: UUU is the number of current users in the database. VVV is the maximal number of certificates that can be published for the organization. W is the number of certificates that were requested but not yet approved. X is the number of certificates that were approved but the certificate was not yet downloaded. Y is the number of certificates that were downloaded from the CA. Z is the number of revoked certificates. Any parameters that are persistently non-zero indicate a problem, such as a networking problem. If the problem persists, contact ARX support at http://www.arx.com/support/supportrequest. If the Certificate issuing service is down, the following message appears: WWW CA Service Down <Expiration Date>. The expiration date is the date of expiration of your organizations authentication key. If the date has passed, you should immediately renew the authentication key (refer to Renewing the ChosenSecurity Authentication Key File).
Note: The consoles display is not automatically refreshed with new data. For example, if the CoSign Service is in the process of stopping, the Status continues to be displayed as Running. In order to view updated information, return to the main menu and reselect Display status. Use the Refresh option to get updated values.
Enabling DHCP
DHCP is enabled by default. If you are currently using a static IP address, you can use this option to switch back to DHCP. To enable DHCP: 1. From the main menu, select Use DHCP. The following message appears:
Setting DHCP mode, please wait.
The IP address of the CoSign appliance is retrieved from the DHCP server. 2. You can view the value of the current IP address by selecting Display status from the main menu. Note: The DNS servers address will also be retrieved from the DHCP server after selecting this option.
150
Using a Static IP Address

To use a static IP address instead of DHCP: 1. From the main menu, select Set IP address. The current IP address information appears.
Figure 76 IP Address Information
2. Enter the IP address, network mask, default gateway, and DNS servers information. For each parameter, use < and > (buttons 1 and 2) to move between digits, and use + and (buttons 3 and 4) to select the desired digit. 3. Select Exit. When prompted, choose whether to Save (button 3) or Discard (button 4) the newly set addresses. 4. The following message appears when you choose Save:
Setting IP address, please wait.
After the IP is set, the following message appears:

DONE
Note: If only the DNS fields are modified, the appliance will continue to use DHCP for getting the IP address, subnet mask, and default gateway address.
Resetting the Tamper Mechanism (CoSign Enterprise Only)

If the cover of the CoSign Enterprise appliance is opened, the secret key used to protect the CoSign database is erased and the power is turned off. The next time CoSign is started, the Tamper LED flashes on and off, the Appliance has been tampered with message is displayed, and the flashing [TAMPER!] message is displayed in the main menu. The tamper mechanism must be reset before CoSign can be used. To reset the tamper mechanism: 1. From the main menu, select Reset tamper. 2. At the prompt, insert one of the backup MiniKey tokens. The following message appears:
151
CoSign Administrator Guide Please insert a backup Minikey that was created during installation
3. After the backup MiniKey is inserted, the following message appears:

Resetting tamper, please wait Done.
4. Remove the backup MiniKey token and insert the license MiniKey token. Note: If you insert the incorrect backup MiniKey token, the Failed, press any key to continue message is displayed and the tamper LED continues to flash. Perform the procedure again using the correct backup MiniKey token. Note: It is recommended to activate the Sync with Directory option after resetting the tamper mechanism. In Novell NDS, the full synchronization occurs automatically. For more information, refer to Synchronizing CoSign with the Directory Service.
Restoring Factory Settings

The console enables you to restore CoSign to its factory settings. You may want to do this in any of the following circumstances: CoSign was installed for demo, pilot, or development purposes, and you now want to reinstall the CoSign software for production purposes. You want to reinstall the CoSign software with different parameters. Installation failed or was stopped, and the CoSign software cannot be reinstalled again without restoring factory settings. Restoring factory settings performs the following functions: Deletes all data from the database, including all users, keys, and certificates. Uninstalls the CA located within CoSign. Unregisters CoSign from the domain. Resets all CoSign installation parameters to the default values. Resets the CoSign appliance. Note: In Active Directory environments, unregistering the CoSign appliance removes the appliance from the domain, but does not remove the CoSign computer from the Active Directory. To fully unregister the CoSign Appliance, manually remove the CoSign computer from the Active Directory. Note: To fully unregister the CoSign Appliance in Novell NDS environments, remove the CoSign Appliance, as well as the CoSign User and CoSign Administrative groups, from the Novell NDS directory.
152
Note: If the CoSign appliance was configured to receive certificates from a WWV external CA automatically, the operator will be asked whether to revoke the existing certificates in the external CA. You may want to keep the existing certificates if you are intending to perform a restoration operation right after the Reset to factory settings operation. If you choose to keep existing certificates, old certificates will not be revoked and the user can continue using the existing certificates. Note: If the CoSign appliance is based on SSCD hardware, the operator is queried whether to delete the SSCD keys. If you intend to restore CoSign from a backup file following the factory restore, do NOT delete the keys since the keys are not included in the backup of the CoSign appliance. If you do not intend to use the current SSCD keys, they can be deleted to enable maximum capacity for new SSCD keys. To restore factory settings: 1. From the main menu, select Factory restore. 2. Enter yes to confirm the operation.
Shutting Down
To shut down CoSign: 1. From the main menu, select Shutdown. 2. Enter yes to confirm the operation.
Setting Time
This option enables the operator to update the CoSign clock. This parameter is very important since it affects the effective start date of a user certificate generated by CoSign, as well as affecting Active Directory user authentication. You can modify the CoSign time by either modifying the contents of CoSigns date and time fields, or by specifying that CoSign time will be constantly updated by the time of an NTP server. To set the CoSign time: 1. From the main menu, select Set Time. The current time is displayed.
153
Figure 77 Setting CoSign Time
2. To modify the date and time fields, use the arrows to specify the field you wish to modify. Use the + and buttons to modify the content of the field. Repeat for every field you wish to modify. 3. Alternatively, you can specify an NTP server IP address. This option constantly updates the CoSign Server time according to the NTP server time. Notes: If you modify the Date or Time fields, any value entered in the NTP server field is ignored and set to all zeros. If you wish to stop being updated by the NTP server, change the NTP Server field to all zeros. By default, in an Active Directory environment, the clock is automatically synchronized with a Domain Controller. In this case, the text AD Sync will appear next to the NTP Server field. The time zone offset (-0800 in Figure 77) cannot be updated and is displayed for informational purposes only. 4. Use the arrows to navigate to Exit. When prompted, choose whether to Save (button 3) or Discard (button 4) the new settings.
Re-synchronizing with Active Directory

If you modify the time, synchronization with Active Directory is lost. To re-synchronize with Active Directory: 1. Change the NTP server address from 0.0.0.0 to 10.0.0.1 (that is, not a real NTP server) and press Save. 2. Change the NTP server address from 10.0.0.1 back to 0.0.0.0 and press Save again. CoSign is now synchronized with Active Directory.
Netware
This option is relevant only when CoSign is installed in a Novell NDS environment. You can set the IP address of a preferred Novell NDS server. This setting is relevant in cases where there are several Novell NDS servers and it is required to direct CoSign to use a certain Novell NDS server. You can also use this option to force the CoSign appliance to communicate with the defined Novell server.
154
Restoring the CoSign Appliance in the Case of an Internal Hard Disk Failure
The appliance provides a mechanism for full appliance recovery and return to factory settings in a case where there is a critical failure in the internal hard disk that prevents the CoSign software from booting and running normally. This option should be used only if the CoSign console does not reach the regular operating Menu and instead displays CoSign is now starting, please wait, or displays no message at all even though the appliance is powered. Note: It is highly recommended to consult with ARX technical support before performing a comprehensive factory restore. To perform a comprehensive factory restore: 1. Restart the appliance. 2. When the appliance starts, the following message appears for two seconds: Press the service key to enter the service console. 3. Press button 1. The Service menu is activated. 4. A please select message appears, prompting you to select between Quit and Restore. 5. Select Restore. Note: If you select Quit, the CoSign appliance continues to boot in the normal fashion. A final caution message appears: Restoring will erase all existing data. Are you sure? 6. Select Yes. Note: If you select No, the CoSign appliance continues to boot in the normal fashion. The Comprehensive Restore operation begins. The entire content of the CoSign firmware, including the data, is restored using a disk image that was created by ARX during CoSign manufacturing. You can now perform a restore operation using an existing backup file, or perform a new installation. Note: To clean all SSCD keys and revoke all the Worldwide verifiable certificates, you will need to perform a regular factory reset (refer to Restoring Factory Settings).
155
Chapter 7: Configuring High Availability

The high availability configuration enables an organization to setup several CoSign appliances to provide the following: Redundancy If a CoSign appliance is not available, the other CoSign appliances in the network continue to provide the essential digital signature functionality to the client. Load Balancing When the organization requires large volumes of digital signature operations, several CoSign appliances can be used in parallel to improve performance. This chapter provides an overview of the CoSign high availability configuration, followed by a detailed description of how to set up the CoSign system for high availability functionality. Note: High availability is not supported for CoSign SSCD appliances. The reason for this limitation is that the keys inside the SmartCard arrays cannot be extracted and therefore a user key cannot be replicated to several appliances.
Overview of High Availability

To enable a CoSign high availability site, several CoSign appliances are installed. All the CoSign appliances are connected to the organizational network and are provided with either static IP address or dynamic IP address. One of the CoSign appliances is defined as the primary CoSign appliance, and the other CoSign appliances in the site are defined as alternate CoSign appliances. The group consisting of the primary appliance and the alternate appliances is referred to as a high availability cluster. Information is replicated securely from the primary to the alternate appliances. The primary CoSign appliance: Contains the internal CoSign CA, and serves as the master database of the CoSign appliances site. Performs all administrative operations such as synchronizing with the Directorys users database and generating keys and certificates for all the relevant users. When using an external automatic Worldwide verifiable CA, the primary CoSign appliance communicates with the Worldwide verifiable CA to obtain end user certificates. The administrative operations can only be performed in the primary CoSign appliance, therefore if the primary CoSign appliance is down, none of these operations can be performed until the primary appliance is up again Note: Even in high availability configuration, you still need to periodically perform a backup of the primary appliance (using the CoSign Administration MMC or the GetBackup utility), in order to be able to re-install the primary appliance if it fails.
157
An alternate CoSign appliance is more limited in operations compared to the primary CoSign appliance, but it provides all digital signature operations. Thus it can provide the necessary Redundancy requirement if the primary CoSign appliance is not available, and the necessary Load Balancing requirement for large volumes of digital signature operations. Information Replication: To enable proper operation of the alternate CoSign appliances, the information that exists inside the primary CoSign appliance is replicated to the alternate appliances. The replication is performed through the network using secure mechanisms, which disable eavesdropping on the secret data transferred between the CoSign primary appliance and the alternate appliances. By default, the replication occurs every minute and sends all changes that occurred during the last minute. If a replication attempt fails, retries occur in one-minute intervals. The replication process stops after 10 failed retry attempts. Note: During information replication, data is transferred using the standard IPSEC protocol, with authentication based on a shared secret. The shared secret is based on a key that is diversified from the Server Master Key that is located in the Backup MiniKey. Client behavior in a high availability configuration: In a high availability configuration, the CoSign client retrieves the IP addresses of all the CoSign appliances from the SCP (in Active Directory and NDS environments), or from the local machine setting (in LDAP and Directory Independent environments). It then randomly selects an available CoSign appliance when a digital signature operation is required. For information about the SCP, refer to Distributing CoSign Information Through the SCP. For information about configuring the appliance in the client settings, refer to the Client Appliances section in the CoSign Configuration Utility chapter of the CoSign User Guide. However, when running an administrative client that performs administrative tasks such as inserting a new user to the system, the client will only use the primary CoSign appliance.
Installing CoSign Appliances in a High Availability Configuration

