Certificates, Keychain and Directory Services

Question

Starting with 10.4.3 iChat now generates X.509 certificates for all .Mac chat addresses to allow encrypted chats.
Those certificates can also be used to sign and encrypt all e-mails for your .Mac address in Mail.app. By default both sides need to send each other a signed e-mail to they get the other's certificate onto their keychains before they can exchange encrypted e-mails.
But Keychain.app allows you to query .Mac for any subscriber's certificate so you get a copy of the public key without the need to exchange messages first. Just turn on
[x] Search .Mac for Certificates
in Keychain Access' Preferences. This works just fine, you can even look at all your friends with .Mac addresses in your Address Book to see which ones already have a working certificate.
Now the second option in Keychain Access
[x] Search Directory Services for Certificates
makes me curious: How do I generate and store my own certificates for all my users in Directory Services? I haven't found any documentation on that so far and would really like to use this asap.
When I can generate all X.509 certificates for my domain and store them in Directory Services this would make life a lot easier.
So far we used some free CA authority but users tend to forget to renew their certs when the expiration warnings come in and sooner or later half of them can no longer sign or encrypt their e-mail. When I can do the renewal myself and distribute them this way this'll be a big improvement.
Norbert

Answer 1

Matthew -
thanks for your reply. Unfortunately this AFP548 article explains a lot about rolling your own CA, but it does not give any hints how to store the certificate data on the directory.
Marcel Bresink, author of several excellent books about Mac OS X (Server), gave me the hint that the following keys can be stored in an LDAP domain (information from "man DirectoryServiceAttributes"):
UserCertificate
Attribute containing the binary of the user's certificate.
Usually found in user records. The certificate is data which identifies a user.
This data is attested to by a known party, and can be independently verified
by a third party.
UserSMIMECertificate
Attribute containing the binary of the user's SMIME certificate.
Usually found in user records. The certificate is data which identifies a user.
This data is attested to by a known party, and can be independently verified
by a third party. SMIME certificates are often used for signed or encrypted emails.
UserPKCS12Data
Attribute containing binary data in PKCS #12 format.
Usually found in user records. The value can contain keys, certificates, and
other related information and is encrypted with a passphrase.
Perhaps someone else has already managed to fill those keys so Keychain Access on connected clients can retrieve the Certificates.
- Norbert