The iKeyman (Certificate Management) utility is a tool that you can use to manage your digital certificates and configuration tasks related to public-private key creation and management. With iKeyman, you can create a new key database or test a digital certificate, add certificate authority (CA) roots to your database, copy certificates from one database to another, request and receive a digital certificate from a CA, set default keys, and change passwords.

During product installation, Personal Communications creates a key database in the user application data folder (as selected during installation) with the name PCommClientKeyDb.kdb. By default, the following CA certificates are stored in the key database and marked as trusted CA certificates.

Certificate authorities

• RSA Secure Server Certification Authority (from VeriSign)
• Thawte Personal Basic CA
• Thawte Personal Freemail CA
• Thawte Personal Premium CA
• Thawte Premium Server CA
• Thawte Server CA
• Verisign Class 1 CA Individual-Persona Not Validated
• Verisign Class 2 CA Individual-Persona Not Validated
• Verisign Class 3 CA Individual-Persona Not Validated
• VeriSign Class 1 Public Primary Certification Authority
• VeriSign Class 2 Public Primary Certification Authority
• VeriSign Class 3 Public Primary Certification Authority
• VeriSign Test CA Root Certificate

Note: For Personal Communications to function, the certificate database must be present in the user application data folder and its name should be PCommClientKeyDb.kdb.

To open the key database file, do the following:

1. From the menu bar, click Key Database File > Open.
2. Select PCommClientKeyDb.kdb from the Personal Communications user application data folder.
3. At the Password prompt, type your password and click OK.
   
   Note: The password is initially set to the value pcomm. This password protects the private key. The private key is the only key that can sign documents or decrypt messages encrypted with the public key. For security reasons, you must change the password from the default before performing any operations on the database. Changing the key database password frequently is a good practice.

If the database is corrupted, you can recreate the database. Click Key Database File > New to create a new database. The database must be created in the user application data folder with the name PCommClientKeyDb.kdb.

When the key database is open, do one of the following options:

• If the server with which you are communicating has a certificate issued by a well-known Certificate Authority (previously listed), there is nothing more to be done. The required root certificate is already in the key database.
• If the server with which you are communicating has a certificate issued by a unknown Certificate Authority (that is, one not in the list), add a root certificate issued by an unknown Certificate Authority.
• If the server with which you are communicating has a self-signed certificate, add a self-signed certificate that was created by and for that server.

Creating a new key pair and certificate request

Key pairs and certificate requests are stored in a key database. To create a public-private key pair and certificate request, do the following:

1. If the key database is not open, click Key Database File > Open from the iKeyman menu bar and select the PCommClientKeyDb.kdb database.
2. From the main menu, click Create > New Certificate Request.
   
   In the New Key and Certificate Request dialog box, enter the following information:
   • Key Label
     Enter a descriptive comment to identify the key and certificate in the database.
   • Key Size
   • Organization Name
   • Organization Unit (optional)
   • Locality (optional)
   • State/Province (optional)
   • Zip code (optional)
   • Country
     Enter a country code (for example, US). Specify at least two characters.
   • Certificate request file name, or use the default name
3. Click OK.
4. After the certificate request has been created, an Information dialog box appears, reminding you to send the file to a certificate authority. Click OK to close the box.

Changing the key database password

To change the password of the current database, do the following:

1. From the iKeyman menu bar, click Key Database File > Change Password to change the current password. The Change Password dialog appears.
2. Type the new password. Follow the guidelines issued by your Network Manager for selecting a strong password or passphrase.
3. Type the same password again for verification. The password should have an expiration date.
4. Select the Set expiration time check box. Specify a suitable number of days or accept the default value.
5. Click Stash the password to a file to save the password of the current database in encrypted format in the PCommClientKeyDb.sth file. If you use the password stash file, you must stash the password each time it is changed. By default, Personal Communications uses the stash file.
6. Click OK.

Adding a root certificate issued by an unknown Certificate Authority (CA)

When you receive the certificate from the network or server administrator, you must store it in the key database. Use the following procedure.

1. In the iKeyman utility window, click Signer Certificates from the drop-down list below Key Database Content.
2. Click Add to receive the certificate.
3. The Add CA's Certificate from a File dialog opens. The data type must be Base64-encoded ASCII data (armored 64 format).
4. Click Browse to locate the certificate file or enter a directory path in the Location box. Select the file and click Open.
5. Enter a label for the certificate and click OK.
6. Click View/Edit.
7. Select the Set the certificate as a trusted root check box and click OK.

Adding a self-signed certificate that was created by and for a specific server

When you receive the certificate from the network or server administrator, you must store it in the key database. It will act as a root certificate to authenticate itself: itself being the server that issued a certificate on behalf of itself (hence, self-signed). Use the following procedure.

1. In the iKeyman utility window, click Signer Certificates from the drop-down list below Key Database Content.
2. Click Add to receive the certificate.
3. The Add CA's Certificate from a File dialog opens. The data type must be Base64-encoded ASCII data (armored 64 format).
4. Click Browse to locate the certificate file or enter a directory path in the Location box. Select the file and click Open.
5. Enter a label for the certificate and click OK.
6. Click View/Edit.
7. Select the Set the certificate as a trusted root check box and click OK.

Cryptographic modules

When iKeyman is started, Personal Communications searches for the following cryptographic modules:

• IBM Secureway Smartcard: w32pk2ig.dll
• GemPlus/GemSoft Smartcard: w32pk2ig.dll
• IBM Netfinity PSG Chip: ibmpkcss.dll
• Rainbow Ikey 1000: Cryptoki22.dll
• Schlumberger Cryptoflex: acpkcs.dll or slbck.dll
• SCW PKCS 3GI 3-G International: 3gp11csp.dll
• Data Key: Dkck232.dll
• Fortezza Module: fort32.dll

If Personal Communications finds a module, the ikmuser.properties file is created in the user's application data directory. This file contains the following two parameters:

• DEFAULT_CRYPTOGRAPHIC_MODULE=
• DEFAULT_CRYPTOGRAPHIC_TOKEN_OPEN_EXISTING_SECONDARY_KEYDB=

Personal Communications sets the name of module as the value for the DEFAULT_CRYPTOGRAPHIC_MODULE parameter. If none of the above modules are found, the system administrator needs to manually create the ikmuser.properties file and provide the DEFAULT_CRYPTOGRAPHIC_MODULE value.