In a high availability configuration, the order of installation is as follows: 1. Install the primary CoSign appliance. 2. Install the alternate CoSign appliances. The following sections describe the installation process.
158
Configuring High Availability
Installing the Primary CoSign Appliance

Installing a primary appliance is identical to installing a stand-alone CoSign appliance (refer to Installing the CoSign Appliance Hardware and Installing the CoSign Appliance Software). During software installation, the administrator specifies the user management environment (i.e., Active Directory, Novell NDS, or Directory Independent).
Installing an Alternate CoSign Appliance

The following sections describe the hardware and software installation of an alternate CoSign appliance.
Installing the Alternate CoSign Appliance Hardware

Prepare the alternate CoSign appliance for installation, and perform the hardware installation of the appliance, as described in Installing the CoSign Appliance Hardware.
Installing the Alternate CoSign Appliance Software

Note: For proper installation of an alternate CoSign appliance in an Active Directory environment or Novell NDS environment, you must have the same permissions as the installer of the primary CoSign. Refer to Installing CoSign in a Microsoft Active Directory Environment and Installing CoSign in a Novell-NDS Environment. To install the alternate CoSign appliance software: 1. Open the CoSign Control Panel as follows: Open the Start menu and select Programs ARX CoSign CoSign Control Panel. The CoSign Control Panel appears. 2. Click the CoSign Appliances Management icon. The ARX CoSign Appliance Management window appears. 3. Login to the CoSign appliance using either the built-in administrator or another admin account. 4. Right-click the primary CoSign appliance, select All Tasks, and then select High Availability Install Alternate. 5. The Network setup dialog box appears.
159
Enter the IP address of the alternate CoSign appliance. This parameter is necessary for enabling basic communication to and from the CoSign appliance. Note: For information on setting up the IP address of the CoSign appliance, refer to Using a Static IP Address and Enabling DHCP. It is highly recommended to use a static IP address for the alternate appliances. If a dynamic (DHCP based) address is used, and the appliances address changes after the installation, the replication process will fail and a manual re-initialization will be required. 6. In the case of an Active Directory installation, enter the user name and password of an administrative account with permission to join the alternate CoSign appliance to the domain.
160
Figure 79 Active Directory Admin Account Dialog Box
7. Click Next. The CoSign installation begins. A status bar displays the status of the installation operation. During the installation, status messages appear on both the console display and the CoSign Administration MMC display. At the Please insert a backup Minikey prompt, insert one of the backup MiniKey tokens that were created during the installation of the primary CoSign appliance. It is very important to insert the correct backup MiniKey token since the token contains a set of Triple-DES Master Key of the primary Device, which are used to decrypt the keys database and check the integrity of the users database. Inserting an improper key will lead to improper authentication of the communication between the primary CoSign appliance and the alternate CoSign appliance, which will cause the replication to fail. 8. At the Please insert your License Minikey prompt, insert the license MiniKey token. Take care to insert the license MiniKey that is dedicated to this alternate CoSign appliance. For example, if four CoSign appliances are installed in the same site, each of the CoSign appliances should have its own license MiniKey, which means there will be four license MiniKeys in the site. The progress bar continues to display the progress of the operation. The primary CoSign appliance database is copied over the network to the alternate CoSign appliance.
161
7
9. At the end of the installation, the following message appears:
Figure 80 Initial Replication Message
Data replication between the primary CoSign appliance and the alternate CoSign appliance continues after CoSign alternate installation ends. 10. Click OK. Note: If the first stage of installation was unsuccessful, the CoSign appliance returns to its factory settings. This enables you to rerun the installation. In this case, the status bar displays that installation was unsuccessful, and you can click the Back buttons to modify settings before rerunning the installation. If the installation was unsuccessful and you are unable to rerun the installation, restore CoSign to factory settings and then try again. For more information about restoring factory settings, refer to Restoring Factory Settings. 11. In the ARX CoSign Appliance Management window, right-click CoSign appliances and select Refresh from the popup menu. The window refreshes and displays the newly installed alternate appliance.
Figure 81 ARX CoSign Appliance Management Window Displaying Primary and Alternate Appliances
12. Verify that all data was indeed replicated to the alternate CoSign appliance (refer to Managing Data Replication in the Alternate CoSign Appliance). The replication state should be OK (refer to Viewing Replication Status of an Alternate CoSign Appliance). 13. Perform a soft restart of the alternate CoSign appliance. The restart ensures that the alternate CoSign appliance starts using replicated data, such as system parameters; otherwise, unexpected results may occur.
162
The alternate CoSign appliance is ready for use.
Managing the Alternate CoSign Appliance

Some management operations are disabled for an alternate CoSign appliance. The management operations that can be performed on an alternate appliance include: Login. Uploading software. Downloading all types of log files. Restarting and shutting down the CoSign service or the CoSign appliance. Setting as a primary appliance. Uploading an SSL certificate for Web Services operation in the alternate appliance. Monitoring the performance of the appliance. Note: You can also optionally set an alternate appliance as the primary appliance. For more information refer to Setting an Alternate Appliance to be the Primary Appliance. These management operations are available from the ARX CoSign Appliance Management window of the CoSign Administration MMC (refer to Chapter 5: Managing the CoSign Appliance). Note: An alternate appliance cannot be backed up. If the appliance fails, it should be reinstalled as specified in Installing an Alternate CoSign Appliance. Note: If the primary CoSign appliance fails and is later re-installed from backup, all alternate appliances must be re-installed as well.
Managing Data Replication in the Alternate CoSign Appliance

You can view and manage data replication using the CoSign Administration MMC. The information can be expanded from the primary appliance information. It is important to view the replication status after the conclusion of alternate CoSign appliance installation, since the replication procedure continues after installation is complete. To view and manage data replication, select Subscribed Alternates under the primary CoSign appliance. The Subscribed Alternates window that appears lists the alternate CoSign appliances.
163
Figure 82 Subscribed Alternates Window
For every alternate appliance in the Subscribed Alternates window, you can: View replication status, in addition to other information about the alternate appliance. Re-initialize the alternate appliance, i.e., force a replication operation. Unsubscribe an alternate appliance. This removes the alternate appliance from the list of subscribed alternates.
Viewing Replication Status of an Alternate CoSign Appliance

The Subscribed Alternates window (Figure 82) in the CoSign Administration MMC displays the time of the last replication activity accompanied by descriptive text. It also displays the following information about each alternate CoSign appliance: the CoSign Serial Number, the IP Address and the Status. The possible statuses include: OK No data needs updating in the alternate CoSign appliance. Running The alternate CoSign appliance is currently synchronizing with the database of the primary CoSign appliance. Retrying The primary CoSign appliance is trying to communicate with the alternate CoSign appliance, but cannot reach it due to network problems or because the alternate CoSign appliance is not installed. Failed Replication has failed. This occurs after several failed retry attempts.
Re-initializing an Alternate CoSign Appliance

The Subscribed Alternates window in the CoSign Administration MMC enables re-initializing an alternate CoSign appliance. This forces a replication operation in which all the relevant data of the primary CoSign appliance is copied to the alternate CoSign appliance. Re-initialization can be used in cases where replication failed due to transient network problems. To re-initialize an alternate CoSign appliance: 1. In the Subscribed Alternates window (Figure 82), right-click the CoSign appliance you wish to re-initialize. 2. From the popup menu, select All Tasks Re-initialize.
164
Unsubscribing an Alternate CoSign Appliance

The Subscribed Alternates window in the CoSign Administration MMC enables unsubscribing an alternate CoSign appliance. This removes the alternate CoSign appliance from the list of Subscribed Alternates. Use this option when an alternate appliance is no longer relevant in the site of the primary CoSign appliance, or before re-installing the alternate appliance. To unsubscribe an alternate CoSign appliance: 3. In the Subscribed Alternates window (Figure 82), right-click the CoSign appliance you wish to unsubscribe. 4. From the popup menu, select All Tasks Unsubscribe. 5. At the prompt, confirm the operation.
Managing Primary Appliance Failure and Recovery

In cases of severe hardware failure in a primary appliance, you can set one of the alternate appliances to be the primary appliance. The selected appliance is now the primary appliance of the cluster. It can replicate its data to all the alternate appliances in the high availability cluster. The previous primary appliance is no longer a member of the high availability cluster. When the failed primary appliance recovers, you can re-define it as an alternate appliance in the cluster.
Setting an Alternate Appliance to be the Primary Appliance

In the case of severe hardware failure in a primary appliance, you should define an existing alternate appliance as the primary appliance. There are several reasons why it is advisable to have an up and running primary appliance available in a high availability cluster. These include: In a Directory Independent environment, you can add or update users only via the primary appliance. In an Active Directory, Novell NDS, or LDAP environment, you can synchronize with the domain only via the primary appliance. You can interface with the automated external CA only via the primary appliance. You can perform administrative operations only via the primary appliance. When the primary appliance is down, no administrative activity such as downloading a backup file is possible.
165
Before setting the alternate appliance as a primary appliance, you must ensure that all configuration settings that were defined in the environment of the primary appliance are also defined in the environment of the alternate appliance. For example, if the system is configured to use an automatic external CA, the primary appliance was given network access to the external CA. You should make sure that the alternate appliance is also able to access the automatic external CA. To set an alternate appliance to be the primary appliance: Caution: Make sure that there are no network disconnections or power failures during the following procedure. 1. In the ARX CoSign Appliance Management window (Figure 81), right-click the alternate CoSign appliance you wish to set as primary. 2. From the popup menu, select All Tasks High Availability Set as Primary. The Set as Primary window appears. The Cluster status section displays the current configuration of the cluster.
Figure 83 Set as Primary Cluster Status
3. Click Next and confirm the operation. A progress window appears, and the operation of switching the role of primary to the alternate appliance begins.
166
Figure 84 Set as Primary Removing Existing Primary
At the end of the operation a report is displayed, describing the performed actions. If you suspect any failure in the operation, contact ARX support at http://www.arx.com/support/supportrequest. 4. Click Finish. The selected appliance is now the primary appliance of the cluster. It can replicate its data to all the alternate appliances in the high availability cluster. Note: There can only be one primary appliance in a cluster. If the previous primary appliance becomes operational again, you can define it as an alternate appliance (refer to Setting a Previous Primary Appliance to be an Alternate Appliance).
Setting a Previous Primary Appliance to be an Alternate Appliance

You can set a previous primary appliance to be an alternate appliance. This is useful for cases where a previously-defined primary appliance that failed becomes operational again, and you wish to add it the cluster as an alternate appliance. To set a previous primary appliance to be an alternate appliance: 1. In the ARX CoSign Appliance Management window (Figure 81), right-click the previous primary CoSign appliance that you wish to designate as an alternate. 2. From the popup menu, select All Tasks High Availability Subscribe as Alternate. After you confirm the operation, the previous primary appliance will become an alternate appliance.
167
Resubscribing an Alternate Appliance with a Primary Appliance

There are cases where an alternate appliance is unsubscribed from a primary appliance, and you wish to resubscribe it with the primary appliance. For example, the alternate appliance is being upgraded. Starting from CoSign version 5, you can resubscribe an alternate appliance to the primary appliance. You do not need to re-install the alternate appliance, as required in previous versions. To subscribe an alternate appliance with a primary appliance: 1. In the ARX CoSign Appliance Management window (Figure 81), right-click the primary CoSign appliance to which you wish to subscribe an alternate appliance. 2. From the popup menu, select All Tasks
High Availability Subscribe Alternate to Primary.
You are prompted to supply the IP address of the alternate appliance. 3. Enter the IP address of the alternate appliance. 4. Confirm the operation. After several seconds the operation is completed and the specified appliance is added to the alternates list of the primary appliance.
Upgrading Appliances Participating in a High Availability Cluster

