Netscape Certificate Management System 6.2, Руководство администратора

Страница: 636 / 874

Mappers
636 Netscape Certificate Management System Administrator’s Guide • June 2003
If the mapper fails to create a second CA entry, be sure to check the base DN that
the uid uniqueness plug-in is set to (in the
slapd.ldbm.conf
file) and also check if
an entry with the same UID already exists in the directory. If it’s true, adjust the
mapper setting, remove the old CA entry, comment out the plug-in, or create the
entry manually using the Console window.
During installation, the Certificate Manager automatically creates two instances
(called mappers) of the CA certificate mapper module. The mappers are named as
follows:
•
LdapCrlMap
for CRLs (see “LdapCrlMap” on page 637)
•
LdapCaCertMap
for CA certificates (see “LdapCaCertMap” on page 637)
Table 15-8 LdapCaSimpleMap Configuration Parameters
Parameter Description
createCAEntry
Select if you want the server to create a CA’s entry (default). Deselect
if you don’t want the server to create an entry.
If you select, the Certificate Manager first attempts to create an entry
for the CA in the directory. If the Certificate Manager succeeds in
creating the entry, it then attempts to publish the CA’s certificate to
the entry. If you don’t select, the entry must already be present in
order to publish to it.
dnPattern
Specifies the DN pattern the Certificate Manager should use to
construct the DN in order to search for the CA’s entry in the
publishing directory. The value of
dnPattern
can be a list of AVAs
separated by commas. An AVA can be a variable, such as
CN=$subj.cn
, that the Certificate Manager can derive from the
certificate subject name, or a constant, such as
O=Example
Corporation
.
Note that if your CA certificate does not have the
CN
component in
its subject name, be sure to adjust the CA certificate mapping DN
pattern to reflect the DN of the entry in the directory where the CA
certificate is to be published. For example, if your CA certificate
subject DN is
O=Example Corporation
and the CA’s entry in the
directory is
cn=Certificate Authority, o=Example
Corporation
, the pattern should look like this:
cn=Certificate
Authority, o=$subj.o