ViPNet CSP 4.0. User's Guide

Transcription

1 ViPNet CSP 4.0 User's Guide

2 Inftecs. All rights reserved. Versin: ENU This dcument is included in the sftware distributin kit and is subject t the same terms and cnditins as the sftware itself. N part f this publicatin may be reprduced, published, stred in an electrnic database, r transmitted, in any frm r by any means electrnic, mechanical, recrding, r therwise fr any purpse, withut the prir written cnsent f Inftecs JSC. ViPNet is a registered trademark f Inftecs JSC, Mscw, Russia. All brands and prduct names that are trademarks r registered trademarks are the prperty f their wners. Inftecs GmbH Oberwallstr Berlin Deutschland Tel: +49 (0) Fax: +49 (0) supprt@inftecs.biz Web:

3 Cntents Intrductin... 8 Abut This Dcument... 9 Audience... 9 Dcument Cnventins... 9 Abut ViPNet CSP System Requirements Distributin Kit Feedback Chapter 1. Using ViPNet CSP in Data Prtectin Systems ViPNet CSP Purpse Encrypting and Signing Dcuments Key Cntainer Digital Signature Authenticity and Cnfidentiality f TLS/SSL Cnnectins ViPNet CSP Scpe Chapter 2. Quick Start Chapter 3. Setting Up and Starting ViPNet CSP ViPNet CSP Setup Running Setup frm the Cmmand Line Adding, Uninstalling, and Restring ViPNet CSP Cmpnents Starting ViPNet CSP ViPNet CSP Licensing Chapter 4. Registering ViPNet CSP Befre Yu Begin Why Yu Need t Register ViPNet CSP Starting the Registratin Prcess Buying Prgram (Getting a Serial Number) Requesting a Registratin Cde... 38

4 Requesting Yur Registratin Cde n the Internet (nline) Requesting Yur Registratin Cde by Requesting Yur Registratin Cde by Phne Receiving Yur Registratin Cde frm the Administratr Registering ViPNet CSP Saving Registratin Data If the Cnfiguratin f Yur Cmputer Has Been Changed System Administratr Actins fr Registratin Using a File Chapter 5. Obtaining a Certificate and Private Key Obtaining and Installing a Private Key and a Certificate Creating a Certificate Request and Generating a Private Key Using Signing Keys f the ViPNet Hst's User Chapter 6. Installing Cntainers and Certificates Ways t Install a Private Key and a Certificate Installing Cntainer frm a Flder Installing Cntainer frm an External Device Installing Certificates in a Cntainer Installing the User Certificate in the System Stre Installing a Certificate Which Has Nt Been Added t the Cntainer Installing a Certificate frm Cntainer Installing Issuer's Certificates and CRL Chapter 7. Wrking with Cntainers Viewing and Cnfiguring Cntainer Prperties Changing the Cntainer Passwrd Deleting a Previusly Saved Passwrd Verifying a Key Cntainer Deleting a Private Key Creating a Backup Cpy f a Cntainer Deleting a Cntainer Chapter 8. Managing External Devices Viewing the Cnnected Devices List Cnfiguring the Devices List External Device Initializatin... 87

5 Changing PIN Using a Randm Number Generatr Chapter 9. Digital Signature in Micrsft Office Dcuments Digitally Signing a Dcument Micrsft Office Micrsft Office Micrsft Office Viewing a Digital Signature Micrsft Office Micrsft Office Micrsft Office Remving a Digital Signature Micrsft Office Micrsft Office Micrsft Office Visible Representatin f a Signature Line in Wrd and Excel Dcuments Adding a Signature Line t a Dcument Adding a Signature Line t a Dcument Chapter 10. Digital Signature and Encryptin in Micrsft Mail Prgrams Organizing Encrypted Messages Exchange Exchanging Certificates with the Message Recipient Advanced Cnfiguring f Digital Signature and Encryptin Adding a Digital Signature t All Messages Micrsft Outlk Windws Live Mail Adding a Digital Signature t a Message Micrsft Outlk Digitally Sign/Sign Buttn Isn't Displayed Windws Live Mail Viewing the Message's Digital Signature Micrsft Outlk Windws Live Mail Encryptin Encryptin in Outlk Encryptin in Outlk

6 Encryptin in Micrsft Outlk 2010 and Micrsft Outlk Encryptin in the Windws Live Mail Prgram Viewing the Encrypted Messages Encrypting Dcuments and Files Chapter 11. Digital Signature in Micrsft Office InfPath Permissin t Sign an InfPath Frm with a Digital Signature Micrsft Office InfPath Micrsft Office InfPath Micrsft Office InfPath Signing an InfPath Frm Micrsft Office InfPath Micrsft Office InfPath 2007, 2010, and Viewing an InfPath Frm Signature Unsigning an InfPath Frm Chapter 12. Digital Signature fr Macrs and Databases Macr Digital Signature Digitally Signing a Macr Verifying a Macr's Digital Signature Unsigning a Macr Signing Micrsft Access 2007 and 2010 Databases Chapter 13. Organizing a Prtected Cnnectin via TLS/SSL Checklist: Organizing Access t a Prtected Web Server Cnfiguring a Server Hst Cnfiguring a Client Hst Cnfiguring Internet Explrer fr Wrk ver the TLS/SSL Prtcl Checking the Web Hst's Availability ver the Secure HTTPS Prtcl Chapter 14. Prblems and Trubleshting Checking the Prgram Cmpnents Integrity The Prgram Wn't Start ViPNet CSP Cnflicts with Other Prgrams Can't Use Accrd-TSHM Electrnic Lck When Yu Are Using etken Aladdin, the System Irrespnsive Unable t Check the Certificate

7 Dcument Can't be Encrypted Address f the Certificate Is Nt Fund n the List f Cntact Addresses Invalid Certificate Can't Use the Digital Signature The Crrespnding Private Key Is Nt Fund The Message Can't be Signed An Message Is Signed with a Certificate That Yu Have Nt Selected fr Signing Macrs r Micrsft Access 2007 Database Can't be Signed The Signature Line in Micrsft Wrd 2003 r Excel 2003 Can't be Signed Signed Micrsft Wrd r Excel Dcument Can't be Edited N Cnnectin t the Server ver HTTPS The IIS Server and the Web Client Have Different ViPNet CSP Versins User's Certificates, the Issuer's Certificate, and CRL Were Installed in the Wrng Stre The Brwser Is Nt Cnfigured t Wrk ver the TLS Prtcl The IIS Services Shuld Be Restarted Passwrd t Server's Certificate Shuld Be Saved When Yu Cnnect t a Server, Security Warning Is Displayed Prviding Additinal Infrmatin Abut the Prblem Appendix A. External Strage Devices Overview Supprted External Strage Devices Appendix B. Glssary Appendix C. Index

