DokuWiki

With the implementation of the CeRTNA Documentation Wiki, this version of the Workstation Installation Guide serves as consolidation of multiple user guides. This document covers the installation and configuration requirements for the following platforms:

• APEX Transport Client
• ERDS Web Client
• G2G Web Client
• Entrust PKI Certificates

You can quickly move to any section by clicking the table of contents shown above

The CeRTNA ERDS workstation configuration requirements are driven by several factors as shown below:

• Workstation Security As Outlined By The California DOJ
• Encryption & Authentication Technologies Used By Entrust
• Two-Factor Authentication Via SafeNet USB Tokens
• Support Of The ERDS Web Based Application

In order to access the CeRTNA application, an ERDS application must meet the security requirements as outlined by the California DOJ. The California DOJ Baseline Security Requirements can be viewed at the following URL:

https://oag.ca.gov/sites/all/files/agweb/pdfs/erds1/Baseline_9_2014.pdf

Section 4.2.7 of the referenced DOJ document outlines the security requirements for a workstation.

To ensure compliance with the DOJ regulations, a CeRTNA ERDS workstation must pass a security audit before it can be used to process production level electronic recording. A new section has been added to this document that outlines the steps to be taken to prepare for the initial workstation security audit.

The CeRTNA application currently uses a toolkit provided by Entrust to perform authentication and encryption services. The Entrust services make use of Public Key Infrastructure (PKI) and Microsoft Cryptography API (CAPI) technologies. The Entrust toolkit uses Java to deliver its functionality and therefore a CeRTNA ERDS workstation must have a version of Java that is compatible with the version of Entrust tools that are in used by CeRTNA.

To support Two-Factor Authentication the CeRTNA application uses USB token technology provided by SafeNet. Drivers are required to communicate with the token and CeRTNA receives SafeNet drivers from Entrusthat that are compatible with the Entrust toolkit. Information about where to obtain the latest drivers and how to install them is provided later in this document.

Finally, the CeRTNA ERDS application is a web-based .NET application that is served up from a Microsoft Internet Information Services (IIS) web server platform. This means a web browser is required to access the CeRTNA ERDS application functionality. Currently the ERDS application will only work with the Microsoft’s Internet Explorer web browser.

CeRTNA is actively transitioning customers to its APEX software. Although APEX does not require Java, CeRTNA still supports customers using the ERDS or G2G web client to send and retrieve XML transactions. In order to use the CeRTNA ERDS or G2G web client, customers must have a Java Runtime Environment (JRE) installed.

As mentioned in the overview section there are a variety of tools required to deliver the CeRTNA application functionality. An extensive number of hours have been invested by CeRTNA to validate the proper application functionality across operating systems, encryption decryption tools, browsers, platforms (ERDS & G2G), certificate renewals/downloads, application roles (submitters, counties, administrators) etc.

In order for everything to work properly together the most important item becomes the Java Runtime Environment (JRE). Comprehensive functionality will only be supported if you are using one of the following JRE versions:

Due to requirements for installing and/or updating Entrust PKI certificates, CeRTNA cannot support JRE 6 Update 45. If you are still running JRE 6 Update 45, please update your workstation to use one of the supported versions shown in the preceding table. CeRTNA recommends using JRE 8.121, if possible.

Once you have downloaded one of the JRE installation files shown above, unzip the file to a working folder such as C:\JRE_Setup or a folder name of your choosing. Once the zip file has been extracted open the following subfolder: C:\{your workfolder}\ and double-click the JRE setup program to start the setup process. If you are prompted by User Access Control (UAC) to allow the installation, click the Yes button.

The following window is displayed:

Click the Install button and the installation process will start. As the installation progresses, the following panel will be displayed:

When the installation completes, the following panel will be displayed:

Click the Next button. The following screen will be displayed:

After the installation is complete, some of the settings in the Java Control Panel need to be adjusted. To adjust these settings follow the instructions on the next page.

