Netscape Certificate Management System 6.1, Руководство администратора

Страница: 646 / 840

Rules
646 Netscape Certificate Management System Administrator’s Guide • February 2003
Rules
You set up Rules to determine what exactly gets published where. Rules work
independently, not in tandem. A certificate or CRL that is being published is
matched against every rule. Any rule to which it matches is activated. In this way,
the same certificate can be published to a file, to an Online Certificate Status
Manager, and to an LDAP directory by matching a file-based rule, an OCSP rule,
and matching a directory-based rule.
You can set up rules for each object type: CA certificate, CRL, user certificate, and
cross-pair certificate, or you can even further divide the rules so that you have
different rules for different kinds of certificates, or different kinds of CRLs.
The rule first determines if the object meets the rule, and then where it is to be
published. Determining if the object meets the rule is done by matching the type
and predicate set up in the rule with the object itself. Determining where matching
objects are published is determined by the Publisher and Mapper that is associated
with this rule.
Note: A Registration Manager can only publish certificates. It cannot publish CRLs.
Modifying Publishing Rules for Certificates and
CRLs
Creating a publishing rule for CA certificate and end-entity certificates involves
creating a rule that uses the publisher that you created in the previous step. You
create a rule for each type of certificate the Certificate Manager issues.
To modify publishing rules:
1.
Log in to the CMS console for the Certificate Manager (see “Logging Into the
CMS Console” on page 247).
2.
Select the Configuration tab.
3.
In the navigation tree, select Certificate Manager, select Publishing, and then
select Rules.
The right pane displays the Rules Management tab, which lists any configured
publishing rules.