8 Intrductin Abut This Dcument 9 Abut ViPNet CSP 11 Feedback 13 ViPNet CSP 4.0. User's Guide 8

9 Abut This Dcument In this dcument, yu can learn abut the purpse f the ViPNet CSP prgram and find hw-t tpics n its usage. Here yu can als get an verview f the ViPNet CSP features, explre the principles f the prgram peratin, and find the descriptin f the graphical user interface. Audience This dcument appeals t thse wh use certificates in ViPNet CSP fr encrypting dcuments in digital dcument wrkflw and Outlk messages, fr signing, fr digital signatures verificatin, as well as t system administratrs wh rganize remte access t resurces ver TLS/SSL prtcls. A ViPNet CSP user des nt have t be an infrmatin technlgy prfessinal. Hwever, at least the minimal level f expsure t netwrk technlgies, IP prtcls, firewalls, and infrmatin security is recmmended. Dcument Cnventins This dcument cncerns the fllwing cnventins: Table 1: Dcument cnventins Icn Descriptin Warning: Indicates an bligatry actin r infrmatin which may be critical fr cntinuing user peratins. Nte: Indicates a nn-bligatry, but desirable actin r infrmatin which may be helpful fr users. Tip: Cntains additinal infrmatin. ViPNet CSP 4.0. User's Guide 9

10 Table 2: Cnventins fr highlighted infrmatin Icn Name Key+Key Menu > Submenu > Cmmand Cde Descriptin The name f an interface element. Fr instance, the name f a windw, a bx, a buttn r a key. Shrtcut keys. T use the shrtcut keys, press and hld the first key and press ther keys. A hierarchical sequence f elements. Fr instance, menu items r sectins in the navigatin pane. A file name, path, text file (cde) fragment r a cmmand executed frm the cmmand line. ViPNet CSP 4.0. User's Guide 10

11 Abut ViPNet CSP ViPNet CSP is a cryptgraphic service prvider (see ViPNet CSP Purpse n page 15), which calls cryptgraphic functins frm varius Micrsft prgrams and ther prgrams using the Micrsft CryptAPI 2.0 interface. With ViPNet CSP yu can: Create signature keys (see Digital signature n page 178) in accrdance with the GOST R and the GOST R algrithms. Calculate and verify a digital signature in accrdance with the GOST R and the GOST R algrithms. Hash data in accrdance with the GOST R and the GOST R algrithms. Encrypt data and message authenticatin with mdificatin detectin cde in accrdance with the GOST algrithm. Generate randm number, pseud-randm numbers, and sessin encryptin keys. Authenticate and create the sessin key when transferring data via SSL/TLS. Stre public keys certificates directly in the key cntainer. Use varius tkens and ther devices fr string digital keys and certificates securely (etken and thers). ViPNet CSP is cmpatible with third-party cryptgraphic service prviders if they cmply with RFC and System Requirements Nte: The cmpatibility f ViPNet CSP with Windws 7 OS is fficially recgnized by Micrsft. ViPNet CSP 4.0. User's Guide 11

12 The minimum system requirements fr yur cmputer t run ViPNet CSP are as fllws: Prcessr: Intel Cre 2 Du r any ther x86-cmpatible prcessr f similar characteristics with tw r mre cres. Minimum RAM: 512 MB. Free disk space: 100 MB. Operating system: Micrsft Windws XP SP3 (32 bit), Windws Server 2003 (32 bit), Windws Vista (32/64 bit), Windws 7 (32/64 bit), Windws Server 2008 (64 bit), Windws Server 2008 R2 (64 bit), Windws 8 (32/64 bit), Server 2012 (64 bit). Yu must install the latest service pack fr yur versin f Windws. Internet Explrer 6.0 r later. If Micrsft Office prgrams are used, the versin shuld be 2003, 2007, 2010, r ViPNet CSP is cmpatible with sme external strage devices. Fr mre infrmatin abut the supprted devices, see Supprted External Strage Devices (n page 175). Distributin Kit The ViPNet CSP distributin kit includes: The ViPNet CSP setup file setup.exe. Dcument ViPNet CSP. User's Guide in PDF frmat (the current dcument). ViPNet CSP. Infrmatin abut Third-Party Sftware Cmpnents. ViPNet CSP 4.0. User's Guide 12

13 Feedback Finding Additinal Infrmatin Fr mre infrmatin abut Inftecs prducts and technlgies, see the fllwing resurces: ViPNet dcumentatin web prtal Infrmatin abut current Inftecs prducts Infrmatin abut Inftecs slutins Frequently asked questins Cntacting Inftecs We value any feedback frm yu. If yu have any questins cncerning Inftecs prducts and slutins, any suggestins, cmplains r ther feedback, feel free t cntact us by means f the fllwing: Supprt request frm Supprt supprt@inftecs.biz. Telephne: +49 (0) Fax: +49 (0) Errata Inftecs makes every effrt t ensure that there are n errrs r misprints in the text f all dcuments supplied with ViPNet sftware. Hwever, n ne is perfect, and mistakes d ccur. If yu find an errr in ne f ur dcuments, like a spelling mistake r sme inaccuracy in describing user scenaris r system features, we wuld be very grateful fr yur feedback. By sending in errata yu may save ther reader hurs f frustratin, and at the same time yu will be helping us prvide dcumentatin in even higher quality. ViPNet CSP 4.0. User's Guide 13

14 1 Using ViPNet CSP in Data Prtectin Systems ViPNet CSP Purpse 15 Encrypting and Signing Dcuments 16 Key Cntainer 18 Digital Signature 20 Authenticity and Cnfidentiality f TLS/SSL Cnnectins 21 ViPNet CSP Scpe 22 ViPNet CSP 4.0. User's Guide 14

15 ViPNet CSP Purpse The main purpse f the ViPNet CSP cryptprvider is t enable yu t implement cryptgraphic functins in Windws OS. Nte: Since the cryptgraphic service prvider is an independent sftware cmpnent, yu dn't need t start any ther client ViPNet sftware fr it t wrk prperly. ViPNet CSP may perfrm the fllwing tasks: Authenticating and ensuring the authenticity f dcuments in secure dcument exchange systems. Fr this purpse, we've implemented the means f digital signatures generatin and verificatin in accrdance with GOST R , GOST R , GOST R , and GOST R Ensuring infrmatin cnfidentiality and integrity by encrypting it and using MAC in accrdance with GOST Ensuring authenticity and cnfidentiality f TLS/SSL cnnectins. ViPNet CSP 4.0. User's Guide 15

16 Encrypting and Signing Dcuments T encrypt and verify a digital signature, the ViPNet CSP prgram emplys a public key lcated in the certificate (see Public key certificate n page 179) f the user the encrypted dcument is addressed t, r f the user wh sent the digitally signed dcument. Fr decrypt r create a digital signature, the cryptgraphic service prvider emplys a private key f the user wh decrypts r signs the dcument (the key that is specified by this user). The scheme belw visualizes the prcess f sending a cnfidential Outlk message. Figure 1: Exchanging prtected dcuments User A needs t send a cnfidential Outlk message t user B. 1 User A requests user B's public key certificate frm the netwrk certificate stre and checks its crrespndence with the user B's cntact in the Micrsft Outlk prgram. 2 User A encrypts the dcument using a public key frm user B's certificate. 3 User A sends the encrypted message t user B. 4 User B decrypts the dcument using his r her private key. Thus, user B receives the cnfidential message frm user A. If a malicius user intercepts this cnfidential message, he r she will nt be able t read it because he r she des nt pssess user B's private key. ViPNet CSP 4.0. User's Guide 16

