If other PKI-enabled applications move onto the desktop, additional certificates stores may be required. While this isn't much of a problem with limited rollouts found in pilot projects, the management problem will grow out of control with general distribution. The certificates can be stored on a virtual device on the file system or on a token. Later this year, Netscape is expected to announce Netscape Personal Security Manager, an application that automates much of the end-user PKI management and can be seamlessly installed into the Communicator suite. Certificate creation, signing and selection will occur with little user intervention within the Netscape application suites.
Certificates provide more than identification to applications and users.
Attributes are used by application processing ranging from identification to access control to environment configuration. However, the more attributes that are inserted into a digital certificate, the shorter the effective lifetime of the certificate. As attributes change, the certificate must be revoked and reissued. A rule of thumb for the certificate lifetime is to divide a certificate lifetime by the number of attributes it contains. How the attribute information is stored depends on the vendor and presents some implementation issues.