Netscape Certificate Management System 6.2, Руководство администратора

Страница: 187 / 874

Configuring the Online Certificate Status Manager
Chapter 5 OCSP Responder 187
❍
Configure the Revocation Info stores. See “Configure the Revocation Info
Stores,” on page 193.
❍
Identify every Certificate Manager that will publish to the OCSP
Responder to the OCSP Responder. “Identifying the CA to the OCSP
Responder,” on page 191 for complete details.
❍
You may need to configure trust settings depending on who signed the
OCSP signing certificate. See “OCSP Certificates,” on page 189 for details.
5.
After configuring both the Certificate Manager and the Online Certificate
Status Manager, restart both.
6.
To verify that the CA is properly connected to the OCSP responder, see “Verify
Certificate Manager and Online Certificate Status Manager Connection,” on
page 192.
Configuring the Online Certificate Status
Manager
This section details the areas that you can configure for the Online Certificate
Status Manager and points you to specific information on configuring those sets of
features.
Adding Users
Once the Online Certificate Status Manager is installed, you need to add users and
assign them to the administrator, agent, and auditor roles. See Chapter 8,
“Authorization” for details on adding users and assigning them to groups.
Configuring Authorization
Each subsystem has a set of predefined groups that are assigned a default set of
privileges. You create users in the CMS database and then assign them to that
group to give them the privileges of that group. The privileges assigned to a role
are controlled by Access Control Instructions (ACIs) placed in Access Control Lists
(ACLs). ACLs define points that need specific authorization. Generally, each
defines a distinct set of functionality for the server. ACIs define what operations
can or cannot be performed by a user, group, or IP address for that particular ACL.
You can change the default ACIs set up in the ACLs to change the privileges. You