Netscape ENTERPRISE SERVER 6.1, Manual

Page: 283 / 373

Security
Chapter 7 Syntax and Use of magnus.conf 283
ldap://ldap.example.com:5000/o=example.net?cn,mail,
telephoneNumber?sub?(sn=Jensen)
❍
http[s]://[
username
:
password
@]
hostname[
:
port]
/
path
[?
query_string
]
For example:
https://ca.example.com:1025/getCRL?op=getCRL&issuepoint=Maste
rCRL
• The update_interval is the maximum amount of time in minutes to allow
between CRL dowloads.
At startup, Enterprise Server downloads all CRLs configured for automatic
downloading. To determine the time of the next download, Enterprise Server
uses this value or the time specified in the Next Update field of the CRL,
whichever is sooner. Not all CRLs have a Next Update field, however, so you
must specify an update interval for each CRL.
To determine an appropriate update interval, consider the network
connectivity and available bandwidth at your site and check with the CA to
find out how often a particular CRL is updated.
• The value of max_age is the time in minutes you want Enterprise Server to wait
past the time specified in the Next Update field before determining that the
CRL is too old to be valid. If you have enabled the option to shut down
Enterprise Server when a CRL is considered too old, Enterprise Server shuts
itself down.
This value applies only if the directive
CRLAgeCheck
is set to
on
and if the CRL
has a Next Update field.
To avoid unnecessary shutdowns, Netscape recommends that you set this
value no lower than
5
(minutes) and take into account possible system time
differences between the Enterprise Server host and the CA’s CRL download
server. Clocks on different servers can be out of sync, and the CA can still be
generating a new CRL at Next Update time.
Default
No default. This directive is added to
magnus.conf
only after automatic CRL
downloads are enabled and you have configured at least one CRL for automatic
downloading.
Example
CRLFile https://
my_ca
/
my_crl
;5;5 \
ldaps://
my_ca
/
my_crl
;60;120