Authorization by the Personal Digital Certificate

Registration and obtaining of the personal digital certificate is possible in Microsoft Internet Explorer or Netscape and is performed at www.wmcert.com.

To start WM Keeper Light server application install the certificate and visit https://light.wmtransfer.com page.

Installation consists of the following stages:

1. Registration and obtaining the personal certificate.
2. Saving the personal certificate and creating a reserve copy.
3. Installation and using the personal certificate.

The secret key, which is necessary for access to the WM-identifier, is stored in the certificate. The personal should be installed to the certificate storage.

The fundamental innovation in the security area lies in the fact that now the the critical personal data no longer need to be stored on the computer. Authorization is provided by using non-permanent session pairs: the login number and the password number, which are changed every time to enter the system and they never repeat.

Saving the personal certificate and creating its reserve copy

During the registration the certificate and the secret key, which is obtained with the certificate, are saved in the way that allows to export them from the local computer's certificate storage to create the reserve copy of the cilent's personal certificate. After the registration is finished the personal certificate should be exported, its reserve copy should be created and the certificate should be deleted from the certificate storage, because leaving the certificate in the storage in the exportable mode is undesirable. Export can be performed in "Certificates manager"(in the Internet Explorer in "Internet options", "Contents" tab, "Certificates" button). After the export you can install the personal certificate on one of your computers by clicking it.

Installation and using the personal certificate

The most acceptable variant of the personal certificate installation on the computer is the "Strong key protection" mode. This mode is turned on by checking the "Enable strong private key protection" option in the dialog that prompts for password during the personal certificate installation. In is not recommended to install the personal certificate in the exportable mode.

In the "Strong key protection" mode every time the personal certificate is accessed the dialog is shown with confimation to allow a program to use the private key. This mode will not be too burdensome, because when SSL connection is used this confirmation occurs only at the beginning. The more strict mode of accessing the private key (password prompt) is appropriate when the computer might be accessed by unauthorized users at any moment.

WM Keeper Light installation and starting recommendations

In order to register and start WM Keeper Light the web browser is used. The connection is set up via HTTPS protocol that uses secure connection (128-bit version of SSL). Authorization of the WM Keeper Light client is performed relying on the personal certificate. The latest versions of web browsers are recommended.

Using the 128-bit SSL

1. The browser should support SSL.
2. SSL usage should be enabled in the browser preferences.
3. Setting of WM Keeper Light SSL connection requires the higher security level than the one that is probably used on your computer. Therefore the 128-bit SSL update should be set up. It should be downloaded from the browser's vendor site (for Internet Explorer you can use updates from the Windows Update or IE High Encryption Pack sites).
4. Furthermore the browser should support usage of client certificates.

Using the registration site by different browsers

For Internet Explorer you should enable starting ActiveX elements signed by publisher.

Internet Explorer for Mackintosh does not support the used ActiveX, for this reason Netscape 6 is recommended.

In Netscape the password to the certificate storage should be set. The password is set for the whole certificate storage. During registering using Netscape the generation of the personal certificate takes place and the the certificate storage is accessed in order to save the certificate (the storage password is demanded).

Using the personal certificate

To work with WM Keeper Light in IE browser the personal certificate should be installed to the certificate storage. The installation of the certificate from the file to the Microsoft Windows certificate storage is performed by double-clicking PFX file in the explorer (see the installation demo).

The personal certificate chosen to work with WM Keeper Light has an effect till the browser is closed, therefore after you finish working with the program you should close all browser windows opened by the user while working with the program.

The certificate containing only a public key (see standard PKCS #7; the default file extention is .cer) does not provide access because it's is not able to authenticate client due to the absence of a secret key, which is contained in the personal certificate (see standard PKCS #12; the default file extension is .pfx).

The certificate can be removed from the storage by using the certificate manager (in IE it is performed by clicking the "delete" button). Manager window in IE can be opened from menu item "Tools / Internet Options". Than in the IE preferences dialog choose the "Contents" tab, and than the "Certificates" button.

The existence of the WebMoney Transfer system root certificates installed in the browser is essential in order to enable the browser to operate correctly with the system sites and services. The certificates are installed automatically during the regitration. In case you have refused to install the system certificates or you want to work from the other computer you can install these certificates manually.