############################################################
 Copyright (c) 2004 Luis Fernando Pardo <lfp70@hotmail.com>
############################################################

SecClabCA is a very simple Certification Authority for ZOPE environment.
This module has three components:

- SecClabWEB: the WEB Connector to the Registration Authority. This lets you to enroll your requests and get the result certificates.

- SecClabRA. the Registration Authority component, to manage your requests, deny or approve for certification, send email notifications,...

- SecClabCA: the Certification Authority component, thats lets you deny or certificate the requests or revoke them when necesary.

INSTALATION
===========
Uncompress the tar.gz on Products directory of your ZOPE distribution. Once you restart ZOPE you can create "SecClab Certification Authority", "SecClab Registration Authority" and "SecClab WEB Connector" objects.

When you create "SecClab Certification Authority" object, you must provide three fields:
- Id: The ZOPE id of this object.
- Title: The ZOPE title.
- BaseDir: The directory on which your CA files will be created. The basename of this directory will be created when you create the keys.

Once this object has been created you have to click on this object and select the option view. This shows you the WEB interface to manage the CA. Click on the "Manage Key" menu option and fill the fields with the correct options. After you have successfully created your keys, the authentication option will be enabled, so you must provide the password you fill in the key generation process to enter into the management WEB interface.


After that you can create the "SecClab Registration Authority" object. You must fill the folowing fields:
- Id: the ZOPE id.
- Title: the ZOPE title.
- Mailhost: mailhost to send notifications emails.
- fromEmail: FROM email in the notifications email.
- url_getcert: URL from where clients would download their certificates. This URL will be the get_cert page on the "SecClab WEB Connector" (if you put the WEB connector on http://127.0.0.1:8080/WebConnector/, this field must be http://127.0.0.1:8080/WebConnector/get_cert .

As SecClabCA, click on this object and select view tab to enter on the WEB management interface. This component have no authentication, so you must create it as your needs. You also have to modify de SecClabCA component so it points to this new SecClabRA. You can do it editing the tab properties on SecClabCA object and fill rafolder field with the ZOPE absolute URL of SecClabRA object (if you create on root folder with "RA" id, you must fill this field with the value /RA). It is important to select "Access contents information" for Anonymous role to let WEB interface to register certification requests.


Finally, you must create the "SecClab WEB Connector" object providing:
- Id: the ZOPE id.
- Title: the ZOPE title.
- Mailhost: mailhost to send request creation event emails.
- FromEmail: FROM email in these emails.
- rafolder: the ZOPE absolute URL of your SecClabRA object (the same value filled in the SecClabCA object bellow).

When this object is created, a new property is added with empty content: policies. As you create policies on SecClabCA you would have to include on this property one new line with this format:

CA POLICY NAME|DESCRIPTION STRING TO SHOW IN THE WEB FORMS

You can also create a policies property in each certification request forms (ca_enroll, client_enroll, server_enroll), so you can set the correct policies on each form (with the same format).

TODO LIST
=========
Many, many, many things to do (first of all cleaning the code). Some options are not implemented yet.
