Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 583 / 840

CRL Extension Reference
Chapter 15 Revocation and CRLs 583
The right pane shows the CRL Extensions Management tab, which lists configured
extensions.
2.
To modify a rule, select it and then click Edit/View.
3.
Change the information as appropriate.
Be sure to supply all the required values. See “CRL Extension Reference,” on page 583
for complete information about each extension and the parameters for those extensions.
4.
Click OK.
You are returned to the CRL Extensions Management tab.
5.
To modify other rules, repeat steps 2 through 4.
6.
Click Refresh to see the updated status of all the rules.
CRL Extension Reference
To enable you to issue or publish X.509 v2 CRLs (that is, CRLs with extensions), CS
provides a set of extension rules; each rule enables you to configure the Certificate Manager
to set a particular CRL or CRL-entry extension in CRLs it issues.
When deciding whether to add CRL extensions, keep in mind that not all applications
support version 2 CRLs. Among the applications that do support extensions, not all
applications will recognize every extension. For general guidelines on using these
extensions in CRLs, see Appendix G, “Certificate and CRL Extensions.”
AuthorityKeyIdentifier
The
AuthorityKeyIdentifier
rule enables you to configure a Certificate Manager to
set the Authority Key Identifier Extension in CRLs. The extension is used to identify the
public key that corresponds to the private key used by a CA to sign CRLs.
The PKIX standard recommends that the CA must include this extension in all CRLs it
issues. The reason for this is that in certain situations, a CA’s public key may change (for
example, when the key gets updated) or the CA may have multiple signing keys (either
because of multiple concurrent key pairs or because of key changeover). In these cases, the
CA ends up with more than one key pair. When verifying a signature on a certificate, other
applications need to know which key was used in the signature.
For general information about the authority key identifier extension in CRLs, see
“authorityKeyIdentifier” on page 744.