Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 27 / 554

Certificate Profiles
5
when the token is first formatted, and all additional certificates belonging to the user can be imported
onto the token. For more information about certificates being issued through the Enterprise Security
Client, see the
Certificate System Enterprise Security Client Guide
, which is available at
http://
redhat.com/docs/manuals/cert-system/
. For information about configuring subsystems to manage
smart cards, see
Chapter 8, Token Processing System
.
1.1.12. Certificate Profiles
The Certificate System uses certificate profiles to configure the content of the certificate, the
constraints for issuing the certificate, the enrollment method used, and the input and output forms for
that enrollment. A single certificate profile is associated with issuing a particular type of certificate.
A set of certificate profiles is included for the most common certificate types; the profile settings
can be modified. Certificate profiles are configured by an administrator, and then sent to the agent
services page for agent approval. Once a certificate profile is approved, it is enabled for use. A
dynamically-generated HTML form for the certificate profile is used in the end-entities page for
certificate enrollment, which calls on the certificate profile. The server verifies that the defaults and
constraints set in the certificate profile are met before acting on the request and uses the certificate
profile to determine the content of the issued certificate.
See
Chapter 13, Certificate Profiles
for details.
1.1.13. CRLs
The Certificate System can create certificate revocation lists (CRLs) from a configurable framework
which allows user-defined issuing points so a CRL can be created for each issuing point. Delta
CRLs can also be created for any issuing point that is defined. CRLs can be issued for each type of
certificate or for a specific subset of a type of certificate. The extensions used and the frequency and
intervals when CRLs are published can all be configured.
The Certificate Manager issues X.509-standard CRLs. A CRL can be automatically updated whenever
a certificate is revoked or at specified intervals. See
Chapter 14, Revocation and CRLs
for details.
1.1.14. Publishing
Certificates can be published to files and an LDAP directory, and CRLs to files, an LDAP directory, and
an OCSP responder. The publishing framework provides a robust set of tools to publish to all three
places and to set rules to define with more detail which types of certificates or CRLs are published
where. The default publishing modules can be enabled, disabled, and configured. See
Chapter 15,
Publishing
for details.
1.1.15. Notifications
The notification feature sets up automated messages when a particular event occurs, such as when
a certificate is issued or revoked. The notification framework comes with default modules that can be
enabled and configured. See
Chapter 18, Automated Notifications
for details.
1.1.16. Jobs
The jobs feature sets up automated jobs that run at defined intervals. See
Chapter 19, Automated
Jobs
for details.