17 If user B can't decrypt the message received frm user A, this means that the message has been changed by unauthrized persns r damaged during sending. In this case, user B can ask user A t resend the message. The prcess f digital signature generatin and verificatin is shwn belw. Figure 2: The prcess f digital signature generatin and verificatin Suppse that user A needs t digitally sign a dcument (fr example, an Outlk message) s that ther users can't change it and each user can make sure that the authr f the dcument is user A. 1 User A signs the dcument using his r her private key. 2 User A sends the dcument t all persns cncerned (t users B, C, and D) r shares the dcument with them. 3 User B requests user A's public key certificate frm the certificate stre. 4 User B verifies the dcument with user A's public key stred in user B's certificate. If verificatin is successful, the dcument's authr is user A and this dcument has nt been changed after signing. If verificatin is nt successful, the dcument's authr is nt user A r that the dcument has been mdified by unauthrized persns r damaged during sending. In this case, user B can ask user A t resend the message. ViPNet CSP 4.0. User's Guide 17

18 Key Cntainer A key pair(a public key and a private key included in a certificate) is used t encrypt and digitally sign dcuments. A private key is generated by the administratr in a Certificatin Authrity r by the user. It is stred in a key cntainer n a hard drive r an external device. A user certificate is created in a Certificatin Authrity n user's request (see Creating a Certificate Request and Generating a Private Key n page 53) r, in sme cases, n the Certificatin Authrity administratr's initiative. Yu can create a certificate request r a renewal request in the client sftware, such as ViPNet Client, and the Create a certificate request (see Obtaining and Installing a Private Key and a Certificate n page 52) prgram included in the ViPNet CSP installatin package, r a third-party prgram. Besides, yu need the issuer's certificate (n page 178) chain and CRL (see Certificate revcatin list (CRL) n page 177) t validate the user certificate. T implement a secure electrnic dcument flw system, the prgram yu create electrnic dcuments in (a Micrsft Office prgram, the Internet Explrer web brwser, the IIS) addresses the cryptgraphic service prvider and prvides it with the certificates' parameters and lcatin f the private key. Fr the prgram t access certificates, yu need t install them in the system certificates stre: Yu can use the ViPNet CSP prgram t install the user certificate and the user private key (see Installing Cntainers and Certificates n page 59). Yu can use standard perating system tls (see Installing Issuer's Certificates and CRL n page 73) t install the issuer's certificate and CRL. ViPNet CSP allws yu t install private keys and public key certificates in the fllwing ways: Adding a cntainer with a private key and a certificate. The cntainer may be lcated in a flder n a disk (see Installing Cntainer frm a Flder n page 61) r n an external device (see Installing Cntainer frm an External Device n page 64). Installing the certificate and chsing the crrespnding private key frm the cntainer in a flder n a disk r n an external device (see Installing the User Certificate in the System Stre n page 68). ViPNet CSP 4.0. User's Guide 18

19 A certificate can be stred separately frm a private key in cases when the certificate is created n a user's request. A certificate and a private key are stred in the same cntainer when the certificate request is initiated by the Certificatin Authrity administratr. A cntainer frmat depends n the particular cryptgraphic service prvider's vendr. Certificate files are always created nly in the fllwing standard frmats: X.509 frmat, cntaining nly a certificate (files with extensins.crt r.cer). PKCS#7 r PKCS#12 frmats. These frmats are intended fr string encrypted and signed messages tgether with the necessary certificates. One f these file frmats can als be used fr transferring certificates and certificate revcatin lists (files with extensins.p7r,.p7b,.pfx, and.p12). Nte: Yu can use any number f certificates and key cntainers in ViPNet CSP. In this case, t digitally sign a dcument, yu need t chse the key, which yu will use. ViPNet CSP 4.0. User's Guide 19

20 Digital Signature The digital signature is an attribute f an electrnic dcument that is a result f cryptgraphic data prcessing with the use f a private key. A digital signature can cnfirm: Authenticity. A digital signature unambiguusly identifies the persn wh has signed the dcument. Integrity. A digital signature cnfirms that the dcument has nt been changed after the signing. Nn-repudiatin. The authr can't deny the fact that he r she has signed the dcument. Thus, individuals and legal entities may use a digital signature as an equivalent t a handwritten signature t ensure the legal validity f an electrnic dcument equal t the legal validity f a printed r handwritten dcument signed manually by the eligible persn and fficially sealed. T use a digital signature, yu need t get a public key certificate (see Key Cntainer n page 18) in a cmpetent Certificatin Authrity. If certificate validatin with the use f the Certificatin Authrity's database cnfirms that a certificate is legal, functinal, has nt expired, and has nt been revked, this certificate is cnsidered valid. The dcuments that are signed using a valid certificate and have nt been changed since the mment f signing are cnsidered valid as well. ViPNet CSP 4.0. User's Guide 20

21 Authenticity and Cnfidentiality f TLS/SSL Cnnectins The TLS/SSL prtcl is used t rganize remte prtected cnnectins, fr example, t get access t remte server's resurces. The TLS/SSL prtcl ensures perfrming f ne-way authenticatin r mutual authenticatin fr interacting parties, as well as cnfidential data transfer. Yu may need secure access when yu share databases r repsitries, r create electrnic payment systems, and fr sme ther functinality. The interactin between tw hsts in a prtected cnnectin is displayed in the scheme belw. Figure 3: Hsts cmmunicate ver TLS Nte: Beside Micrsft Internet Explrer, yu may use Ggle Chrme r Yandex.Brwser as a web client. Therefr, in the brwser's shrtcut prperties, in the Object bx, at the end f the path t the prgram flder add the cmmand --usesystem-ssl. Thus, the usage f the TLS/SSL prtcl implemented by means f ViPNet CSP prvides a reliable and authrized cnnectin t remte servers and strictly cntrlled access t the prtected data. ViPNet CSP 4.0. User's Guide 21

22 ViPNet CSP Scpe With ViPNet CSP yu can perfrm the fllwing peratins: encrypt Micrsft Outlk, Micrsft Outlk Express, Micrsft Windws Mail, and Micrsft Windws Live Mail messages and their attachments (see Encryptin n page 121); generate and verify a digital signature in Micrsft Office prgrams (see Digital Signature in Micrsft Office Dcuments n page 91); sign Micrsft Outlk, Micrsft Outlk Express, Micrsft Windws Mail, and Micrsft Windws Live Mail messages (see Digital Signature and Encryptin in Micrsft Mail Prgrams n page 105); sign Micrsft Office InfPath frms (see Digital Signature in Micrsft Office InfPath n page 128); sign macrs in Micrsft Wrd, Excel, Outlk, PwerPint, Access, Publisher, and Visi prgrams (see Macr Digital Signature n page 139); establish prtected TLS/SSL web cnnectins by using an IIS server and the Micrsft Internet Explrer brwser (see Organizing a Prtected Cnnectin via TLS/SSL n page 144); perfrm cryptgraphic functins in the DcVisin electrnic dcument wrkflw; authenticate in Windws with the Kerbers prtcl; perfrm cryptgraphic peratins required fr Active Directry Certificate Services. ViPNet CSP 4.0. User's Guide 22

