Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 343 / 554

Chapter 14.
321
Revocation and CRLs
The Certificate System provides methods for revoking certificates and for producing lists of revoked
certificates, called certificate revocation lists (CRLs). This chapter describes the methods for revoking
a certificate, describes CMC revocation, and provides details about CRLs and setting up CRLs.
14.1. Revocation
Certificates can be revoked by an end user (the original owner of the certificate) or by a Certificate
Manager agent. End users can revoke certificates by using the revocation form provided in the end-
entities page. Agents can revoke end-entity certificates by using the appropriate form in the agent
services interface. Certificate-based (SSL client authentication) is required in both cases.
An end user can revoke only certificates that contain the same subject name as the certificate
presented for authentication. After successful authentication, the server lists the certificates belonging
to the end user. The end user can then select the certificate to be revoked or can revoke all certificates
in the list. The end user can also specify additional details, such as the date of revocation and
revocation reason for each certificate or for the list as a whole.
Agents can revoke certificates based on a range of serial numbers or based on subject name
components. When the revocation request is submitted, agents receive a list of certificates from which
they can pick the ones to be revoked. For instructions on how agents revoke end-entity certificates,
see the
Certificate System Agent's Guide
.
When it receives the CRL, the Certificate Manager marks the corresponding certificate records in its
internal database as revoked, and, if configured to do so, removes the revoked certificates from the
publishing directory and updates the CRL in the publishing directory.
14.1.1. SSL Client Authenticated Revocation
When an end user submits a certificate revocation request, the first step in the revocation process
is for the Certificate Manager to identify and authenticate the end user to verify that the user is
attempting to revoke his own certificate, not a certificate belonging to someone else.
In SSL client authentication, the server expects the end user to present a certificate that has the same
subject name as the one to be revoked and uses that for authentication purposes. The server verifies
the authenticity of a revocation request by mapping the subject name in the certificate presented for
client authentication to certificates in its internal database. The server revokes the certificate only if the
certificate maps successfully to one or more valid or expired certificates in its internal database.
After successful authentication, if the server detects only one valid or expired certificate matching
the subject name of the one presented for client authentication, it revokes the certificate. If the server
detects more than one valid or expired certificate with a matching subject name, it lists all those
certificates. The user can then either select the certificate to be revoked or revoke all certificates in the
list.
14.1.2. Certificate Revocation Forms
The end-entities page of the Certificate Manager includes default HTML forms for SSL client
authenticated revocation. The forms are accessible from the
Revocation
tab. The form for SSL client
authenticated-revocation is shown by clicking the
User Certificate
link.