Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 599 / 840

Setting Up Publishing
Chapter 16 Publishing 599
❍
If you are publishing all CRLs to one location, create one publisher specifying the
location where you want to publish all CRLs.
❍
If you are publishing different types of CRLS to separate locations, create a
publisher for each location you will publish to specifying the location you will
publish. You use Rules to determine which type to publish, and then tell the rule
which location to publish to by associating the Rule with the Publisher you create
in this step.
For complete details about setting up Publishers, see “Configuring Publishers for
Publishing to OCSP,” on page 603.
3.
For LDAP publishing, you need a Publisher for each type of object you will be
publishing: CA certificate, cross-pair certificate, CRL, and user certificates. In the case
of LDAP publishing, the Publisher simply declares which attribute in which to store the
object. The attributes that are setup by default are the X500 standard attributes for
storing each object type. You can change the attribute you want to store the object by
changing the attribute in this publisher. Generally, you will not need to do anything to
the Publishers for LDAP publishing. For more information, see “Configuring
Publishers for LDAP Publishing,” on page 605.
4.
For LDAP publishing, you need to set up Mappers to enable an entries’ DN to be
derived from the certificate’s subject name. Generally, you will need to set one up for
the CA certificate, CRLs and for user certificates. You can also set more than one up
for a particular type. You might do this, for example, if you have two sets of users from
different divisions of your company who are located in different parts of the directory
tree. You might create one Mapper for each of the groups that specifies a different
branch of the tree.
For complete details about setting up Mappers, see “Configuring Mappers,” on page
610.
5.
You set up Rules to determine what exactly gets published where. Rules work
independently, not in tandem. A certificate or CRL that is being published is matched
against every rule. Any rule to which it matches is activated. In this way, the same
certificate can be published to a file and to an LDAP directory by matching a file-based
rule and matching a directory-based rule.
You can set up rules for each object type: CA certificate, CRL, user certificate, and
cross-pair certificate, or you can even further divide the rules so that you have different
rules for different kinds of certificates, or different kinds of CRLs.