3.
In the results page, select the desired CRL issuing point, select the option to display the CRL as base-64, and click
Display.
4.
In the CRL details page, scroll to the Certificate revocation list base64 encoded section, which shows the CRL in
base-64 format.
5.
Copy the base-64 encoded CRL, including the
-----BEGIN CERTIFICATE REVOCATION LIST-----
and
-
----END CERTIFICATE REVOCATION LIST-----
marker lines, to the clipboard or a text file.
The CRL looks similar to the example:
-----BEGIN CERTIFICATE REVOCATION LIST-----
MIHiMIGNAgEBMA0GCSqGSIb3DQEBBQUAMEsxGDAWBgNVBAoTD0RvbWFpbiBTcG9v
bmJveTEPMA0GA1UECxMGMTAyNnNiMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRo
b3JpdHkXDTA2MTExMzE4MDM0MFoXDTA2MTExMzIyMDM0MFqgDjAMMAoGA1UdFAQD
AgFeMA0GCSqGSIb3DQEBBQUAA0EAlbdl7bPD5yLpBwKkSXeSA1fa8M2TiqNynRS1
B5zDGGAamOBdnKVMEBPEXFsTzk92rjbL0J0KjoMYicTEGO1wKA==
-----END CERTIFICATE REVOCATION LIST-----
6.
Open the OCSP's agent services page.
https://server.example.com:11443/ocsp/agent/ocsp
7.
In the left frame, click Add Certificate Revocation List.
8.
In the resulting form, paste the encoded CRL inside the Base 64 encoded certificate revocation list (including the
header and footer) text area.
9.
Click Add.
The CRL is added to the internal database of the OCSP.
4. Checking the Revocation Status of a Certificate
The revocation status of a certificate is checked by submitting the certificate in its base-64 encoded format to the OCSP, as
follows:
1.
Copy the base-64-encoded certificate, including the
-----BEGIN CERTIFICATE-----
and
-----END CER-
TIFICATE-----
marker lines, to the clipboard or a text file.
The certificate looks similar to this example:
-----BEGIN CERTIFICATE-----
MIICGDCCAcKgAwIBAgIBEzANBgkqhkiG9w0BAQUFADBLMRgwFgYDVQQKEw9Eb21
haW4gU3Bvb25ib3kxDzANBgNVBAsTBjEwMjZzYjEeMBwGA1UEAxMVQ2VydGlmaW
NhdGUgQXV0aG9yaXR5MB4XDTA2MTAyNjE1MjEzOVoXDTA4MTAxNTE0MTIxNVowL
jEXMBUGA1UEChMOVG9rZW4gS2V5IFVzZXIxEzARBgoJkiaJk/IsZAEBEwNjZnUw
gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMDmhEvpHBMBE/N1mQ+
w2kEn9fw0w6RIQvxxUACPabb66Dgg8DcAFLpYK9HZ7ZPkX+
mVr/aCFZUOZkydySGE3zjLwhX5s5UgJ3YGcaLm3rbfsAXZxJNlHyLVqJ/p7Lrvq
pGfs80oVxudAgMBAAGjajBoMA4GA1UdDwEB/wQEAwIGwDALBgNVHREE
BDACgQAwHQYDVR0OjJZAWWvgEWblcn6gh2rW2kxdMB8GA1UdIwQYMBa
AFFpUxAabux1ebNVWkYucMAkGA1UdEwQCMAAwDQYJKoZIhvcNAQEFBQ
ADQQBwyt/tiBd1TRrCWlxRds2zTRrFk1MyIYJWFzZL3fR3tT/1dD1NR
V6t1Z/5bqchjMsQwXGZ
-----END CERTIFICATE-----
2.
Open the OCSP agent services page.
3.
In the left frame, click Check Certificate Status.
4.
In the next form, paste the certificate inside the Base 64 encoded certificate text area.
4. Checking the Revocation Status
of a Certificate
52
Chapter 7. OCSP: Agent Services
Summary of Contents for CERTIFICATE SYSTEM 7.2 - AGENT GUIDE
Page 1: ...Red Hat Certificate System Agent Guide 7 2 ...
Page 3: ......