23 2 Quick Start If yu need t secure electrnic dcuments by means f cryptgraphy and t digitally sign dcuments, ensuring their authenticity and integrity, yu shuld install a special mdule called a cryptgraphic service prvider (see ViPNet CSP Purpse n page 15). T start using the cryptgraphic service prvider ViPNet CSP: 1 Install ViPNet CSP (see ViPNet CSP Setup n page 26). 2 Get a public key certificate and a cntainer with a private key: Yur Certificatin authrity administratr may have given yu a certificate file and a cntainer file with a private key (r a cntainer file cntaining bth a private key and a certificate) earlier. Make sure that yu already have these files. If yu dn't have a cntainer r a certificate, create a certificate request (see Obtaining and Installing a Private Key and a Certificate n page 52). Tgether with the certificate and the key cntainer, yu receive the issuer's certificate (n page 178) and the certificate revcatin list (CRL) (n page 177). Nte: A certificate cntains a public key crrespnding t nly ne private key. The private key is stred n a user's cmputer and is used t generate a digital signature and t decrypt encrypted messages. A public key is used t verify a digital signature and t encrypt messages, and it is distributed in a certificate. The issuer's certificate and CRL are used t verify the authenticity f yur certificate. ViPNet CSP 4.0. User's Guide 23

24 3 Install a public key certificate and the crrespnding private key (r several certificates and keys) (see Ways t Install a Private Key and a Certificate n page 60). Nte: When yu add a cntainer, yu will be prmpted t install the certificate int the system stre. If the certificate has nt been installed, yu shuld d it manually (see Installing a Certificate frm Cntainer n page 71). 4 Install the issuer's certificate and a certificate revcatin list (see Installing Issuer's Certificates and CRL n page 73) in the system stre. Nte: If yu are a web server administratr and yu want t rganize a secure cnnectin t yur server ver TLS/SSL, cnfigure the server and web clients fr wrk ver the TLS/SSL prtcl (see Organizing a Prtected Cnnectin via TLS/SSL n page 144). 5 Upn cmpleting the abve-mentined steps, yu may use any prgrams that use a cryptgraphic service prvider in their wrk (see ViPNet CSP Scpe n page 22). These can be prgrams fr wrking with a digital signature, encryptin, secure cmmunicatin, and thers. Figure 4: Start using ViPNet CSP ViPNet CSP 4.0. User's Guide 24

25 3 Setting Up and Starting ViPNet CSP ViPNet CSP Setup 26 Running Setup frm the Cmmand Line 28 Adding, Uninstalling, and Restring ViPNet CSP Cmpnents 29 Starting ViPNet CSP 31 ViPNet CSP Licensing 33 ViPNet CSP 4.0. User's Guide 25

26 ViPNet CSP Setup If the ViPNet CSP prgram is part f ViPNet sftware, it is installed tgether with this sftware. If yu need t install prgram separately, fllw the instructins in this sectin. T install ViPNet CSP, yu shuld have OS administratr rights n yur cmputer. T install ViPNet CSP: 1 Duble-click the setup file. 2 On the License page f the setup prgram, read the terms and cnditins f the license agreement. If yu agree, select the crrespnding check bx. Then click Cntinue. 3 T cnfigure the setup parameters, n the Setup type page, click Custmize and specify: the sftware cmpnents yu want t install; the path t the prgram flder n yur cmputer; the user name and the cmpany name; the name f the prgram flder n the Start menu. Yu can enable r disable the fllwing sftware cmpnents: ViPNet CSP supprt via MS Cypt API adds the functinality that allws yu t integrate ViPNet CSP in third-party prgrams. This cmpnent is enabled by default when yu install ViPNet CSP as a separate prgram and disabled when yu install it as a part f sme ther ViPNet sftware. KC3 integrity check adds the functinality that ensures file integrity check. This is required s that ViPNet CSP cnfrms with the KC3 Russian standard fr cryptgraphical prtectin. 4 T start the setup, click Install nw. 5 Yu will be prmpted t restart yur cmputer. T restart the cmputer immediately, click Yes. T register ViPNet CSP during installatin withut displaying the user interface ( Silent mde ), yu need t prepare the registratin file cspreg.txt and put it t the same flder as the setup.exe file. The cspreg.txt file must be as fllws: Serial Number: XXXX-XXXX-XXXX-XXXX ViPNet CSP 4.0. User's Guide 26

27 User name: <User first, secnd, and last name> Cmpany: <Cmpany name> Nte: The User name and Cmpany fields are ptinal. ViPNet CSP 4.0. User's Guide 27

28 Running Setup frm the Cmmand Line Yu may run ViPNet CSP setup prgram frm the Windws cmmand line specifying a number f standard Windws Installer arguments. Table 3: Setup mde arguments Argument /qn /qb /qf Descriptin Installatin withut displaying user interface ( Silent mde ). Installatin with basic user interface (nly a standard indicatr f prgress and infrmatinal messages are displayed). Installing with full user interface (default). Table 4: Restart mde arguments Argument /nrestart /prmptrestart /frcerestart Descriptin Disable restart after installatin. Display a dialg bx prmpting yu t restart. Restart the cmputer after installatin and frce ther applicatins t clse withut saving pened files. This parameter is valid nly in cnjunctin with the /qn argument. Here is an example f the setup cmmand: setup.exe /qn /nrestart ViPNet CSP 4.0. User's Guide 28

29 Adding, Uninstalling, and Restring ViPNet CSP Cmpnents If necessary, yu can install r uninstall ViPNet CSP cmpnents and restre the sftware in case f a failure. T add r remve a cmpnent r t restre ViPNet CSP: 1 Run the setup file. Wait until the preparatin fr the cmpnents' installatin is cmpleted. 2 In the Changing installed sftware cmpnents windw, click the required ptin: t add r remve a cmpnent, click Add r remve cmpnents; t restre the prgram, click Restre; t remve all cmpnents f the prgram, click Remve All Cmpnents. Figure 5: Changing installed sftware cmpnents Then, click Cntinue. ViPNet CSP 4.0. User's Guide 29

30 3 If yu add r remve any ViPNet sftware cmpnents, make the necessary changes in the Chse cmpnents windw. Then, click Cntinue. 4 Wait fr the peratin t be cmpleted. Then, click Clse. ViPNet CSP 4.0. User's Guide 30