Note: All appliances participating in a high availability cluster must run the same version of CoSign. To upgrade appliances in a high availability cluster: 1. Unsubscribe all alternate appliances from the primary appliance (refer to Unsubscribing an Alternate CoSign Appliance). 2. In the Subscribed Alternates window (Figure 82), make sure that no alternate appliances are listed for the primary appliance. 3. Upgrade the primary appliance (see Upgrading CoSign). Wait until the upgrade is complete. 4. Reset the alternate appliances to their factory settings (refer to Restoring Factory Settings). 5. Upgrade all the alternate appliances to the same version as the primary appliance. In each alternate appliance, verify that the upgrade has completed successfully and that the CoSign console shows the updated version number. 6. For each alternate appliance, install the alternate appliance software (refer to Installing the Alternate CoSign Appliance Software). The high availability cluster is now upgraded and ready for operation.
168
Chapter 8: CoSign Configuration Utility

The CoSign client behavior in general and each CoSign component in particular have several modes of operation that are suitable for different kinds of usage and customer needs. These different modes of operation can be set by the user, or can be set and then distributed by the organizations administrator. The CoSign Configuration Utility enables both the user and the administrator to set the configuration of any parameter in any of the CoSign client components both for a single machine and for a group of machines. User related functionality is described in the CoSign User Guide.
Overview
The CoSign Configuration Utility is a GUI application that enables a user or administrator to set any of the CoSign client components configurable parameters easily and intuitively. The CoSign configuration Utility can run in either of two modes: Admin mode is run by an administrator to build a certain setting for distribution. It can be a registry file or a group policy that can be distributed to different clients by the Active Directory group policy mechanism, using login scripts or manually. End User mode allows a user (or administrator) to view or configure the CoSign client behavior on the machine on which the utility is running. The utility displays a components tree, in which you can select the component whose configuration values you wish to set. Each component includes several independent groups of parameters, which can be independently set. The utility can also be used on a specific machine to view or update the current configuration. This may be useful for debugging purposes or when the client behavior deviates from the expected. Note: The CoSign Configuration utility is not the only method for changing the CoSign clients behavior. Some of the components have their own GUI for setting their own configuration (such as the ARX Legacy Word Add-in plug-in, OmniSign, and others), but while the components' GUI changes the setting of the current user, the CoSign Configuration utility changes the configuration of the local machine. You can also use the CoSign Configuration Utility to retrieve the CoSign internal CA certificate and the CoSign CA CRL (Certificate Revocation List).
169
8
Using the CoSign Configuration Utility
The CoSign Configuration Utility enables you to view and edit all the configurable parameters of the CoSign client components. In End User mode, only the installed components are displayed, while in Admin mode you can view and change the settings of all the CoSign client components. Refer to Running the CoSign Configuration Utility in Admin Mode and Running the CoSign Configuration Utility in End User Mode for more information about the two modes. To run the CoSign Configuration Utility: To run in Admin mode, select Start > Programs > ARX CoSign > CoSign control panel. The CoSign Control Panel appears (Figure 42). Select the Client Configuration Management item. The CoSign configuration utility main window appears. To run in End User mode, select Start > Programs > ARX CoSign > CoSign Control Panel. The CoSign Control panel appears (Figure 42). Select the Client Configuration item. The CoSign configuration utility main window appears.
Figure 85 CoSign Configuration Utility Main Window
The left pane of the CoSign Configuration Utility displays a components tree. Each node in the highest level of the tree is a configurable client component. Each component has one or more sub-nodes, with each sub-node being a group of parameters. These sub-nodes group parameters by category, except for the Miscellaneous sub-node, which includes all the parameters that are not included in any of the other groups.
170
CoSign Configuration Utility
8
to the left of the
To edit a parameter: 1. Double-click the component to which this parameter belongs, or click component. The components sub-nodes are displayed.
2. Select the sub-node that contains the parameter. The right pane displays all the configurable parameters for the sub-node. The right pane of each sub-node (except Miscellaneous) displays all the configurable parameters, with a triplet of radio buttons on top. Since the Miscellaneous group is a collection of various unrelated parameters, it may display several triplets, one for each logical set of parameters. 3. Select one of the radio button options: Not Configured When this option is selected, the local machine definition of this sub-nodes parameters remains unchanged when the configuration is applied to the local machine. When this option is selected, the parameters are greyed out and you cannot edit them. Use Defaults When this option is selected, registry entries for all this sub-nodes parameters are removed when the configuration is applied to the local machine, and the CoSign defaults are used. When this option is selected, the parameters are greyed out and you cannot edit them. Set <Sub-node Name> Parameters When this option is selected, the sub-nodes parameters become editable and display values where applicable (either the default value or a value taken from the local machine definition). When the configuration is applied to the local machine, all the parameters of this group are written to the registry. New registry keys and values will be created if necessary, and the old values, if defined, are overwritten. You can configure parameters for the following CoSign components: Client. For explanations about the configurable parameters, refer to the CoSign Configuration Utility chapter in the CoSign User Guide. Signature API. For explanations about the configurable parameters, refer to the CoSign Configuration Utility chapter in the CoSign User Guide. Microsoft Office. For explanations about the configurable parameters, refer to the CoSign Configuration Utility chapter in the CoSign User Guide. OmniSign. For explanations about the configurable parameters, refer to the CoSign Configuration Utility chapter in the CoSign User Guide. Admin. For explanations about the configurable parameters, refer to Setting Admin Configuration.
CoSign Configuration Utility Menus

The following sections describe the menu options available from the CoSign Configuration Utility: File, CA, and Help. Note that the File menu differs for Admin mode and End User mode.
171
8
File Menu Admin Mode
The following options are available in Admin mode from the File drop-down menu: Note: For a detailed explanation of configuration file operations and group policy operations, refer to Configuration File Operations and Group Policies Operations.
New Configuration
Enables creating a new configuration file.

Open
Enables opening and importing a configuration file. All the settings defined in the file are displayed in the relevant components dialogs. The components and values that are not defined in the file appear with the Not configured option selected.
Save
Enables saving a configuration file.

Save configuration file as
Enables saving a configuration file as a new configuration file.

Export to configuration file
Enables exporting to a configuration file only when working on Group Policy settings. You must specify the desired file name and location. Exporting allows the administrator to distribute a specific configuration manually, or via login scripts or other distribution mechanisms that allow working with .reg files.
Export to group policy
Enables exporting the configuration file to an existing Group Policy. Select the Group Policy to which the settings should apply.
CA Menu
The following options are available from the CA drop-down menu:
Install CoSign CA Certificate
Enables installing CoSigns ROOT certificate into the current users PC. Refer to Chapter 4: Deploying the CoSign Client for information relating to CoSigns ROOT certificate.
Download CoSign CA Certificate
This option is very similar to the Install CoSign CA Certificate option. The difference is that in this case the CoSign ROOT CA certificate is output to a selected file. The downloaded file can be placed in the AIA location according to the AIA field defined in the users certificates.
172
Download CoSign CA CRL
Enables downloading the CoSign CRL (Certificate Revocation List) to a file. The downloaded file can be placed in the CDP (CRL Distribution Point) location according to the CDP field defined in the users certificates.
Help Menu
The following options are available from the Help drop-down menu:
About
Displays the version of the CoSign configuration utility as well as a link to the ARX web site.
Contents
Displays the content of this chapter in on-line help format.

Create report
Enables generating a report listing information on both the CoSign Client installation and the CoSign appliance installation. Click Save to save the report to a file. The file can be sent to ARX support for problem analysis. The report includes three parts: CoSign Client installation files Includes all the files of the CoSign installation, their dates, sizes and version information. CoSign Client and Server parameters Includes CoSign Client and Server parameters. The parameters also include information that is displayed in the CoSign console. Environmental information Displays information about the PC in which the CoSign client is installed, the version of the installed MS Office application, and other parameters that can be valuable to ARX support for problem analysis.
Running the CoSign Configuration Utility in Admin Mode

Note: To run the CoSign Configuration Utility in Admin mode, you must first install the CoSign admin client. Refer to Installing CoSign in a Directory Independent Environment. To run the CoSign Configuration Utility in Admin mode: 1. Select Start > Programs > ARX CoSign > CoSign control panel. The CoSign Control Panel appears. Select the Client Configuration Management item.
173
Figure 86 CoSign Client Configuration Utility Admin Mode
2. Edit the parameters as described in Using the CoSign Configuration Utility. When running in Admin mode, all the CoSign client configurable components are displayed in the left pane, regardless of the CoSign components installed on the machine you are working on. The application starts with a new configuration file whose components are all non-configured. You can either edit this new configuration or you can open an existing configuration from a file or from Group Policy. The Admin mode of the CoSign Configuration Utility enables administrators to create and edit configuration files and to add and edit CoSign client configuration to an existing Active Directory Group Policy. The configuration files are actually valid registry files that can either be imported to an end user machine (by double-clicking them or from regedit), or can later be used as input to the configuration utility (in Admin mode) for further editing or for exporting to Group Policy, or can be imported by the Configuration Utility (in End User mode) for configuring a single machines settings. You can perform the following when running the CoSign Configuration Utility in Admin mode: Edit and save a configuration file. Edit/view a configuration file and export the CoSign client settings to an existing Active Directory Group Policy.
174
Edit/view the CoSign settings of a Group Policy and save them in the same Group Policy or export them to another Group Policy. Edit/view the CoSign settings of a Group Policy and export them to a configuration file. Install/Download the CoSign CA certificate. Refer to Install CoSign CA Certificate and Download CoSign CA Certificate. Download the CoSign CA CRL (Certificate Revocation List). Refer to Download CoSign CA CRL. The following sections describe basic Configuration File and Group Policy operations.
Configuration File Operations

The following sections describe basic configuration file operations.
Creating a New Configuration File

A new configuration file can be created in either of two ways: When the application starts it always starts with a new configuration file. By selecting File > New configuration. After changing all desired parameters, you must either: Save the configuration file select either File > Save or File > Save configuration file as. Export the configuration file to an existing Group Policy (refer to Exporting to a Group Policy).
Opening a Configuration File

A configuration file is typically opened for one of two reasons: For editing and saving. For viewing and exporting to an existing Group Policy. To open a configuration file, select File > Open. All the settings defined in the file are displayed in the relevant components dialogs. The components and values that are not defined in the file appear with the Not configured option selected.
Exporting to a Configuration File

When in Admin mode, you can export to a configuration file only when working on Group Policy settings. Exporting allows the administrator to distribute a specific configuration manually, or via login scripts or other distribution mechanisms that allow working with .reg files. To export a Group Policy setting to a configuration file, select File > Export to configuration file, and browse for the desired file name and location.
175
8
Group Policies Operations
When opening and exporting group policies, a list of the available policies is displayed according to the current users credentials and the domain to which the current machine is joined. This list contains all the domains group policies which the user may view/edit, as well as all the group policies defined for the local machine which the user may view/edit. The CoSign Configuration Utility enables you to view and edit CoSign related parameters in a Group Policy.
Opening a Group Policy

