4.2. Testing the Key Archival and Recovery Setup

Enroll for dual certificates using the CA's Manual User Signing & Encryption Certificates Enrollment form.

Submit the request. Log in to the agent services page, and approve the request.

Log into the end-entities page, and check to see if the certificates have been issued. In the list of certificates, there should be two new certificates with consecutive serial numbers.

Import the certificates into the web browser.

Confirm that the key has been archived. In the KRA's agent services page, select Show completed requests. If the key has been archived successfully, there will be information about that key. If the key is not shown, check the logs, and correct the problem. If the key has been successfully archived, close the browser window.

Verify the key. Send a signed and encrypted email. When the email is received, open it, and check the message to see if it is signed and encrypted. There should be a security icon at the top-right corner of the message window that indicates that the message is signed and encrypted.

Delete the certificate. Check the encrypted email again; the mail client should not be able to decrypt the message.

Test whether an archived key can be recovered successfully:

Restore the key to the browser's database. Import the .p12 file into the browser and mail client.

Open the test email. The message should be shown again.