31 Starting ViPNet CSP T cnfigure the ViPNet CSP prgram, d ne f the fllwing: Click the Start buttn, chse All Prgrams > ViPNet > ViPNet CSP > ViPNet CSP Settings (the prgram lcatin n the Start menu might have been changed at installatin). On the desktp, duble-click the shrtcut (this shrtcut is displayed nly if the crrespnding ptin has been selected during the installatin). When yu start ViPNet CSP dem versin, yu will be ffered t register the prgram. Yu may register the prgram r run a dem versin (see ViPNet CSP Licensing n page 33). Figure 6: Starting a dem versin After the ViPNet CSP startup, the General sectin f the main windw will be displayed. This sectin cntains infrmatin abut the prgram versin, license wner, and ViPNet CSP peratin mde. ViPNet CSP 4.0. User's Guide 31

32 Figure 7: Displaying infrmatin abut ViPNet CSP Started using ViPNet CSP. First, we recmmend yu t install a key cntainer and a certificate. (see Installing Cntainers and Certificates n page 59) ViPNet CSP 4.0. User's Guide 32

33 ViPNet CSP Licensing If yu install the ViPNet CSP prgram as part f anther ViPNet sftware, registratin is nt required. If yu install the ViPNet CSP separate, yu need t register it. Using a dem license, yu can wrk with ViPNet CSP nly fr 14 days. After that the prgram will stp functining and yu will need t register it. Hwever, there are n limitatins in the dem versin, and all features are available. Yu can register ViPNet CSP fr free s we strngly recmmend yu t d it as sn as pssible t avid any incnvenience when dem perid expires. When the dem perid expires, yu can't wrk with unregistered ViPNet CSP prgram. T cntinue the wrk, yu need t register the prgram (see Registering ViPNet CSP n page 34). The registratin is free. ViPNet CSP 4.0. User's Guide 33

34 4 Registering ViPNet CSP Befre Yu Begin 35 Buying Prgram (Getting a Serial Number) 37 Requesting a Registratin Cde 38 Registering ViPNet CSP 47 System Administratr Actins fr Registratin Using a File 50 ViPNet CSP 4.0. User's Guide 34

35 Befre Yu Begin Why Yu Need t Register ViPNet CSP 35 Starting the Registratin Prcess 35 Why Yu Need t Register ViPNet CSP After yu install ViPNet CSP, it starts in the dem mde and yu can use it nly fr a limited perid f time (see ViPNet CSP Licensing n page 33). If yu find that ViPNet CSP meets yur requirements, yu shuld register it t enjy a full-featured versin. That is why we recmmend yu the fllwing wrkflw: install ViPNet CSP and feel free t use the dem versin t find ut all its features and advantages; When the validity perid f yur dem license expires, yu need t register yur ViPNet CSP cpy. Starting the Registratin Prcess ViPNet CSP can be registered in tw ways: by yurself (cmmn registratin) and by the system administratr. T register by yurself, fllw the scenari belw. If yu are a system administratr and yu need t register several cpies at nce, yu can use the grup registratin feature allwing yu t cllect several users registratin requests in ne and receive all required registratin cdes at nce. Fr mre infrmatin, see System Administratr Actins fr Registratin Using a File (n page 50). Nte: If ViPNet CSP has been reinstalled and registered n yur cmputer, yu can restre the previusly saved registratin data using the *.brg file (see Saving Registratin Data n page 49). If yu are planning t perfrm minr upgrades t the cmputer, where yu are ging t use ViPNet CSP, cnsider the tpic If the Cnfiguratin f Yur Cmputer Has Been Changed (n page 49). ViPNet CSP 4.0. User's Guide 35

36 T register ViPNet CSP: 1 In the ViPNet CSP main windw, n the Help menu, click Registratin. The Registratin f ViPNet CSP Wizard will be launched. Figure 8: First registratin page 2 Yur next step depends n whether yu have gt the ViPNet CSP serial number befrehand: If yu have nt gt the serial number, click Get the serial number (free f charge) (see Buying Prgram (Getting a Serial Number) n page 37). If yu have gt the serial number, click Request registratin cde (see Requesting a Registratin Cde n page 38). Nte: If yu request yur registratin cde nline, yur ViPNet CSP registratin will be dne autmatically (n user actin is required). If yu have already gt bth the serial number and the registratin cde, click Register (see Registering ViPNet CSP n page 47). ViPNet CSP 4.0. User's Guide 36

37 Buying Prgram (Getting a Serial Number) T buy a serial number: 1 In thethe Registratin f ViPNet CSP wizard, select Get the serial number (free f charge), and click Next. The ViPNet prducts rder page n the Inftecs website will be displayed in yur default Internet brwser. 2 Chse the prduct versin, fill in the request frm an send it. The link t dwnlad the prduct and the serial number will be sent t yur . 3 Upn receiving a serial number, return t the Registratin f ViPNet CSP (see Starting the Registratin Prcess n page 35) wizard and request a registratin cde (see Requesting a Registratin Cde n page 38). ViPNet CSP 4.0. User's Guide 37

38 Requesting a Registratin Cde T request a registratin cde fr ViPNet CSP: 1 On the Registratin f ViPNet CSP page, chse Request registratin cde and click Next. 2 On the Registratin request ptins page, chse the means f requesting yur registratin cde. T d this, chse ne f the fllwing ptins: On the Internet (nline) (see Requesting Yur Registratin Cde n the Internet (nline) n page 38). By (see Requesting Yur Registratin Cde by n page 41). By phne (see Requesting Yur Registratin Cde by Phne n page 43). Using file (see Receiving Yur Registratin Cde frm the Administratr n page 44). Figure 9: Selecting a registratin request ptin 3 Click Next. ViPNet CSP 4.0. User's Guide 38

39 Requesting Yur Registratin Cde n the Internet (nline) Warning: Fr requesting a registratin cde n the Internet yu need an Internet cnnectin. If yu select On the Internet (nline), the Registratin data page will be displayed. Figure 10: Entering registratin data On the Registratin data page: 1 In the Serial number bx, type yur serial number. Nte: If yu d nt have a serial number, make request t purchase it (see Buying Prgram (Getting a Serial Number) n page 37). If yu have ever previusly typed yur serial number in this bx, yur serial number will be entered autmatically. 2 In the User name bx, type yur name t be used when issuing yur license and cntacting yu. This bx is ptinal. By default, the user name yu have typed at the ViPNet CSP installatin will be displayed. 3 In the Cmpany bx, type yur cmpany name. This bx is ptinal. By default, the cmpany name yu have typed at the ViPNet CSP installatin will be displayed. ViPNet CSP 4.0. User's Guide 39

40 4 In the bx, type yur address which will be used t cntact yu in case f need. Warning: We will nt sell, distribute r lease yur addresses. We are cmmitted t ensuring that yur infrmatin is secure. In rder t prevent unauthrized access r disclsure we have put in place suitable physical, electrnic and managerial prcedures t safeguard and secure the infrmatin we cllect frm yu. 5 In the Additinal infrmatin bx, feel free t type any additinal infrmatin. Fr example, yu can type here hw t cntact yu r pst sme prblems r suggestins n ViPNet registratin utility r ViPNet sftware in the whle. In the Cmputer cde bx, a cde that uniquely identifies yur cmputer is displayed. Yu can't change this value. 6 Click Next. The page, shwing yur registratin request status, will be displayed. On this page yu will als see hw much time elapsed since yu had begun yur registratin request. Please nte, that yu have n mre than three minutes t cmplete yur nline registratin request. Figure 11: Requesting fr registratin If within the three minutes a cnnectin t the Inftecs registratin server is nt established, the crrespnding message will be displayed. If a cnnectin t the Inftecs registratin server is established, the registratin may failed by the fllwing reasns: ViPNet CSP 4.0. User's Guide 40