Open the following folder:

Windows 64-bit systems:

C:\Program Files (x86)\Java\jre1.8.0_121\bin

Windows 32-bit systems:

C:\Program Files\Java\jre1.8.0_121\bin

The following window should be displayed:

Right-click the javacpl.exe program item and select Run As Administrator from the pop-up menu.

If the User Access Control (UAC) prompts for authorization to run the program, select Yes.

The following window will be displayed:

Click the Update tab and the following will be displayed:

Un-check the box labeled ‘Check for Updates Automatically’. This will disable the automatic updating of the JRE.

The JRE needs to remain at JRE 7 Update 51 or JRE 8 Update 121 for all aspects of the CeRTNA application to function properly. (Note: You should only have one version of the JRE installed. Running multiple versions of the JRE can cause unpredictable behavior in the CeRTNA applications.)

You will be presented with the following window:

Click the Do Not Check button.

You will be returned to the Update Panel below:

Click the Apply button.

Next Click the Advanced tab and the following panel will be displayed:

Set the items that are highlighted below as shown.

Click the Ok button to close the window.

Starting with Windows 7, support for Microsoft’s Core XML Parser is delivered with the operating system. It does not need to be downloaded and installed separately.

CeRTNA ERDS & G2G web applications require that you set your Internet Explorer browser into Compatibility Mode. If you do not configure your Internet Explorer browser for compatibility mode, you see the message ‘XML Parser Not Found’ if you attempt to complete a process that requires the application to parse an XML file, such as submitting a transaction or viewing a transaction.

The following items should be taken into consideration before installing the SafeNet Token Utilities:

• If you are using APEX and do not plan to send or retrieve transactions using the CeRTNA ERDS web client you do not need to install the SafeNet Token Utilities.
• If you are using a CeRTNA G2G workstation you do not need to install the SafeNet Token Utilities.
• Important: If you plan to use your APEX or CeRTNA G2G workstation as a backup to the CeRTNA ERDS workstation, you should install the SafeNet Token Utilities on your workstation.

CeRTNA uses SafeNet USB tokens for ‘two-factor authentication’. These tokens require drivers to be installed in order to recognize the token. Currently CeRTNA is supporting two different types of tokens, the SafeNet iKey 4000 token and the SafeNet 5100 eToken.

The current version of the Entrust SafeNet Authentication Client software can be downloaded from the following URL:

https://www.certna.org/ErdsUI/Downloads/SAC83.zip

This zip file is approximately 311 MB in size.

Important Note: If you currently have the SafeNet 7.x software installed you will need to uninstall the SafeNet 7.x Client Tools and the SafeNet iKey Drivers before you can install the SafeNet 8.3 Client software. The SafeNet 7.x software can be uninstalled via the Windows Control Panel and you will have to restart your computer when the software is being uninstalled.

To install the SafeNet 8.3 Client software make sure your token is NOT plugged in.

Unzip the SAC83.zip file to a working directory, for example C:\SAC83_Setup or a name of your choosing.

Once the zip file has been extracted open the following subfolder:

C:\{your workfolder}\SafeNetAuthenticationClient-8.3\32×64 Installer

Double-click the SafeNetAuthenticationClient-x32-x64-8.3.exe program to start the setup process.

The following window is displayed:

Click the Next button to continue.

The following window is displayed:

Click the Next button to continue.

The following window is displayed:

Click on the I accept the license agreement radio button.

Click on the Next button to continue.

The following IMPORTANT window is displayed:

IMPORTANT: By default the Standard radio button is selected. (You must change this.)

Click the BSec-compatible radio button.

Note: SafeNet iKey4000 tokens require BSec compatibility and the SafeNet 5100 tokens function with this setting as well.

Click the Next button.

The following confirmation window will be displayed:

Click the Next button to start the installation.

