Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 587 / 840

CRL Extension Reference
Chapter 15 Revocation and CRLs 587
InvalidityDate
The
InvalidityDate
rule enables you to configure a Certificate Manager to set the
Invalidity Date Extension in CRL entries. The extension is a non-critical CRL entry
extension that is used to specify the date on which it is known or suspected that the private
key was compromised or that the certificate otherwise became invalid.
For general guidelines on setting the invalidity date extension in CRL entries, see
“invalidityDate” on page 747.
IssuerAlternativeName
The
IssuerAlternativeName
rule enables you to configure a Certificate Manager to set
the Issuer Alternative Name Extension in CRLs. This extension enables binding of or
associating alternative identities, such as a mail address, a DNS name, an IP address, and a
uniform resource indicator (URI), with the issuer of the CRL.
instruction
Specifies the action a validating application must take when it encounters
a certificate that has been put on hold.
Permissible values:
none
,
callissuer
, or
reject
.
•
none
specifies that the validating application need not do anything;
the PKIX standard says that this is semantically equivalent to the
absence of a holdInstructionCode (default).
•
callissuer
specifies that the validating application must call the
CA that has issued the certificate or reject the certificate.
•
reject
specifies that the validating application must reject the
certificate on hold.
Table 15-7 InvalidityDate Configuration Parameters
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Select to enable (default),
deselect to disable.
critical
Select if you want the server to mark the extension critical; deselect if you
want the server to mark the extension noncritical (default).
Table 15-6 HoldInstruction Configuration Parameters (Continued)
Parameter Description