41 Yu have supplied incrrect data. In this case, yu will be prmpted t check the crrectness f supplied data. In the message windw, click OK t return t the Registratin data page. The entered serial number has been already registered fr anther cmputer. In this case, yu will be prmpted t t get anther serial number free f charge. Click the link in the message and request a new serial number (see Buying Prgram (Getting a Serial Number) n page 37). If nline registratin was successful, the Registratin f ViPNet CSP was successful page will be displayed. This page will als display sme suggestins n hw t securely backup yur registratin data (see Saving Registratin Data n page 49). 7 Click Finish. Requesting Yur Registratin Cde by Warning: Fr requesting a registratin cde n the Internet yu need an Internet cnnectin. If yu select By , the Registratin data page will be displayed. On the Registratin data page: 1 Prvide all yur data as described in Requesting Yur Registratin Cde On the Internet (Online) (n page 38). 2 Click Next. An summarizing yur registratin data will be autmatically pened in yur default applicatin. It will be addressed t reg@inftecs.biz. ViPNet CSP 4.0. User's Guide 41

42 Figure 12: Requesting registratin cde by Warning: We dn't recmmend yu t mdify anything in this aut-generated . 3 T cmplete the prcedure, send this . When Inftecs has checked yur registratin data, yu will receive yur registratin cde in respnse. Warning: If yu dn't receive a respnse frm Inftecs fr a lng perid f time, yu may try t resend yur . T d this, repeat all steps described in this tpic. If yu still can't register yur ViPNet CSP, cntact Inftecs Supprt Team. ViPNet CSP 4.0. User's Guide 42

43 4 Upn receiving a respnse with registratin cde, register yur ViPNet CSP (see Registering ViPNet CSP n page 47). Requesting Yur Registratin Cde by Phne If yu select By phne, the Registratin request by phne page will be displayed. Figure 13: Registratin request by phne This page displays all the data yu need t tell Inftecs. 1 Call Inftecs n the phne number specified at the tp f the windw and request a registratin cde. 2 When yu receive the registratin cde, click Next. The Register page will be displayed. ViPNet CSP 4.0. User's Guide 43

44 Figure 14: Entering the serial number and registratin cde 3 On the Register page type yur serial number and registratin cde, then click Next. Nte: If yu have ever previusly typed yur serial number in this bx, yur serial number will be entered autmatically. If yu prvided crrect data, the Registratin f ViPNet CSP was successful page will be displayed. This page will als display sme suggestins n hw t securely backup yur registratin data (see Saving Registratin Data n page 49). 4 Click Finish. Receiving Yur Registratin Cde frm the Administratr The idea behind registering using a file is t delegate the registratin cde receiving prcess t yur ViPNet netwrk administratr. This means that yu persnally dn't request yur registratin cde frm Inftecs. Instead yu use the Registratin f ViPNet CSP Wizard t cllect yur registratin data and then pass it t yur ViPNet netwrk administratr. Nte: If yu wuld like t register nly ne cpy f ViPNet CSP using a file, first cmplete actins 1 6 described in this chapter and then fllw the instructins given in the chapter System Administratr Actins fr Registratin Using a File (n page 50). Then, cmplete the step 7 t register yur cpy f ViPNet CSP (see Registering ViPNet CSP n page 47). ViPNet CSP 4.0. User's Guide 44

45 It is yur ViPNet netwrk administratr, wh cllects yur and ther ViPNet users registratin data and sends it t Inftecs. It is yur ViPNet netwrk administratr, wh btains yur and ther ViPNet users registratin cdes and then passes them t yu and yur fellw ViPNet users. Upn receiving yur registratin cde frm yur ViPNet netwrk administratr yu can register yur ViPNet CSP. T register yur ViPNet CSP using a file: 1 On the Registratin request ptins page, chse Using file. The Registratin data page will be displayed. 2 Prvide all yur data as described in Requesting Yur Registratin Cde n the Internet (nline) (n page 38). Click Next. 3 On the Saving registratin data page, click Brwse and select the flder that will stre the file cntaining yur registratin data. Figure 15: Saving registratin data 4 Click Next. The registratin data is saved in a text file named after the serial number f the prgram: <serial number>.txt. ViPNet CSP 4.0. User's Guide 45

46 Figure 16: Registratin data have been saved 5 Click Finish. 6 Send the file cntaining yur registratin data t yur system administratr. 7 When yu receive yur registratin cde frm yur system administratr, register yur ViPNet CSP (see Registering ViPNet CSP n page 47). ViPNet CSP 4.0. User's Guide 46

47 Registering ViPNet CSP Upn receiving registratin cde frm Inftecs, yu can register yur ViPNet CSP. T d this: 1 Launch the Registratin f ViPNet CSP (see Starting the Registratin Prcess n page 35). 2 On the first wizard page, chse Register prgram and click Next. 3 On the Serial number page, type yur serial number. Figure 17: Entering a serial number Nte: If yu have ever previusly typed yur serial number in this bx, yur serial number will be entered autmatically. 4 On the Registratin Cde page: yu persnally sent a request fr a registratin cde, select Single registratin and type the registratin cde. yur system administratr sent a request fr a registratin cde, select Using file, click Brwse and lcate the file n yur netwrk that cntains the registratin cde. ViPNet CSP 4.0. User's Guide 47

48 Figure 18: Ввод кода регистрации 5 Click Next. If yu prvided crrect data, the Registratin f ViPNet CSP was successful page will be displayed: Figure 19: Завершение регистрации 6 Click Finish. 7 Back up yur registratin data (see Saving Registratin Data n page 49) by cpying yur registratin file t a secure lcatin. The file ffmanager.brg is lcated in the same flder as the ViPNet CSP applicatin. ViPNet CSP 4.0. User's Guide 48

