Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 349 / 554

Issuing CRLs
327
Figure 14.1. Default CRL Issuing Point
Additional issuing points for the CRLs can be created. See
Section 14.4.1, “Configuring Issuing
Points”
for details.
There are four types of CRLs the issuing points can create, depending on the options set when
configuring the issuing point to define what the CRL will list:
•
Master CRL
, which contains the list of revoked certificates from the entire CA.
•
ARL
, an Authority Revocation List containing only revoked CA certificates.
•
CRL with expired certificates
, which includes revoked certificates that have expired in the CRL.
•
CRL from certificate profiles
, which determines the revoked certificates to include based on the
profiles used to create the certificates originally.
3. Configure the CRLs for each issuing point. See
Section 14.4.2, “Configuring CRLs for Each
Issuing Point”
for details.
4. Set up the CRL extensions which are configured for the issuing point. See
Section 14.4.3, “Setting
CRL Extensions”
for details.
5. Set up the delta CRL for an issuing point by enabling extensions for that issuing point,
DeltaCRLIndicator
or
CRLNumber
.
6. Set up the
CRLDistributionPoint
extension to include information about the issuing point.
7. Set up publishing CRLs to files, an LDAP directory, or an OCSP responder. See
Chapter 15,
Publishing
for details about setting up publishing.