The CoSign Configuration Utility can be used to open and edit the CoSign setting in an existing Group Policy. Note that only the CoSign specific settings are retrieved from the Group Policy and thus only these settings can be edited or viewed. To open a Group Policy for editing, select File > Open group policy. A list of all the available group policies is displayed. Select a group policy, and all its defined settings are displayed in the relevant components dialogs. The components and values that are not defined in the policy appear with the Not configured option selected. Specifically, if you open a Group Policy that never contained CoSign definitions, all values of all components appear with the Not configured option selected. After setting (or viewing) the desired values, you can either save the settings to the Group Policy, or export the values to a configuration file or to another Group Policy. Refer to Exporting to a Group Policy and Exporting to a Configuration File, respectively, for how to export the configuration values.
Exporting to a Group Policy

Exporting to a Group Policy is typically performed in either of two situations: When you work on a Group Policys settings and wish to apply the settings to another Policy. When you work on a configuration file and wish to apply the settings to a Group Policy. To export configuration settings to a Group Policy, select File > Export to group policy, and select the Group Policy to which the settings should apply. Note: After exporting the settings to a Group Policy, additional changes are saved to the original file or policy and not to the one to which the settings were exported.
Running the CoSign Configuration Utility in End User Mode

The CoSign Configuration Utility can also be used for editing and viewing a specific machines settings. When the application runs in End User mode, it looks for all the CoSign components that are installed, and for each component reads its settings and displays them in the relevant dialog. For more information, refer to the CoSign User Guide.
176
Distributing the CoSign Client Configuration

The CoSign client consists of several components, which can be operated in different modes according to organizational needs. These modes can be controlled by the components parameters. While in some organizations there is a policy of how things should work and look like, and therefore all users must have the same configuration, there are some other organizations where there is more than one such policy for the different organizational units, and others where there is no policy at all and every user can determine his/her own configuration. All CoSign components are installed with a default behavior that should fit most users. Some components have their own GUI for changing the default configuration, and the client configuration can also be centrally set using a configuration file or Group Policy. Following is a list of the common ways to set and distribute CoSign client configurations: Use CoSign defaults Do nothing except install the CoSign client from the CoSign CD. All users will have the same default behavior. Use the components GUI For each configured machine, use the CoSign components GUI to configure each component (Office Signature plug-in, OmniSign) as desired. Refer to the chapters describing the components GUI for an explanation of the various parameters and how to configure them. Use the CoSign Configuration Utility in End User mode Run the CoSign Configuration Utility on each machine you wish to configure and set the parameters as desired. Use Configuration files Use configuration files that are created by the CoSign Configuration Utility. Refer to Distributing the CoSign Configuration Using Configuration Files below. Use Group Policy In an Active Directory environment you can use Group Policies for distributing different configurations to different groups of machines. Refer to Distributing the CoSign Configuration Using Group Policy.
Distributing the CoSign Configuration Using Configuration Files

The configuration files created by the CoSign Configuration Utility are actually valid .reg files. You can create these files in Admin mode (refer to Creating a New Configuration File), or by exporting a certain machines setting. Once the configuration file is created you can distribute it in any of the following ways: Manually Refer to Distributing the CoSign Configuration Manually. Using Login Scripts or other distributing software Refer to Distributing the CoSign Configuration via Login Scripts or any Distributing Software.
177
8
Distributing the CoSign Configuration Manually
Note: You must have administrative rights on the machine in order to apply the configuration values. To distribute the CoSign configuration manually: 1. Copy the appropriate .reg file to the machine for which you want these settings to apply. 2. Double-click the file. A message pops up, requesting confirmation to apply the new registry values.
3. Click Yes, and wait for the message confirming that the operation was completed successfully.
4. Click OK. Note: Some CoSign components must be restarted in order for the new configuration to take effect, or else they will keep working with the old settings. It is recommended to restart the machine after manually installing a new configuration.
Distributing the CoSign Configuration via Login Scripts or any Distributing Software
Since the configuration file is a .reg file that changes some settings in HKLM, any software or tool that is able to apply .reg files and has the appropriate access rights on the target machine can be used to distribute the CoSign configuration files.
Distributing the CoSign Configuration Using Group Policy

In an Active Directory environment, you can distribute the CoSign configuration using a Group Policy. You can use one Group Policy for all your users, or you can have several policies for several organizational units. CoSign configuration values do not require a proprietary Group Policy, but are integrated in existing policies.
178
When opening a Group Policy in the CoSign Configuration Utility, the application retrieves only the CoSign-related parameters and displays them in the relevant dialogs. When saving the configuration, or when exporting it to a specific Group Policy, the application removes all the CoSign-related definitions from the existing policy, and replaces them with the new settings. All non-CoSign-related definitions are not affected by the saving/exporting action. Both the opening and the saving operations show the user all existing Group Policies available to the user according to the users credentials; you cannot use the CoSign Configuration Utility to create a new policy.
Setting Admin Configuration

Admin configuration enables you to set parameters relating to the CoSign appliance installation. Some of these parameters affect the appliance itself, while others configure the administrators machine installation capabilities.
Admin Appliance Installation

This group enables you to set parameters that relate to the CoSign appliance installation. You can set the log level and the administrators group defined within the appliance, as well as the administrators machine installation capabilities, such as in which types of directories you can install CoSign, and whether you may set AIA and CDP in the internal CA setup.
Figure 87 Configuring Admin Appliance Installation Parameters
179
8
CoSign appliance related settings:
In the Appliance Installation group you can set the following Admin parameters:
Cluster ID (0 means use default) Do not change this value unless instructed to do so by ARX technical support. Appliance installation log level Specify the reporting level of the appliance to the log while installation is in progress. It is recommended not to change this setting. Certificate common name origin Directs CoSign how to define the Common Name field in the created user certificate. The origin can be either the common name of the user in the directory or the display name of the user in the directory. This parameter is identical to the Certificate Common Name parameter in the CoSign system parameters. Administrators group name Specify the name of the directory services user group that identifies authorized CoSign administrators. You can select any name for this group. Make sure that all users who perform CoSign administrative tasks are assigned to this group. Default value: administrators. Certificate expiration variance The maximum number of days that may be subtracted from the certificates expiration date for the purpose of refreshing the certificate This parameter is identical to the Certificate Expiration Variance parameter in the CoSign system parameters Administrators machine related settings: Allow AD install Check this option to enable the administrator to install CoSign appliance in an Active Directory environment. Allow NDS install Check this option to enable the administrator to install CoSign appliance in a Novell environment. Allow Directory Independent install Check this option to enable the administrator to install CoSign appliance in a Directory independent environment. Allow extended install types This option should always remain unchecked. Allow AIA/CDP entry Check this option to enable the administrator to change the AIA and CDP fields in the CA setup dialog.
180
Chapter 9: Troubleshooting
This chapter offers solutions to various problems you may encounter while installing or running CoSign. If you are unable to identify or solve a problem, try the ARX support web site at http://www.arx.com/support/ or contact ARX Support at http://www.arx.com/support/supportrequest ARX Support information Support web site Support Request Form: Support email address: http://www.arx.com/support/ http://www.arx.com/support/supportrequest [email protected]
ARX Contact information ARX web site: ARX US Headquarters: http://www.arx.com 855 Folsom Street, Suite 939 San Francisco, CA 94107
Installation Problems
This section describes various problems and error messages you may encounter during the installation process, and provides possible solutions to these problems.
CoSign IP Address is Invalid

Problem: During CoSign software installation, this message appears after you enter the CoSign address and click Next. Solution: This message indicates that CoSign is not accessible. Perform the following: Verify that the IP address you entered is correct. Verify that CoSign is operational. Check for networking problems.
181
Error When Setting the CoSign IP Address Via the Console Interface
Problem: When setting the CoSign IP address through the console, one of the following error messages appear: failed error 51, failed error 52, or failed error 54. Solution: Check the following: Verify that CoSign is properly connected to the network. Verify there are no switch problems, cable problems, etc. Verify that the IP address you entered is not being used by another machine in the network. One way to check this is to ping the IP address; if you receive an answer, it means that the IP address is being used by another machine in the network. If the problem is none of the above and the network has a DHCP server installed, perform the following:
1. 2. 3. 4. 5. Choose the Use DHCP option in the CoSign Console main screen. Restart the CoSign appliance. Select Ip Addr in the CoSign Console main screen to view the IP address that was allocated by the DHCP server. Perform Save. The Appliance saves as static IP the address that was allocated by the DHCP server. Remove this IP address from the IP addresses pool of the DHCP server.
Default Values Do Not Appear in the Directory Setup Dialog Box

Problem: During CoSign software installation, the Directory Setup dialog box appears without any default values. Solution: DNS configuration may be problematic, causing an installation failure. For more information, refer to Installation Failed.
The Appliance is Not in Factory Settings Mode

Problem: During CoSign software installation, this message appears after you enter the CoSign address and click Next. Solution: This message indicates that a CoSign appliance with the IP address entered is already installed. Perform one of the following options: Enter a different IP address. Return CoSign to factory settings using the console, and then rerun the installation process. Note: Since this message indicates that CoSign is already installed, you may want to cancel the installation process to prevent the accidental reinstallation of CoSign.
182
Troubleshooting
Installation Failed
Problem: The CoSign software installation process fails. Solution: Verify the following: DNS supports dynamic updates. This information is included in the DNS server properties. The user running the CoSign Administration MMC has the necessary privileges. The user must be a member of both the domain admins and enterprise admins groups. If you have verified all of the above, and the installation process still fails, download the Install log. For information on downloading the Install log, refer to Downloading Log Files. The Install log may include one of the following errors: Failed to join the domain If this error appears in the Install log, verify the following: The domain controller is up. The domain name was entered correctly. The administrator user has the necessary privileges to register computers to the domain. Failed to remove http URLs for CDP and AIA This error usually indicates a failure in CA installation. Send the Install log file to ARX technical support ([email protected]).
Progress Bar Stops Advancing

Problem1: During CoSign software installation, the progress bar stops advancing at the users keys and certificate generation stage, and only one user is defined in CoSign. Solution 1: There may be a DNS configuration problem (in either DHCP or static IP mode). Perform the following: Do not close the CoSign installation wizard. Modify the DNS Server IP address from the console. The progress bar will continue advancing until the installation is completed. Problem2: During CoSign software installation, the progress bar stops advancing at the users keys and certificate generation stage. Solution 2: There is a Novell NDS configuration problem. The CoSign appliance internal clock and the Novell NDS server clock are not aligned. Perform the following: Close the CoSign Administration MMC window. View the amount of users in the console and validate that indeed all the users were created.
183
9
CoSign Appliance Installation Issues
Problem: In an MS Active Directory environment, right after the installation starts, the following error appears: "Installation failed in step 93 with reason: failed to join the domain, error code is 1231". Sometimes the error code is 1355. Cause: The CoSign appliance failed to join the domain due to network configuration problems. Solution: Check for network setting such as DNS IP on the CoSign console. Make sure to restart the appliance after any changes to the IP or DNS even if the change was successful. To be sure that your network configuration is OK try to ping with the CoSign appliance IP using the a option. You should get a reply with the appliance full DNS name.
High Availability/Load Balancing Alternate Installation

Problem: After completing the installation of an alternate CoSign, the following message appears in the subscribed alternate: "The snapshot for this publication has become obsolete". Cause: You did not restart the primary CoSign appliance before starting the alternate installation. Solution: 1. Unsubscribe the alternate appliance. 2. Restore the alternate to factory settings. 3. Restart the primary appliance (hardware restart). 4. Re-install the alternate appliance.
CoSign Appliance Problems

