Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 346 / 554

Chapter 14. Revocation and CRLs
324
One of the standard methods for conveying the revocation status of certificates is by publishing a list
of revoked certificates, known a certificate revocation list (CRL). A CRL is a publicly available list of
certificates that have been revoked.
The Certificate Manager can be configured to generate CRLs. These CRLs can be created to conform
to X.509 standards by enabling extension-specific modules in the CRL configuration. The server
supports standard CRL extensions through its CRL issuing points framework; see
Section 14.4.3,
“Setting CRL Extensions”
for more information on setting up CRL extensions for issuing points. The
Certificate Manager can generate the CRL every time a certificate is revoked and at periodic intervals.
If publishing is set up, the CRLs can be published to a file, an LDAP directory, or an OCSP responder.
A CRL is issued and digitally signed by the CA that issued the certificates listed in the CRL. The CA
may use a single key pair to sign both the certificates and CRLs it issues or two separate key pairs,
one for signing certificates and another one for signing CRLs.
By default, the Certificate Manager uses a single key pair for signing the certificates it issues and
CRLs it generates. To create another key pair for the Certificate Manager and use it exclusively for
signing CRLs, see
Section 4.11, “CRL Signing Key Pair and Certificate”
.
14.3.1. Reasons for Revoking a Certificate
A Certificate Manager can revoke any certificate it has issued. There are generally accepted reason
codes for revoking a certificate that are often included in the CRL, such as the following:
•
0
. Unspecified; no particular reason is given.
•
1
. The private key associated with the certificate was compromised.
•
2
. The private key associated with the CA that issued the certificate was compromised.
•
3
. The owner of the certificate is no longer affiliated with the issuer of the certificate and either no
longer has rights to the access gained with the certificate or no longer needs it.
•
4
. Another certificate replaces this one.
•
5
. The CA that issued the certificate has ceased to operate.
•
6
. The certificate is on hold pending further action. It is treated as revoked but may be taken off hold
in the future.
A certificate can be revoked by administrators, agents, and end entities. Agents and administrators
with agent privileges can revoke certificates using the forms in the agent services page. End users
can revoke certificates using the forms in the
Revocation
tab of the end-entity interface. End users
can revoke only their own certificates, whereas agents and administrators can revoke any certificates
issued by the server. End users are also required to authenticate to the server in order to revoke a
certificate.
Whenever a certificate is revoked, the Certificate Manager updates the status of the certificate in
its internal database. The server uses the entries in the internal database to track of all revoked
certificates, and, when configured, it makes the CRLs public by publishing it to a central repository to
notify other users that the certificates in the list are no longer valid.