You will see a User Access Control (UAC) prompt requesting permission to install the software. Select Yes to allow the software to be installed.

The following window is displayed while the installation progresses:

When the installation completes, the following window is displayed:

Click the Finish button.

To use the CeRTNA ERDS application for submitting or retrieving transactions customers must complete a fingerprint/background check. Once this process is complete and the approval paperwork has been provided to CeRTNA staff a SafeNet token will be mailed to you. The token will contain your Entrust Authentication certificate and your Entrust Encryption certificate.

After you receive your token, insert your Token Key into an available USB port on your system. The Token will be automatically recognized and installed as shown in the figure below. This occurs because of the SafeNet Authentication Client software/driver installation completed in an earlier step.

Once the device driver software is successfully installed you will see another popup as shown in figure below.

Now you should see a confirmation that your Token has been inserted as shown in the figure below.

This completes the Token Installation.

The certificates that are installed on your token, depend on a ‘certificate chain’ in order to function properly. You can verify that the certificate chain is valid by completing the following steps with your token inserted in the USB port.

Note: Depending on your local IT security policy, you may need to contact your local IT staff to perform the following steps:

Click the Windows Start button and enter mmc.exe in the Search field.

You should see mmc.exe listed at the top of the results list.

Click mmc.exe and the following window will be displayed:

Select the File / Add-Remove snap in… menu option.

The following window is displayed:

Select Certificates in the left panel and click the Add button.

The following window is displayed:

My user account should be already selected. (If not select it.)

Click the finish button. You will be returned to the following updated window:

The certificate snap-in should be shown in the right pane.

Click the Ok button and the following window will be displayed:

In the left pane, click the carat that appears next to Certificates – Current User

In the left pane, click the carat that appears next to the Personal folder.

Click the Certificates folder.

Your window should look similar to the following:

The certificates in the middle pane should reflect your identity.

Double-click either certificate and the following window is displayed:

Click the Certification Path tab and the following window is displayed:

If you do not see a 3-tier certification path, your certificate installation is not complete. The most likely reason is that the Entrust Intermediate and Root certificates were not installed when you inserted the token. To resolve this issue, continue with the next section

If your window shows the proper 3-tier certification path, you are finished with the certificate verification process and you can skip the next section entitled Entrust Intermediate & Root Certificate Installation.

Windows supports user-level certificate stores and computer-level certificate stores. If you need to manually install the Entrust Intermediate or Entrust Root certificates on your computer, CeRTNA recommends installing these certificates in the computer-level certificate store.

Before you can install the Entrust Intermediate and Entrust Root certificates you will need to download them from the following URL:

https://www.certna.org/ErdsUI/Downloads/Entrust_Token_Root_Intermediate_Certs.zip

Once the zip file has been downloaded, unzip it to a working folder. You will have the following two files in your unzipped work folder:

• Token_Intermediate.cer
• Token_Root.cer

These two certificates can be installed in either the user-level certificate store or the computer-level security store. CeRTNA recommends installing the certificates in the computer-level store so that you will not have to repeat this process for each Windows user login on the ERDS workstation.

There are a couple of important notes here:

• You will need Administrator level access on the CeRTNA ERDS workstation in order to install certificates into the computer-level certificate store. CeRTNA recommends contacting your local IT support to assist with this.
• Depending on your local IT security policy, your Windows user may not have the appropriate authority to access the computer certificate store. If that is the case, then your local IT support staff can assist you with installing the certificates into the user-level certificate store.

To install the Entrust Intermediate and Entrust Root certificates complete the following steps: Click the Windows Start button and enter mmc.exe in the Search field. You should see mmc.exe listed at the top of the results list. Click mmc.exe and the following window will be displayed:

Select the File / Add-Remove snap in… menu option. The following window is displayed:

Select Certificates in the left panel and click the Add button. The following window is displayed:

My user account should be already selected. (If not select it.) Click the finish button. You will be returned to the following updated window:

The certificate snap-in should be shown in the right pane. Select the Certificates item in the left pane and click the Add button. The following window is displayed:

Click the Computer account radio button to select it. Click the Next button. The following window is displayed:

Select Local computer and click the Finish button. You are returned to the following updated window:

Click the Ok button to be returned to the following window:

I have highlighted the items we are interested in.