CoSign Appliance Does Not Start
Problem 1: Even though power is on, the appliance shows no sign of being on. The power LED is off. Solution 1: Check that the power cables are indeed connected to the power supply. Problem 2: The power LED is on. The Console does not stop displaying the message: CoSign is now starting, please wait. Even after restarting CoSign several times the same message continues to display. Solution 2: Follow the instructions in Restoring the CoSign Appliance in the Case of an Internal Hard Disk Failure. It is recommended to consult with ARX technical support before carrying out the instructions.
184
Troubleshooting
Console Problems
The console provides messages and alerts for the following problems (refer to CoSign Does Not Respond for more information): [Tamper] A tamper event occurred. [License] There is a problem with the license MiniKey. [IP Addr] The appliance does not have an IP address. Following are licensing issue messages that can also appear in the console: Passed 90% of CoSign license limit Contact ARX to obtain a larger license. CoSign appliance license is not present, please insert your license MiniKey. Warning <num> of 5, system will shutdown! The license MiniKey is not inserted. Insert the MiniKey immediately. The amount of users in the CoSign appliance has passed the license limit. Warning <num> of 5, system will shutdown! Either obtain a new license MiniKey from ARX, or remove users from the scope of CoSign users. An improper license Minikey is inserted(<error-code>). Warning <num> of 5, system will shutdown! Insert a proper license MiniKey. For more information on licensing issues, refer to New Users Do Not Receive Certificates.
Client-Related Problems
This section describes various problems and error messages you may encounter while running the CoSign Client, and provides possible solutions to these problems.
Cannot Enable the Add Digital Signature to Outgoing Messages Checkbox in Outlook
Problem: In Microsoft Outlook, the Add digital signature to outgoing messages checkbox is disabled. Solution: In order to send signed emails, you must first define security settings. Refer to Signing Outlook Emails in the CoSign User Guide.
Cannot See Any Certificates in Store

Problem: You cannot see any certificates in your Microsoft Personal certificates store. Solution: Perform the following: 1. Restart the machine and try again.
185
9
2. Verify the following:
You are logged in to the same domain as CoSign. You should not be logged in to any other domain, and you should not be logged in to the current machine. Your DNS definitions are correctly configured on the PC. These definitions should be the same as the domains DNS. You receive a response when you ping the CoSign IP address or try to connect to CoSign using telnet to port 443. Your user account is defined in the directory that was defined as the AD users container during CoSign installation (refer to Figure 15). If you are using a Directory Independent environment, you did not omit to set configuration parameters for the client machine. Use the Cosign Configuration Utility to setup the CoSign appliance IP address (refer to the Client Appliances section in the CoSign Configuration Utility chapter of the CoSign User Guide).
Administrative Problems
This section describes various problems and error messages you may encounter while managing CoSign, and provides possible solutions to these problems.
CoSign System Parameters Do Not Appear in the CoSign Administration MMC

Problem: You do not see any CoSign system parameters in the CoSign Administration MMC. Solution: In order to perform administrative operations using the CoSign Administration MMC, you must be a member of the CoSign Administrators group. This group is defined in the Administrator Group system parameter, and its default value is Administrators. The Administrator Group parameter is displayed in the CoSign Console (refer to Chapter 6: Using the CoSign Console). Starting from version 4 you can use the built-in administrator defined during installation for administrating the CoSign appliance.
All CoSign Administration MMC Operations Fail

Problem: Any operation you attempt to perform in the CoSign Administration MMC fails. Solution: Refer to CoSign System Parameters Do Not Appear in the CoSign Administration MMC.
186
Troubleshooting
CoSign Does Not Respond

Problem: You cannot access CoSign through the CoSign Administration MMC or perform digital signature operations. Solution: Check the appliance status. The cause may be one of the following: A correct license MiniKey token is not inserted, causing CoSign to turn itself off after two hours. Insert the correct license MiniKey and restart CoSign. A tamper event occurred, and the Tamper LED is blinking. Reset the Tamper mechanism from the console (refer to Resetting the Tamper Mechanism). CoSign failed to receive an IP address, and the Tamper LED is lit. Check the cable and DHCP server. Once the network problem is resolved, the LED turns off and CoSign begins working. The CoSign users OU was modified. Verify that the CoSign users OU was not modified, and it is the same as was entered during CoSign installation. If none of the above is applicable, run the console and enter 1 from the main menu (refer to Displaying CoSign Status). Check the appliance information for the CoSign Service State parameter, as follows: If the CoSign Service State is Running, check for a network problem between CoSign and the clients. If the CoSign Service State is Stopped, restart CoSign and then recheck the CoSign Service State. If the CoSign Service State is still Stopped, contact ARX technical support ([email protected]). If the CoSign Service State is neither Running nor Stopped, first check to see whether there is a networking problem (ping the CoSign IP address). If this is not the problem, contact ARX technical support ([email protected]).
New Users Do Not Receive Certificates

Problem: When you add new users to the system, CoSign does not assign the users certificates. Solution: Verify that the number of users does not exceed the CoSign license. To do this, check the number of users currently defined in the database and the number of users allowed by the license MiniKey token. Both numbers appear on the Display status page in the console (refer to Displaying CoSign Status). If there are too many users defined in the Users OU, perform one of the following actions: Request a new license from ARX. Delete unnecessary users. Move some of the users to another OU.
187
Then perform Sync with Directory from the CoSign Administration MMC (refer to Synchronizing CoSign with the Directory Service). If the number of users in the Users OU does not exceed the license, there may still be too many users defined in the CoSign database. Download the Event log. If this is the problem, the message CoSign appliance reach license limit, please upgrade your CoSign license appears. In this case, perform Sync with Active Directory from the CoSign Administration MMC. Note: All users defined in the OU are counted toward the total number of users, including special users such as IUSR*, guest, etc. Another cause may be that a user tried to log in immediately after being added to the system, before CoSign updated its database. In this case, the user should log off and then log in again.
Restore Appliance Fails

Problem: When you attempt to restore the appliance (refer to Restoring the CoSign Appliance), the operation fails immediately after inserting the backup MiniKey token. In this case, the failed to parse the backup header message appears in the Install log. Solution: You may have inserted the wrong MiniKey token. Make sure that the MiniKey token you insert is the same MiniKey token that was used during the installation process. If the correct MiniKey token was inserted and the Restore Appliance operation still fails due to MiniKey token hardware problems, try again using the second MiniKey token of the pair.
Backup CoSign Operation Fails

Problem: When attempting to backup the CoSign appliance using the getbackup.exe utility or the CoSign appliance management console, the backup process fails. The administrator has full administrative privileges on the MS Active Directory. Cause 1: CoSign administrative tasks can be performed only by a user who is himself a member of the CoSign administrators group (and not a member of a group that is member of the CoSign administrators group). Solution 1: Check the name of the CoSign administrators group on the CoSign appliance console and make sure you are yourself a member of that group. It is also possible to use the CoSign built-in administrator. Cause 2: On the debug log you will see that the backup failed because it failed to copy the CoSign internal CA CRL file. Solution 2: Perform a hardware restart.
188
Appendix A: CoSign Installation with Reduced Privileges

This appendix describes how to perform CoSign installation in an Active Directory environment with reduced permissions.
Overview
When the CoSign appliance is installed in an Active Directory environment, you must login with an admin account and provide the installation wizard with both an admin account and a password, to enable both the appliance installation and the appliance operation in the MS Active Directory environment. During installation, the administrative permissions enable the creation of new objects in the MS Active Directory and updating of existing objects. Access to the administrative account is limited to the installation phase, and is not required for the ongoing operation of CoSign. CoSign appliance installation is performed using the CoSign Appliance Management utility and is described in detail in Chapter 3: Installing CoSign. There are cases where the CoSign appliance is installed in environments that do not have global administrative permissions, for example, a department of a big organization. In this type of organization, there are several administrators for the organizations Active Directory, with each administrator responsible for maintaining a department that is defined as a specific OU (Organizational Unit) in the organizations Active Directory. These administrators have permissions only to manipulate objects in their departments OU, but do not have permission to update any objects outside that scope. CoSign Client enables administrators with restricted permissions to install the CoSign Appliance. Additional operations must be performed in addition to the actual installation, to provide a functionality similar to that of a privileged administrator performing an installation. Note: In some cases, an installation with reduced privileges reduces the functionality of CoSign. This appendix describes the differences between a regular CoSign installation and a CoSign installation with reduced privileges. It includes the following sections: Regular CoSign Installation This section describes a regular CoSign appliance installation, with a focus on the Active Directory operations performed by the installation, and the functional purpose of each Active Directory operation. CoSign Installation with Reduced Privileges This section describes the reduced CoSign appliance installation. It details the activities that must be carried out to enable the functionality provided by the regular installation procedure.
189
Note: You can switch to another administrative account if the current administrator fails to perform an operation which accesses the Domain. The failed administrator is prompted to supply an alternate administrator account. This ability may resolve issues of reduced privileges that arose in pervious versions. For more information about this functionality refer to Permission Considerations.
Regular CoSign Installation

The following sections list all the operations carried out during CoSign appliance installation that require Enterprise admins or Domain admins permissions.
Creating a New Computer Account for the CoSign Appliance

The installation creates a new computer account for the CoSign appliance if an account does not yet exist. The installation also grants this account membership to Cert publishers and to Pre-Windows 2000 Compatible Access.
Joining the CoSign Appliance to MS Domain

In order to install CoSign in an Active Directory environment, the installation requires an administration machine joined to the domain and logged in with a user who is a member of the Enterprise admins and Domain admins groups.
Creating a Services Connection Point (SCP)

The installation creates an SCP object, which contains information (such as the CoSign IP address) that enables the CoSign Clients to connect to the CoSign appliance. This object is located in Active Directory Sites and Services Services Net Services. The CoSign appliance computer account is granted read and write access rights so that the CoSign appliance can update SCP information.
CoSign User Synchronization

During normal operation, the CoSign appliance synchronizes periodically with the domain by querying for new, updated, or deleted user objects. It may also update the user certificate attribute of users for whom it had issued a certificate (refer to Updating the userCertificate Attribute for Users below). To enable proper synchronization of users, read access rights to the Deleted Objects container are granted to the CoSign appliance to enable querying the deleted user objects.
190
CoSign Installation with Reduced Privileges
Updating the userCertificate Attribute for Users

Write access rights to the userCertificate attribute for all users objects in the users OU is required. The userCertificate attribute contains the updated CoSign certificate of the user. This is enabled by assigning the CoSign Computer to the Cert Publishers group as part of the installation procedure. Starting from CoSign version 5, CoSign will not update the certificate attribute of a user by default.
CoSign CA Root Certificate Information

AIA (Authority Information Access) and CA objects that contain the CoSign published Certificate Authority root certificate are updated by the CoSign appliance during installation. This information automatically updates all machines in the domain, thereby providing proper signature verification. The objects are located in Active Directory Sites and Services Services Public Key Services AIA, and Active Directory Sites and Services Services Public Key Services CA. Read and write access rights are granted to the CoSign appliance computer account so that the appliance can publish and update CA objects.
CoSign CA CDP (Certificate Distribution Point)

The CoSign CA CDP (CRL Distribution Point) contains the updated CoSigns published CRL (Certificate Revocation List). This object is located in Active Directory Sites and Services Services Public Key Services CDP. Read and write access rights are granted to the CoSign appliance computer account so that the appliance can publish and update new CRLs.