49 Saving Registratin Data The registratin prcess saves registratin data t the *.brg file, which is created in ne f the fllwing flders: C:\PrgramData\inftecs\ViPNet CSP\ fr the perating systems Windws Vista, Windws 7 and Windws Server 2008; C:\Dcuments and Settings\All Users\Applicatin Data\inftecs\ViPNet CSP\ fr the perating systems Windws XP and Windws Server Nte: The name f the *.brg file depends n the ViPNet prgram versin. We recmmend yu t save this file in a secure place because it will be useful in sme cases f re-installatin (fr example, if yu need t install the prgram int anther flder n yur cmputer, r yu need t re-install the prgram after frmatting yur hard drive). In such cases, yu shuld unlad the prgram, mve the saved *.brg file back int the flders mentined abve, and then start the prgram anew. Upn start, ViPNet CSP will be registered autmatically (as lng as the registratin data are valid and the cnfiguratin f yur cmputer has nt changed). Registratin data (serial number, cmputer cde, registratin cde, and mre) is als stred in a registratin lg file named reginf.txt, lcated in the ViPNet CSP installatin flder. Yu can use infrmatin frm this file fr manual registratin f the prgram after re-installatin (fr example, if the *.brg file has been lst). If the Cnfiguratin f Yur Cmputer Has Been Changed Changes in cmputer cnfiguratin may influence the wrk f ViPNet Netwrk Manager installed n this cmputer. If yur upgrade was substantial (yu replaced almst all hardware in yur PC) yu will need t register yur ViPNet Netwrk Manager nce again (see Requesting a Registratin Cde n page 38). If yu made nly minr changes t yur cmputer s cnfiguratin, yu will nt have t register yur ViPNet Netwrk Manager again. At the first ViPNet Netwrk Manager startup after minr upgrade the message will be displayed infrming yu that yur cmputer s cnfiguratin has been changed and a new *.brg file has been created. This means that yur previus registratin data became bslete. Yu will nt be able t register yur ViPNet Netwrk Manager using thse data after its reinstallatin. That is why yu shuld cpy this updated *.brg file int the secure lcatin. If yu reinstall ViPNet CSP n this cmputer, yu shuld cpy this very file t the ViPNet CSP installatin flder. Only after that the applicatin will cnsider itself registered. ViPNet CSP 4.0. User's Guide 49

50 System Administratr Actins fr Registratin Using a File Registratin using file allws a cmpany t request and receive registratin cdes fr several users via a single persn. This persn is nrmally the rganizatin's system administratr. T register using file, all ViPNet users must have their prduct's serial number. If nt, they need t buy it via the Registratin f ViPNet CSP (see Buying Prgram (Getting a Serial Number) n page 37). Each user, frm their cmputer, shuld have created a using file registratin request (see Receiving Yur Registratin Cde frm the Administratr n page 44). This creates a *.txt file cntaining registratin data, which they will send t their system administratr. If yu are a system administratr: 1 Save the files btained frm ViPNet users and cntaining their registratin data t the same flder. 2 When yu have them all, cmbine them using the cpy cmmand: cpy *.txt registratin.all. Yu can use anther file name instead f registratin.all. 3 the file t Inftecs at reg@inftecs.biz. Name the ViPNet Registratin Using File. 4 After Inftecs cmpany has prcessed the request, yu will receive an with an attached *.txt file. This file will cntain registratin cdes fr all users taking part in the grup registratin. Deliver this file t users (fr example via netwrk disk) wh can then register their installed ViPNet prgram. ViPNet CSP 4.0. User's Guide 50

51 5 Obtaining a Certificate and Private Key Obtaining and Installing a Private Key and a Certificate 52 Creating a Certificate Request and Generating a Private Key 53 Using Signing Keys f the ViPNet Hst's User 57 ViPNet CSP 4.0. User's Guide 51

52 Obtaining and Installing a Private Key and a Certificate T have an pprtunity t sign electrnic dcuments, yu need t get a user private key, and t verify a digital signature, yu need t get a public key certificate. Nte: The rder f btaining and cmmissining a certificate and private key is determined by the rules f yur Certificatin Authrity. T generate a certificate request, ask yur Certificatin Authrity's administratr whether requests, generated in the Create a certificate request prgram, will be accepted. T btain and t cmmissin a new certificate r t renew already existing certificate, yu need t: 1 Create a certificate request in the Create a certificate request prgram (see Creating a Certificate Request and Generating a Private Key n page 53). 2 Create a private key r save a cntainer with the private key n the disk r an external device. 3 Send the certificate request file t yur Certificatin Authrity's administratr (by r ther means used in yur cmpany) and wait until yu receive the certificate. 4 Install the received certificate in a cntainer (see Installing Certificates in a Cntainer n page 66). 5 Install the received certificate (see Installing the User Certificate in the System Stre n page 68), the issuer's certificate and CRL (see Installing Issuer's Certificates and CRL n page 73) in the system stre. ViPNet CSP 4.0. User's Guide 52

53 Creating a Certificate Request and Generating a Private Key T create a request fr a new certificate r t renew an existing certificate: 1 On the Start menu, click All prgrams > ViPNet > ViPNet CSP > Create a certificate request. 2 In the Certificatin Authrity windw, chse ne f the fllwing: Request new certificate t create a new certificate request. Request a renewal f the existing certificate t renew an existing certificate. When yu are creating a certificate renewal request: In the Renew Certificate windw, select the certificate t be renewed and click OK. If yu need t select anther certificate r view the selected certificate, use the Select certificate and Selected certificate buttns. If necessary, specify new certificate parameters and details abut the wner f the certificate r use the details f the previus certificate. Figure 20: Allwing blcked cntent ViPNet CSP 4.0. User's Guide 53

54 3 In the Chse Certificate Settings sectin, specify the fllwing parameters: In the Cryptprvider list, select the cryptgraphic service prvider that yu want t use fr creating private and public keys. In the crrespnding list, select a hash algrithm. In the Purpse list, select the actins a certificate will be used fr: Signature and encryptin (by default), if yu want t use yur digital signature fr encrypting messages and signing them. Signature, if yu want t use yur digital signature nly fr signing messages r dcuments. Encryptin, if yu want nly t encrypt messages r dcuments. In the Certificate template list, chse ne f the fllwing ptins: Qualified ViPNet CSP (by default), t create a request fr a qualified certificate, in which yu may specify OGRNIP (Primary State Registratin Number f the Sle Prprietr), SNILS (Insurance Number f Individual Ledger Accunt), INN (taxpayer identificatin number), and OGRN (primary state registratin number) attributes. Reprting, t create a certificate fr signing dcuments intended fr submissin f financial statements. WEB server, t create a certificate n the IIS web server. Standard fr the remaining cases. T have an pprtunity t exprt a certificate, select the Exprtable check bx. T create a certificate fr installing it t the system stre, select the System check bx. 4 In the Prvide details abut the wner f the certificate sectin, specify the necessary infrmatin abut yurself (the persn fr whm the certificate will be generated). Figure 21: Typing the data n the certificate wner ViPNet CSP 4.0. User's Guide 54

55 Warning: If yu plan t use the certificate fr signing MS Outlk messages, yu need t specify the address.yu can't use a certificate withut an address fr signing messages. 5 In the Save Yur Request sectin, click Brwse and specify a flder n a hard r remvable drive fr string the request file, and als specify a name fr the file. Nte: The request file frmat is determined by the rules f yur Certificatin Authrity. We recmmend yu t include yur name and surname in the request file name s that yur request was easily identifiable. 6 Click Create request. This buttn appears after all required fields are filled. Warning: If the Create request buttn is nt displayed after yu fill in all required fields, make sure that, in the General sectin (see figure n page 32), the Allw ViPNet CSP t use MS Crypt API check bx is selected. Then, create a key cntainer by perfrming the fllwing actins. 7 In the displayed ViPNet CSP Key Cntainer Initializatin windw, specify: A cntainer name, r leave the default value. The cntainer lcatin by clicking ne f the fllwing ptins: Flder r Chse device. Nte: In sme cases, the ViPNet CSP Key Cntainer Initializatin windw can be displayed with a delay. Wait until it is displayed. 8 In the ViPNet CSP Key Cntainer Initializatin windw, specify the private key prtectin passwrd. 9 The Digital Rulette (n page 178) windw will be displayed. Fllw the instructins in the Digital Rulette windw. ViPNet CSP 4.0. User's Guide 55