The first item we are interested in verifying and/or installing is the Entrust Root certificate. Review the following window:

For each of the two certificate stores (highlighted) you should verify that you do NOT have an entry in the middle pane for ‘Entrust Managed Services Commercial Private Root CA’ (In my sample above, I have already imported my Root certificate.) If the Trusted Root Certificate is already installed in either of these two certificate stores, you should continue on and verify/install the Intermediate certificate. If you discover that both the Trusted Root and Intermediate certificates are already installed on your ERDS workstation but you did not see a valid 3-tier certificate path as shown in section 4.1 then this is an indication of a more complex problem and you will need to contact CeRTNA support staff to address the issue. If the ‘Entrust Managed Services Commercial Private Root CA’ certificate does not exist in the middle pane, you need to install the certificate carefully following steps outlined below: Right-click click the Certificates subfolder that is shown in the Certificates (Local Computer) / Trusted Root Certification Authorities path (as shown above) Select All Tasks / Import… from the pop-up menu. The following window is displayed:

Click the Next button. The following window is displayed:

Click the browse button.

Locate the folder you extracted the zip file into as shown below:

Select the Token_Root.cer file and click the Open button. The following window is displayed:

Click the Next button.

The following window is displayed:

Click the Next button. The following window is displayed:

Click the Finish button. A pop-up window indicating that the certificate was successfully installed should be displayed. Click the Ok button to close the pop-up window. You will be returned to the Certificates list. Select the Certificates folder in the Local Comptuer / Trusted Root Certification Authorities path and you should now have an ‘Entrust Managed Services Commercial Private Root CA’ certificate in the middle pane, as shown below:

The process for verifying and importing the Entrust Intermediate certificates is primarily the same as just completed. The exact steps are documented in the next section.

4.2.2 Verifying / Installing the Entrust Intermediate Certificate

The next item we are interested in verifying and/or installing is the Entrust Intermediate Certification Authority certificate. Review the following window:

For each of the two certificate stores (highlighted) you should verify that you do NOT have an entry in the middle pane for ‘Commercial Private Sub CA1’ (In my sample above, I have already imported my Intermediate certificate.) If you discover that both the Trusted Root and Intermediate certificates are already installed on your ERDS workstation but you did not see a valid 3-tier certificate path as shown in section 4.1 then this is an indication of a more complex problem and you will need to contact CeRTNA support staff to address the issue. If the ‘Commercial Private Sub CA1’ certificate does not exist in the middle pane, you need to install the certificate carefully following steps outlined below: Right-click click the Certificates subfolder that is shown in the Certificates (Local Computer) / Intermediate Certification Authority path (as shown above) Select All Tasks / Import… from the pop-up menu. The following window is displayed:

Click the Next button. The following window is displayed:

Click the browse button.

Locate the folder you extracted the zip file into as shown below:

Select the Token_Intermediate.cer file and click the Open button. The following window is displayed:

Click the Next button.

The following window is displayed:

Click the Next button. The following window is displayed:

Click the Finish button. A pop-up window indicating that the certificate was successfully installed should be displayed. Click the Ok button to close the pop-up window. You will be returned to the Certificates list. Select the Certificates folder in the Local Comptuer / Trusted Root Certification Authorities path and you should now have an ‘Commercial Private Sub CA1’ certificate in the middle pane, as shown below:

Once you have completed this process, you can return to section 4.1 and re-verify that your three-tier cerification path is displaying correctly. If the three-tier path is still not displaying correctly, you will need to contact CeRTNA support for additional assistance.