During the CoSign installation procedure, both the login administrative user and the provided administrator account can have fewer privileges than domain admins and enterprise admins. However, at the end of the data collection stage, a warning appears listing the operations that failed during the creation of Active Directory objects, due to insufficient privileges. To restore the reduced functionality, perform the following steps, as described in the following sections: Add the CoSign computer to the domain as a preliminary action to be taken before installing with reduced privileges. Install CoSign in a reduced-privileges environment. Complement the CoSign installation with the CoSign capabilities that were described in Regular CoSign Installation.
191
Preliminary Action Adding the CoSign Computer to the Domain

Prior to running the CoSign installation, add the CoSign computer to the domain, as follows: Add a computer account to the Active Directory and set the name of the user who can join this computer to the domain. The computer name field should be set according to the CoSign serial number (refer to Displaying CoSign Status). For example, CSN00041. Set the user or group to a user or group that can join this computer to the domain. Note: The admin user provided during CoSign installation should be the above user or a user who is a member of the assigned group.
Figure 88 Adding the CoSign Computer to the Domain
Installing CoSign in a Reduced Privileges Environment

After adding the CoSign computer to the domain, activate the CoSign Appliance Management and install the CoSign Appliance according to the following guidelines: 1. In the User Setup window provide the username and password for an account with permission to join the CoSign machine to the domain. 2. In the Directory Setup window set the CoSign Container field with the full OU (or container) path of the CoSign computer account that was generated in the preliminary stage. 3. Click Finish. A message appears listing the operations that failed during the creation of Active Directory objects. Note: The list of failed operations depends on the extent of the users privileges.
192
Figure 89 Installation Failure Message
4. Click Yes to continue with the installation. The installation will try to create/update objects in the Active Directory. Any object listed in the above warning message will not be generated/updated.
Complementing the CoSign Installation with Missing Capabilities

Once installation with reduced privileges is complete, you can complement it with the missing capabilities. This section describes how to restore the CoSign capabilities after installing with reduced privileges. Note: After you update any of the objects in the Active Directory, restart the CoSign appliance.
Joining the CoSign Appliance to the MS Domain

For CoSign to work, it is mandatory that the user specified in the User Setup window has permission to join the CoSign appliance to the Domain.
Administrating CoSign after the installation

To administrate CoSign after the installation, use the CoSign Configuration Utility (described in Chapter 8: CoSign Configuration Utility) to set the value of Admin Administrators Group Name to the administrators groups of the division. For example, set the value to be Division Admin Users. Alternatively, you can administrate CoSign using the CoSign built-in administrator.
193
Figure 90 Setting the Administrators Group Name
Creating a Services Connection Point (SCP)

Failure to create an SCP prevents the CoSign appliance from publishing its binding information, thus preventing CoSign clients from locating the CoSign appliance. Once the CoSign computer is granted access rights to the SCP, this functionality is enabled. If it is a problem to enable such access, it is still possible to manually set this information through the CoSign Client Configuration utility (refer to Distributing CoSign Information Through the SCP). However, this option is limited for the following reasons: The client is never updated with the current status of the CoSign appliance activity. This causes long delays when attempting to connect to an inactive appliance. Any update of information, such as the CoSign appliances IP address, involves a manual update of all CoSign clients.
CoSign User Synchronization

Failure to set read access rights to the Deleted Objects container causes synchronization problems of deleted users from the Active Directory. Since deleted users are not recorded as deleted, you can reach the CoSign license limitation when the actual number of users is well under the limitation. You can take the following action: After any deletion of users from the Active Directory, perform a manual full synchronization of the CoSign appliance (refer to Synchronizing CoSign with the Directory Service).
194
Updating the userCertificate Attribute for Users

Failure to assign the CoSign computer as a member of the Cert Publishers group causes problems in setting the users certificate in the Active Directory. You can take any of the following actions: Manually assign the CoSign computer as a member of the Cert Publishers group. Grant the Cosign computer write access to the relevant users. Publish the user certificate manually, or refrain from publishing users certificates. Starting from CoSign version 5, CoSign does not update the certificate attribute of the user by default.
CoSign CA Root Certificate Information

Failure to create the AIA prevents the CoSign server from automatically publishing its ROOT certificate. Since the CoSign ROOT CA must be part of the trusted Certificate Authorities, you can take any of the following actions: Distribute the root certificate manually or automatically using administrator tools. Refer to Chapter 4: Deploying the CoSign Client for more information. During the installation of the CoSign appliance, you can define a different AIA location (such as an HTTP location), or not specify any AIA location. Create the AIA object in the Active Directory after the installation, and publish the root certificate manually.
CoSign CA CDP (Certificate Distribution Point)

Failure to create a CDP prevents the CoSign appliance from publishing its updated CRL. This may cause signature or verification problems or delays since the updated CRL is not located in its designated location. You can take any of the following actions: The CoSign CRL expiration time can be set to expire several years in the future. By setting the CRL once in the CDP, all applications that require CRLs will work properly. Distribute the CRL manually or automatically using administrator tools. During CoSign appliance installation, you can define a different CDP location (such as an HTTP based location), or specify that the CRL is not required. Create this object in the Active Directory after the installation, and then either publish the CRL manually, or grant the CoSign appliance the proper rights to update this object.
195
Appendix B: Centralized Installation from Active Directory

Microsoft Active Directory allows you to automatically perform remote software installations. Using this feature, you can install the CoSign client on all relevant workstations without user intervention, resulting in a smooth deployment of the CoSign system in a large-scale organization. For more information refer to Microsoft documentation at http://support.microsoft.com/kb/816102. You can use the Microsoft documentation also for instructions on how to uninstall the CoSign client and its component automatically. Note: You can deploy the CoSign client using Active Directory irrespective of the type of environment in which CoSign will work.
Installing the Client in an Active Directory Environment

Automatic deployment in a Microsoft Active Directory is performed as follows: 1. Place the contents of the CoSign CD in a specific location in the Domain, such as a shared disk drive of the domain server or any other Microsoft-based file server in the domain. 2. Establish a group policy in the domain. Assign the appropriate .msi files to the group policy (refer to Table 2). Make sure to assign the .msi files in the order in which they appear in the table. Note that the .msi files may differ, depending on the intended operating system (32bit or 64bit). Note: All client installations must include the AR CoSign Client.msi, AR Signature API.msi, and AR CryptoKit.msi, in this order. 3. Assign organizational units to the group policy. 4. Direct all the computers that belong to the organizational unit to install the software. The software is automatically installed after the next restart of each workstation.
CoSign MSI Files