56 Figure 22: Digital Rulette 10 In the message abut the successful creatin f the certificate request file, click OK. 11 After creating the request file, yu can clse the Certificatin Authrity brwser page. After the certificate request is created, deliver yur request file t the administratr f yur certificatin authrity and get an issued certificate in return. Then, in the ViPNet CSP Settings prgram, install the issued certificate (see Installing the User Certificate in the System Stre n page 68) and specify the key cntainer crrespnding t this certificate. ViPNet CSP 4.0. User's Guide 56

57 Using Signing Keys f the ViPNet Hst's User Yu can transfer the key cntainer installed n yur ViPNet hst using the ViPNet CryptService, ViPNet Client r ViPNet Crdinatr prgram (versin r later), t anther cmputer and use this key cntainer in the ViPNet CSP prgram. T use the signature keys f the ViPNet hst's user in the ViPNet CSP prgram, d the fllwing: 1 In the ViPNet CryptService, ViPNet Client f ViPNet Crdinatr, pen the Security Service Settings dialg bx, click the Keys tab. 2 Under Signature, click Transfer. Figure 23: Transferring the key cntainer 3 In the ViPNet CSP- Key Cntainer Initializatin windw, click Brwse and specify a flder r remvable device fr transferring the cntainer. Then click OK. The cntainer will be transferred int the specified flder. 4 Cpy the cntainer t the cmputer where the ViPNet CSP prgram installed. ViPNet CSP 4.0. User's Guide 57

58 Warning: After yu delete the cntainer frm yur ViPNet hst, yu can't use signature keys. 5 Install the cntainer in the ViPNet CSP prgram (see Installing Cntainer frm a Flder n page 61). ViPNet CSP 4.0. User's Guide 58

59 6 Installing Cntainers and Certificates Ways t Install a Private Key and a Certificate 60 Installing Cntainer frm a Flder 61 Installing Cntainer frm an External Device 64 Installing Certificates in a Cntainer 66 Installing the User Certificate in the System Stre 68 Installing Issuer's Certificates and CRL 73 ViPNet CSP 4.0. User's Guide 59

60 Ways t Install a Private Key and a Certificate T wrk with the digital signature, d the fllwing: 1 Install the cntainer cntaining yur private key: If a private key and a certificate are lcated in the same cntainer in a flder n the hard drive, see the sectin Installing Cntainer frm a Flder (n page 61). If a private key and a certificate are lcated in the same cntainer n an external device, see the sectin Installing Cntainer frm an External Device (n page 64). If the certificate was issued in the certificatin authrity by request, and as a result yu have a cntainer with a private key and a separate cer-file, see the sectin Installing Certificates in a Cntainer (n page 66). 2 Install a certificate with a public key in the system stre (see Installing the User Certificate in the System Stre n page 68). 3 Install the issuer's certificate and CRL in the system stre (see Installing Issuer's Certificates and CRL n page 73). ViPNet CSP 4.0. User's Guide 60

61 Installing Cntainer frm a Flder T wrk with prtected dcuments and t rganize cnnectins ver the TLS/SSL prtcl, yu need a private key and a crrespnding certificate. Yu can install a private key and a certificate in the same cntainer r install a certificate and a cntainer with a private key separately (see Installing the User Certificate in the System Stre n page 68). T install the cntainer, lcated in a flder n the hard drive, in the system stre: 1 In the main ViPNet CSP windw, select Cntainers. Figure 24: Cntainers cntrl panel 2 In the Cntainers sectin, click Add. 3 In the ViPNet CSP - Key Cntainer Initializatin windw, click Brwse. If a cntainer is stred n the hard drive, in the Brwse fr Flder windw, specify the lcatin f the cntainer. If a cntainer is stred n a remvable flash-drive, in the Brwse fr Flder windw, select this drive. In the Flderbx, the path will be autmatically substituted, fr example E:\inftecs\Cntainers. ViPNet CSP 4.0. User's Guide 61

62 Warning: On a remvable flash-drive, the cntainer shuld be lcated in the flder Inftecs\Cntainers. Figure 25: Installing the key cntainer frm the flder 4 In the Cntainer name list, chse the cntainer file r leave the default value. 5 Click OK. In the Key cntainer windw, a message abut the successful cntainer additin will be displayed and yu will be prmpted t install the certificate in the stre. T use certificates, yu shuld install them in the system stre f the current user. Warning: If the ViPNet CSP prgram is installed n a server and is used t rganize cnnectins ver the TLS/SSL prtcls, yu shuld install yur certificate in the lcal cmputer's stre (see Installing a Certificate frm Cntainer n page 71) manually. If yu want t install the certificates autmatically in the user's stre, click Yes. Certificates will be autmatically installed in the user's stre. If yu dn't need t install certificates (r yu will install it manually), click N. T view the cntainer's certificate list, click Certificates. 6 After yu have installed the certificates in a stre (r after yu have canceled the certificates installatin), in the available cntainers list (see figure n page 61), the added cntainer will be displayed. ViPNet CSP 4.0. User's Guide 62

63 Nte: In the certificate settings windw, yu can install certificates frm the cntainer manually (see Installing a Certificate frm Cntainer n page 71). After cntainer adding, install the issuer s certificate and CRL (see Installing Issuer's Certificates and CRL n page 73) and prceed using cryptgraphic peratins (see ViPNet CSP Scpe n page 22). ViPNet CSP 4.0. User's Guide 63

64 Installing Cntainer frm an External Device T install cntainer frm an external device: 1 In the main ViPNet CSP windw, select the Cntainers (see figure n page 61) sectin. 2 In the Cntainers sectin, click Add. 3 In the ViPNet CSP - Key Cntainer Initializatin windw, click Device. In the devices list, select the required device. Figure 26: The key cntainer initializatin frm an external device 4 In the Type PIN bx, specify the PIN f the selected external strage device. Select the Save PIN check bx if yu dn't want t enter PIN every time yu cnnect the cntainer. Nte: If yu save PIN f the device in the system, the security level becmes lwer. Fr mre infrmatin,see the Supprted External Strage Devices (n page 175). 5 Click OK. In the Key cntainer (see figure n page Ошибка! Закладка не определена.) windw, the message abut successful cntainer additin will be displayed, and yu will be prmpted t install the certificate in the stre. T use certificates, yu shuld install them in the system stre f the current user. ViPNet CSP 4.0. User's Guide 64