Netscape Certificate Management System 6.1, Руководство администратора

Страница: 599 / 840

About CRLs
Chapter 14 Revocation and CRLs 599
One of the standard methods for conveying the revocation status of certificates is
by publishing a list of revoked certificates. This list is known as a certificate
revocation list (CRL). A CRL is a publicly available list of certificates that have been
revoked.
You can configure the Certificate Manager to generate CRLs by enabling and
configuring the CRL feature. You can also create CRLs conforming to X.509 (either
version 1 or version 2) standards by enabling extension-specific modules in the
CRL configuration—version 1 CRLs do not use extensions, version 2 CRLs use
extensions. Note that the server supports standard CRL extensions through its CRL
issuing points framework, see “Setting CRL Extensions,” on page 607” for more
information on setting up CRL extensions for issuing points. You can configure the
Certificate Manager to generate the CRL every time a certificate is revoked and at
periodic intervals which is stored in its internal database. If you configure the
publishing feature, you can also publish the CRLs to a file, an LDAP directory, or
an OCSP responder.
Note that the Registration Manager cannot create or publish CRLs, although it can
take revocation requests and pass them on to the Certificate Manager.
A CRL is issued and digitally signed by the CA that issued the certificates listed in
the CRL. The CA may use a single key pair to sign both the certificates and CRLs it
issues or two separate key pairs, one for signing certificates and another one for
signing CRLs.
By default, the Certificate Manager uses a single key pair for signing the certificates
it issues and CRLs it generates. You may choose to create another key pair for the
Certificate Manager and use it exclusively for signing the CRLs it generates. See
“Getting a CRL Signing Key Pair and Certificate,” on page 112 for details on setting
this up.
Reasons for Revoking a Certificate
A Certificate Manager can revoke any certificate it has issued. There are generally
accepted reason codes for revoking a certificate that are often included in the CRL.
These include the following:
0
= Unspecified—No particular reason is given.
1
= Key Compromised—The private key associated with the certificate has been
compromised in some way.
2
= CA Key Compromised—The private key associated with the CA that issued
this certificate has been compomised in some way.