The following table lists the.msi files that are part of the CoSign Client installation, and their location in the CoSign CD. These files should be associated with the relevant group policy to enable centralized installation. Some of the files differ depending on the intended operating system (32bit or 64bit). Caution: For 64bit operating systems, DO NOT use the ARX Office Signatures64.msi. Instead, use the ARX Office Signatures.msi.
196
Index
Table 2 CoSign Client MSI Files
Installation Files for 32bit Operating Systems ARX CoSign Client.msi ARX CryptoKit Basic.msi ARX Signature API.msi ARX OmniSign Printer.msi (Optional)
Installation Files for 64bit Operating Systems ARX CoSign Client64.msi ARX CryptoKit Basic64.msi ARX Signature API64.msi ARX OmniSign Printer64.msi (Optional) ARX Office Signatures.msi (Optional) ARX Signature Pad.msi (Optional)
Location CDRom\MSI CDRom\CryptoKit CDRom\MSI CDRom\MSI
ARX Office Signatures.msi (Optional) ARX Signature Pad.msi (Optional)
CDRom\MSI CDRom\MSI
197
Index
A
Accessing CoSign, troubleshooting, 187 Active Directory. See Microsoft Active Directory Add Digital Signature checkbox disabled, 185 Administrative problems, troubleshooting, 186 Administrator Group, 115 Adobe Acrobat changing default logo, 90 defining new Adobe appearance, 90 updating graphical signature, 90 Adobe Reader changing default logo, 90 defining new Adobe appearance, 90 AIA Location Settings, 119 AIA Publication Location, 118 Alternate CoSign appliance data replication management, 163 installing, 159 installing hardware, 159 installing software, 159 managing, 163 overview, 158 re-initializing, 164 resubscribing, 168 setting as primary appliance, 165 unsubscribing, 165 viewing replication status, 164 Alternate Extended Auth Mode, 125 Alternate Radius Server IP Address, 127 Alternate Radius Server port, 127 Appliance configuring installation parameters, 179 configuring the signing operation using the CoSign Configuration Utility, 179 connecting CoSign Central Enterprise, 19 connecting CoSign Central FIPS, 16 connecting CoSign central SSCD, 16 connecting CoSign Central Starter, 22 CoSign Central Enterprise back panel, 20 CoSign Central Enterprise front panel, 20 CoSign Central FIPS back panel, 17 CoSign Central FIPS front panel, 16 CoSign Central Starter back panel, 23 CoSign Central Starter front panel, 23 managing, 99 not in factory settings mode, error message, 182 restarting appliance, 108 restarting services, 107 restore operation fails, 188 restoring in Active Directory, 128 restoring in Directory Independent environment, 131 restoring in LDAP environment, 130 restoring in Novell NDS, 129 restoring, overview, 128 synchronizing with directory service, 104 viewing information in console, 148 Applications that work with CoSign, 2 Architecture, 7 Authenticating data, requirements, 1 users in CoSign, 8 Authentication key renewal, ChosenSecurity CA, 112 Authentication methods, 8 Authentication, extended authentication mechanisms, 9, 97 Automatic Deletion of Users, 115 Automatic User Logon, 121
B
Back panel CoSign Central Enterprise, 20 CoSign Central FIPS, 17 CoSign Central Starter, 23 Backing up the database, 101 Backup backup fails, troubleshooting, 188 command line utility, 140 operation, 101 restoring appliance from, 128 Batch scripts, 140 Biometric Authentication, 125 Biometric Authentication Window, 126 Biometric Shared Secret, 126 Built-in CoSign Admin, 116
C
CA Account Name, 119 CA Account Owner Email, 120 CA Service Connection Point, 119 CD installation files, 73 uninstalling CoSign software, 76 CDP location settings, 119 Central storage of keys, 8
199
Certificate Common Name, 119 Certificate Expiration Variance, 118 Certificate Issuer Name, 126 Certificate Refresh Timer, 117 Certificate Refresh Window, 117 Certificate Revocation List (CRL) CRL publishing frequency, 118 downloading to a file, 173 Certificates automatic external CA mode, 11 clearing CA files, 106 CoSign Central FIPS certificates compliance, 19 creating for each computer, 116 expiration variance, 118 groups, 116 internal CA, installing, 57 manual external CA mode, 10 none in store, 185 parameters, setting, 117 publishing, 116 refresh timer, 117 refresh window, 117 refreshing, 106 ROOT, adding to trusted CA list, 94 ROOT, direct installation, 93 ROOT, extracting to a file, 93 ROOT, for validating signatures without CoSign, 92 ROOT, installing, 93 setting common name, 119 troubleshooting, 187 ChosenSecurity external CA creating an organizational account, 64 enabling automatic communication, 65 renewing authentication key, 112 setting up, 63 uploading CA information, 66 Client client components installation screen, 74 deployment deployment options, 71 introduction, 71 on end-user machine, 72 on terminal server, 72 on Web server, 72 overview, 71 installing, 72, See Client installation setting security parameters, 120 software components, 73 supported operating systems, 71 troubleshooting, 185 uninstalling, 76 Client installation automatic deployment in Active Directory, 76
installing from CD, 74 overview, 72 prerequisites, 74 Clients Inactivity Timeout, 124 Command line utilities GetBackup, 140 GetEvt, 141 Groups, 142 installing, 140 overview, 140 SetSCP, 142 Comodo external CA, setting, 62 Configuring console terminal, 145 CoSign, using the Configuration Utility, 169 Console accessing, 145 configuring the terminal, 145 enabling DHCP, 150 error messages, 185 messages, 147 resetting tamper, 151 restoring factory settings, 152 setting CoSign time, 153 setting static IP address, 151 shutting down CoSign, 153 troubleshooting, 185 updating display, 147 USB to serial adaptor, 146 using, 145, 147 viewing CoSign information, 148 CoSign applications that work with CoSign, 2 architecture, 7 components, 3 data flow, 7 documentation, 4 does not respond, troubleshooting, 187 environments supported by CoSign, 2 information, viewing in console, 148 installation, 13 installing client directly from CD, 73 installing signature capture device, 87 installing with reduced privileges, 189 managing graphical signatures, 88 setting debug level, 124 shutting down, 153 solving PKI deployment problems, 3 time and date, setting, 153 turnkey solution, 9 uninstalling client, 76 using Graphical Signature Management application, 86 CoSign Administration MMC
200
Index
backing up database, 101 capabilities, 100 changing system parameters, 114 downloading log files, 107 high availability options, 108 managing data replication, 163 monitoring appliance performance, 113 operations fail, troubleshooting, 186 overview, 99 renewing ChosenSecurity authentication key file, 112 renewing subordinate CA certificate, 109 restarting CoSign, 108 restarting CoSign services, 107 restoring the appliance in a Directory Independent environment, 131 restoring the appliance in Active Directory, 128 restoring the appliance in LDAP environment, 130 restoring the appliance in Novell NDS, 129 restoring the appliance, overview, 128 starting, 99 synchronizing CoSign with the directory service, 104 system parameters, troubleshooting, 186 uploading software updates, 102 uploading SSL certificate, 111 usage prerequisites, 99 CoSign administrative client installation overview, 13 installation requirements, 14 installing, 14 uninstalling, 15 CoSign appliances CoSign Central Enterprise, 4 CoSign Central FIPS, 5 CoSign Central SSCD, 5 CoSign Central Starter, 5 installing, 16 monitoring performance, 113 overview, 4 software installation, 25 CoSign Central Enterprise back panel, 20 configuring console terminal, 145 description, 4 environmental conditions, 19, 22, 25 front panel, 20 hardware installation, 19 physical dimensions, 21 resetting tamper mechanism, 151 CoSign Central FIPS back panel, 17 certificates compliance, 19 description, 5
environmental conditions, 19 front panel, 16 hardware installation, 16 physical dimensions, 17 CoSign Central SSCD control panel, using, 82 deleting SSCD keys, 84 description, 5 enrolling for a key, 82 environmental conditions, 19 generating a key, 82 generating automatic key, 117 hardware installation, 16 keys location, 8 physical dimensions, 17 signing documents, 82 SSCD max failed attempts, 117 SSCD minimal password length, 117 updating SSCD keys, 84 CoSign Central Starter back panel, 23 configuring console terminal, 145 description, 5 front panel, 23 hardware installation, 22 physical dimensions, 24 CoSign Certificate SN, 120 CoSign Configuration Utility Admin mode configuration file operations, 175 creating a configuration file, 175 exporting to a configuration file, 175 exporting to a group policy, 176 group policies operations, 176 opening a configuration file, 175 opening a group policy, 176 usage, 174 CA menu, 172 distributing a client configuration manual distribution, 178 overview, 177 via configuration files, 177 via distributing software, 178 via group policy, 178 via login scripts, 178 downloading the ROOT certificate, 172 editing parameters, 171 End User mode, 176 File menu, Admin mode, 172 generating an installation report, 173 Help menu, 173 installing the ROOT certificate, 172 introduction, 169 menus, 171
201
modes of operation, 169 overview, 169 running, 170 setting appliance configuration appliance installation parameters, 179 overview, 179 using, 170 CoSign Control Panel Administrator actions, 80 Design actions, 80 for an SSCD appliance, 82 in a Directory Independent environment, 85 menu bar options, 81 overview, 79 User actions, 79 CoSign Debug Level, 124 CoSign license Minikey token, 17 CoSign verifier deploying, 96 installing, 97 CPS Object ID, 119 CPS URI, 119 Create Computer Keys, 116 Create Group Keys, 116 Creating graphical signature, 90 CRL Publication Location, 118 CRL Publishing Frequency, 118 CRL Validity Period, 118
overview, 10 password policy, 122 restoring appliance, 131 using the Control Panel, 85 Directory Server Search Base, 116 Directory Synchronization Timer, 115 Disabled checkbox, troubleshooting, 185 Disabling digital signatures, 185 Downloading log files, 107
E
Email From Address, 122 Email notifications configuring, 60 mail server name parameter, 121 Enable the Radius AD Attribute, 127 Enable User Counters, 121 End-user machine, deploying client on, 72 Enforce CRL Validation, 126 Enrolling users in CoSign, 8 Environmental conditions CoSign Central Central Enterprise, 19, 22, 25 CoSign Central FIPS, 19 CoSign Central SSCD, 19 Environments supported by CoSign, 2 Error messages appliance not in factory settings mode, 182 CoSign IP address is invalid, 181 failed error 51, 182 failed error 52, 182 failed error 54, 182 licensing issues, 185 the snapshot for this publication has become obsolete, 184 Event log command line utility, 141 downloading, 107 enabling user counters, 121 reporting signature events, 121 Expiration variance, certificates, 118 Extended Authentication devices, 97 parameters, setting, 125 supported modes, 97 Extended Authentication Method, 125 External CA Password, 120 External CA User Name, 120 External CA, automated mode available WWV CAs, 61 ChosenSecurity, 63 Comodo, 62 overview, 11 SSL proxy settings, 60 synchronizing with CoSign, 105
D
Data authentication systems, 1 Data flow in CoSign, 7 Data replication management accessing, 163 re-initializing an alternate appliance, 164 unsubscribing an alternate appliance, 165 viewing replication status, 164 Database, backing up, 101 Date, setting, 153 Debug level, 124 log, downloading, 107 Default Radius password length, 127 Deleting graphical signature, 89 Deployment problems, solving, 3 DHCP enabling, 150 server, using, 150 Digital signatures, prompting for signature, 121 Directory Independent environment changing the password, 85 Directory Independent Users Management utility, 131 installing CoSign software, 52
202
Index
External CA, manual mode, 61 Extractable Keys, 117 Extracting ROOT certificate to a file, 93
F
Factory settings mode error message, 182 Factory settings, restoring, 152 Failed installation, 183 operations in CoSign Administration MMC, 186 FIPS box, certificates' compliance, 19 Firmware updates, uploading, 102 Front panel CoSign Central Enterprise, 20 CoSign Central FIPS, 16 CoSign Central Starter, 23
installing alternate appliance hardware, 159 installing alternate appliance software, 159 installing an alternate appliance, 159 installing the primary appliance, 159 introduction, 157 managing data replication, 163 managing primary appliance failure, 165 overview, 157 resubscribing an alternate appliance, 168 setting alternate appliance as primary appliance, 165 setting primary appliance as alternate appliance, 167 Subscribed Alternates window, 163
I
Inactivity timeout, clients, 124 Install log, downloading, 107 Installation report, generating, 173 Installing alternate CoSign appliance, 159 alternate CoSign appliance hardware, 159 alternate CoSign appliance software, 159 ChosenSecurity External CA, 63 command line utilities, 140 Comodo External CA, 62 CoSign administrative client, 13, 14 CoSign appliances, 16 CoSign appliances in a high availability configuration, 158 CoSign as a subordinate CA, 67 CoSign Central Enterprise hardware, 19 CoSign Central FIPS hardware, 16 CoSign Central SSCD hardware, 16 CoSign Central Starter hardware, 22 CoSign client, 72 CoSign in Active Directory, 25 CoSign in Directory Independent environment, 52 CoSign in LDAP environment, 44 CoSign in Novell NDS, 37 CoSign with reduced privileges, 189 failed, troubleshooting, 183 internal CA, 57 overview, 13 primary CoSign appliance, 159 progress bar, troubleshooting, 183, 184 ROOT certificate, 93 ROOT certificate, direct installation, 93 signature capture device, 87 troubleshooting, 181 uninstalling the client, 76 uninstalling the CoSign administrative client, 15 Installing CoSign administrative client installation procedure, 14
G
Generate Automatic Keys in SSCD, 117 GetBackup, 140 GetEvt, 141 Graphic file types, 90 Graphical signature capture device installing, 88 model types, 87 Graphical Signature Management accessing, 88 creating graphical signature, 90 default signature, 92 defining new Adobe appearance, 90 defining one-time signature, 90 deleting graphical signature, 89 graphic file types, 90 installing signature capture device, 87 overview, 86 replacing graphical signature, 90 signature capture mechanisms, 86 signature capture options, 90 using application, 88 viewing graphical signatures, 89 Group of CoSign Users (AD), 115 Groups command line utility, 142
H
Hardware installing CoSign Central Enterprise, 19 installing CoSign Central FIPS, 16 installing CoSign central SSCD, 16 installing CoSign Central Starter, 22 restarting, 108 High availability client behavior, 158 data replication, 158 installation overview, 158
203
requirements, 14 Installing CoSign in Active Directory installation procedure, 27 overview, 25 permissions, 26 user types, 36, 197 Installing CoSign in Directory Independent environment installation procedure, 52 overview, 52 Installing CoSign in LDAP environment installation procedure, 45 overview, 44 supported directories, 44 Installing CoSign in Novell NDS installation procedure, 37 overview, 37 Installing CoSign with reduced privileges administrating CoSign after the installation, 193 creating a CDP, 195 creating an SCP, 194 installation instructions, 192 introduction, 189 joining CoSign to MS domain, 193 order of operations, 191 overview of regular installation, 190 performing user synchronization, 194 pre-installation action, 192 publishing the ROOT certificate, 195 restoring capabilities, 193 updating userCertificate, 195 Internal CA installing, 57 installing CoSign as subordinate CA, 67 overview, 10 Introduction to CoSign, 2 to CoSign architecture, 7 to digital signatures, 1 Invalid IP address, 181 IP address failure when setting via the console interface, 182 invalid, 181 setting, 151
LDAP Built-in CoSign Admin, 116 Directory Server Search Base, 116 parameters, setting, 123 LDAP Authentication Method, 123 LDAP CoSign user name, 123 LDAP CoSign user password, 123 LDAP environment installing CoSign software, 44 restoring appliance, 130 supported directories, 44 LDAP Secure mode, 123 LDAP Server Realm name, 123 Log files, downloading, 107 Logon prompt setting, 120 specifying when it appears, 121 viewing in SCP, 77
M
Mail Server Name, 121 Mail Server Port, 122 Managing appliance, 99 CoSign using the console, 145 signatures, 88 Max Password Failed Attempts, 122 Maximum Password Validity, 122 Maximum Repeats in password, 122 Maximum Sequence in password, 122 Microsoft Active Directory adding ROOT certificates to trusted CA list, 94 installing CoSign software, 25 installing CoSign with reduced privileges, 189 multiple trusted Active Directory, 26 parameters, setting, 115 permission considerations, 26 restoring appliance, 128 SCP, 77 synchronizing CoSign with, 154 Minimum Password Length, 122 Minimum Password Validity, 122 Modifying system parameters, 114 Monitoring appliance performance, 113 activating monitoring, 113 stopping monitoring, 113 viewing monitoring results, 114 Multi-language support, 70 Multiple trusted Active Directory support, 26
K
Key Location (Non Automatic), 117 Keys central storage of, 8 parameters, setting, 117 storage in CoSign SSCD, 8
N
Novell NDS installing CoSign software, 37 Periodic Directory Sync Timer, 116
L
Language support, 70
204
Index
restoring appliance, 129 SCP, 78 specifying server, 154
O
One Time Password Radius server settings, 126 using a Radius Server, 125 One time signature, 90 Operating systems supported for client, 71 Outlook, disabling digital signatures, 185 Overview of CoSign, 1
P
Password in Directory Independent environment changing, 85 setting policy, 122 Performance monitoring, 113 Periodic Directory Sync Timer, 116 Permissions in Microsoft Active Directory, 26 PKI CoSigns integrated solution, 9 solving deployment problems, 3 Primary CoSign appliance installing, 159 overview, 157 setting as alternate appliance, 167 Primary LDAP server address, 123 Primary LDAP server port, 123 Prompt for Logon, 120 Prompt for Signature, 121
in LDAP environment, 130 in Novell NDS, 129 overview, 128 Restoring factory settings in case of hard disk failure, 155 via the console, 152 ROOT certificate adding to trusted CA list, 94 direct installation, 93 downloading, using the CoSign Configuration utility, 172 extracting to a file, 93 for validating signatures without CoSign, 92 installing, 93 installing using the CoSign Configuration utility, 172
S
SCP in a Microsoft Active Directory, 77 in Novell NDS, 78 overview, 76 Search Base in LDAP Server, 123 Secondary LDAP server address, 123 Secondary LDAP server port, 123 Service Restart operation, 107 SetSCP, 142 Setting IP address, 151 Shutting down CoSign appliance, 108 CoSign services, 107 CoSign, via the console, 153 Smart Card Authentication, 125 SmartCard Authentication Window, 126 Software installation failed, 183 installing, 25 installing in a Directory Independent environment, 52 installing in Active Directory, 25 installing in LDAP environment, 44 installing in Novell NDS, 37 updates, uploading, 102 SSCD key deleting, 84 enrolling for a key, 82 generating, 82 updating, 84 SSCD Max Failed Attempts, 117 SSCD Minimal Password Length, 117 SSL certificate, uploading, 111 SSL proxy specifying IP address, 124 specifying password, 124
R
Radius customer AD attribute, 127 Radius Server IP Address, 127 Radius server parameters, setting, 126 Radius Server port, 127 Radius Server Retries, 127 Radius Server Secret, 127 Radius Server Timeout, 127 Refresh timer, certificates, 117 Refresh window, certificates, 117 Refreshing certificates, 106 Report Signatures to Event Log, 121 Require Static Password Logon, 126 Resetting tamper mechanism, 151 Restarting CoSign appliance, 108 CoSign services, 107 Restoring appliance after hard disk failure, 155 failed appliance restore, troubleshooting, 188 in a Directory Independent environment, 131 in Active Directory, 128
205
specifying port number, 124 specifying usage, 124 specifying user name, 124 SSL Proxy IP, 124 SSL Proxy Password, 124 SSL Proxy Port, 124 SSL proxy settings, 60 SSL Proxy User Name, 124 Starting the CoSign Administration MMC, 99 Static IP address, using, 151 Storage of keys in CoSign, 8 Subordinate CA installation, 67 introduction, 59 renewing certificate, 109 Support ARX contact information, 181 ARX support contact information, 181 Synchronization timer, directory, 115 Synchronizing CoSign with external CA in automated mode, 105 Synchronizing CoSign with the directory service, 104 Syslog Server IP Address, 122 System parameters Administrator Group, 115 AIA Publication Location, 118 Alternate Extended Auth Mode, 125 Alternate Radius Server IP Address, 127 Alternate Radius Server Port, 127 Automatic Deletion of Users, 115 Automatic User Logon, 121 Biometric Authentication, 125 Biometric Authentication Window, 126 Biometric Shared Secret, 126 Built-in CoSign Admin, 116 CA Account Name, 119 CA Account Owner Email, 120 CA Service Connection Point, 119 Certificate Common Name, 119 Certificate Expiration Variance, 118 Certificate Issuer Name, 126 Certificate Refresh Timer, 117 Certificate Refresh Window, 117 Clients Inactivity Timeout, 124 CoSign Certificate SN, 120 CoSign Debug Level, 124 CPS Object ID, 119 CPS URI, 119 Create Computer Keys, 116 Create Group Keys, 116 CRL Publication Location, 118 CRL Publishing Frequency, 118 CRL Validity Period, 118 Default Radius password length, 127
Directory Server Search Base, 116 Directory Synchronization Timer, 115 Email From Address, 122 Enable the Radius AD attribute, 127 Enable User Counters, 121 Enforce CRL Validation, 126 Extended Authentication Method, 125 External CA Password, 120 External CA User Name, 120 Extractable Keys, 117 Generate Automatic keys in SSCD, 117 Group of CoSign Users (AD), 115 Key Location (Non Automatic), 117 LDAP Authentication Method, 123 LDAP CoSign user name, 123 LDAP CoSign user password, 123 LDAP Secure mode, 123 LDAP Server Realm name, 123 Mail Server Name, 121 Mail Server Port, 122 Max password failed attempts, 122 Maximum Password Validity, 122 Maximum Repeats in password, 122 Maximum Sequence in password, 122 Minimum Password Length, 122 Minimum Password Validity, 122 missing from CoSign Administration MMC, 186 modifying, 114 One Time Password using a Radius Server, 125 Periodic Directory Sync Timer, 116 Primary LDAP server address, 123 Primary LDAP server port, 123 Prompt for Logon, 120 Prompt for Signature, 121 Radius customer AD attribute, 127 Radius Server IP Address, 127 Radius Server Port, 127 Radius Server Retries, 127 Radius Server Secret, 127 Radius Server Timeout, 127 Report Signatures to Event Log, 121 Require Static Password, 126 Search Base in LDAP Server, 123 Secondary LDAP server address, 123 Secondary LDAP server port, 123 Smart Card Authentication, 125 SmartCard Authentication Window, 126 SSCD Max Failed Attempts, 117 SSCD Minimal Password Length, 117 SSL Proxy IP, 124 SSL Proxy Password, 124 SSL Proxy Port, 124 SSL Proxy User Name, 124 Syslog Server IP Address, 122
206
Index
URL Retrieval, 126 Use AIA Location Settings, 119 Use CDP Location Settings, 119 Use SmartCard Auth for Logon, 126 Use SSL Proxy, 124 User Administrator Group, 115 User Certificate Publishing, 116 User Certificate Type, 120 User Must Change Password, 122 Web Services Support, 124
T
Tamper mechanism, resetting, 151 Terminal server, deploying client on, 72 Terminal, configuring for console, 145 Time, setting, 153 Total cost of Ownership (TCO), using CoSign, 3 Troubleshooting administrative problems, 186 alternate CoSign installation, 184 appliance does not start, 184 appliance not in factory settings mode, 182 backup fails, 188 cannot see personal certificates, 185 client-related problems, 185 console-related problems, 185 CoSign Administration MMC operation fails, 186 CoSign does not respond, 187 CoSign parameters missing from CoSign Administration MMC, 186 default values do not appear in the directory setup dialog box, 182 installation, 181 installation fails, 183 installation issues, 184 IP address invalid, 181 overview, 181 prograss bar during installation, 183 restore operation fails, 188 setting IP address via the console, 182 signatures in Outlook, 185 users do not receive certificates, 187 Trusted CA list, adding ROOT certificates to, 94 Turnkey solution, 9
overview, 102 to version 4.1, 103 to version 4.5, 103 to version 5, 102 Uploading updates, 102 URL Retrieval, 126 USB to serial adaptor, 146 Use AIA Location Settings, 119 Use CDP Location Settings, 119 Use SmartCard Auth for Logon, 126 Use SSL Proxy, 124 User authentication, 8 enrollment, 8 User Administrator Group, 115 User Certificate Publishing, 116 User Certificate Type, 120 User groups, 115 User Must Change Password, 122 Users do not receive certificates, troubleshooting, 187 Users Management utility activating, 132 adding a user, 135 deleting a user, 136 displaying user information, 137 generating a Users report, 135 login, 135 login using built-in administrator, 135 logout, 135 main window, 132 menus, 134 overview, 131 resetting a users signature counters, 135 resetting signature counters, 134 right-click menu, 139 setting user password, 136 status bar, 134 toolbar, 139 user fields, 133
V
Validating signatures installing CoSign verifier, 95 installing ROOT certificate, 93 Viewing certificates in store, troubleshooting, 185 CoSign information in console, 148 graphical signatures, 89
U
Uninstalling CoSign administrative client, 15 CoSign client, 76 CoSign client using CoSign CD, 76 Updates, uploading, 102 Upgrading
W
Web server, deploying client on, 72 Web Services Support, 124
207

