Netscape Certificate Management System 6.2, Руководство администратора

Страница: 194 / 874

Configuring the Online Certificate Status Manager
194 Netscape Certificate Management System Administrator’s Guide • June 2003
includeNextUpdate. The Online Certificate Status Manager can include
the time stamp of next CRL update—a future update time for the CRL or
the revocation information—in the OCSP response that it sends to
OCSP-compliant clients. (According to the OCSP protocol, it is optional to
include the time stamp of next CRL update in an OCSP response.) Select
this option if you want the OCSP response to contain information about
the next CRL update. Leave the option deselected if you don’t want the
OCSP response to contain this information.
❍
If you selected
ldapStore
, fill in values as below:
numConns. Type the total number of LDAP directories the Online
Certificate Status Manager should check. By default, this is set to 0. If you
change the value to a positive integer, for example 1, 2, or 3, you will see
that many sets of
host
,
port
,
baseDN
, and
refreshInSec
fields. (Change
the value, click OK, and reopen the window to see the updated fields.)
host<n>. Type the fully-qualified DNS hostname of the LDAP directory.
The name must be in the
<machine_name>.<your_domain>.<domain>
form. For example,
corpDir1.example.com
.
port<n>.
Type the nonSSL port of the LDAP directory. For example, 389.
baseDN<n>. Type the DN to start searching for the CRL. For example,
O=example.com
.
refreshInSec<n>. Type how often the connection is refreshed. The default
is 86400 seconds (that is, refresh every day).
caCertAttr. Leave the default value,
cACertificate;binary
, as it is. (It’s
the attribute to which the Certificate Manager publishes its CA signing
certificate.)
crlAttr.
Leave the default value,
certificateRevocationList;binary
, as
it is. (It’s the attribute to which the Certificate Manager publishes CRLs.)
notFoundAsGood. A certificate’s status can typically be indicated by three
possible OCSP responses, namely GOOD, REVOKED, and UNKNOWN.
Select this option if you want the Online Certificate Status Manager to
return an OCSP response of GOOD if the certificate in question cannot be
found in any of the CRLs. If you deselect the option, the response will be
UNKNOWN, which when encountered by Netscape Personal Security
Manager (an OCSP-compliant client) results in an error message.