CoSign 5 Administrator's Guide

Uploaded by

Copyright:

Available Formats

CoSign 5 Administrator's Guide

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CoSign 5 Administrator's Guide

Uploaded by

Copyright:

Available Formats

CoSign

ARX (Algorithmic Research) Ltd, Tel. 1-866-EASY-PKI (327-9754) Site: www.arx.com

Copyright 2010 ARX (Algorithmic Research), Ltd. All rights reserved.

CoSign Administrator Guide

CoSign Administrator Guide

Requirements for Data Authentication Systems

CoSign Administrator Guide

Solving PKI Deployment Problems Using CoSign

CoSign Administrator Guide

PKI in a nutshell CoSign provides a complete, ready-to-use PKI system in a single

Central storage of signature credentials CoSigns innovative patent-pending technology

CoSign Appliance Hardware Models

Chapter 2: CoSign Architecture and Data Flow

Figure 1 CoSign Architecture

CoSign Administrator Guide

Enrollment Using a Standard User Management Application

Central Storage of Signing Keys

CoSign Architecture and Data Flow

Extending User Authentication

CoSign Administrator Guide

Using CoSigns Internal CA

Using CoSign in Manual External CA Mode

CoSign Architecture and Data Flow

Using CoSign in Automatic External CA Mode

CoSign Administrator Guide

Chapter 3: Installing CoSign

Installing the CoSign Administrative Client

CoSign Administrator Guide

Installing the CoSign Administrative Client

Figure 2 ARX CoSign Client Installation screen

Uninstalling the CoSign Administrative Client

CoSign Administrator Guide

Figure 3 CoSign Central FIPS Front Panel

Figure 4 CoSign Central FIPS Back Panel

Figure 5 CoSign License MiniKey Token

CoSign Administrator Guide

CoSign Central FIPS Certificates

Installing the CoSign Central Enterprise Appliance Hardware

CoSign Administrator Guide

Figure 6 CoSign Central Enterprise Front Panel

Figure 7 CoSign Central Enterprise Back Panel

Figure 8 CoSign License MiniKey Token

CoSign Administrator Guide

Non-operating -40 to 140F -40 to 60C 8 to 80 % (non-condensing)

Installing the CoSign Central Starter Appliance Hardware

Figure 9 CoSign Central Starter Front Panel

Figure 10 CoSign Central Starter Back Panel

Figure 11 CoSign License MiniKey Token

CoSign Administrator Guide

Installing the CoSign Appliance Software

Figure 12 CoSign Installation Options

Installing CoSign in a Microsoft Active Directory Environment

CoSign Administrator Guide

Figure 13 Switching to a Different Administrator

CoSign Administrator Guide

Figure 14 Network Setup Dialog Box

Figure 15 CoSign Administrator User Dialog Box

CoSign Administrator Guide

Figure 16 Active Directory Admin Account Dialog Box

10. Click Next. The Directory Setup dialog box appears.