Netscape Certificate Management System 6.2, Руководство администратора

Страница: 680 / 874

Additional CRL Scheduling Information
680 Netscape Certificate Manager System Administrator’s Guide • June 2003
3.
Download the certificate to the browser.
4.
Revoke the certificate.
5.
Check master CA’s CRL for the revoked certificate.
To verify that the revoked certificate has been included in the master
Certificate Manager’s CRL, go to the master Certificate Manager’s Agent
Services interface. In the left frame, click Update Certificate Revocation List.
Find the CRL and display it.
The CRL appears in the browser window. In the list, look for the certificate
revoked by the cloned Certificate Manager. If you don’t see the certificate,
check logs to resolve the problem.
Additional CRL Scheduling Information
By default, full and delta CRLs are generated at the same time. Usually, most CRLs
contain a field that specifies the next update time for both full and delta CRLs. By
default, for full CRLs, this field indicates the generation time of the next full CRL.
However, full CRLs can be generated every "n" deltas. By adding the following
parameter, the user is able to control the contents of the next update field. Setting
this parameter will cause the next update field to be set to the time of the next delta
CRL generation.
1.
Go to the master CA directory at the command line:
cd <serverRoot>/cert-<masterID>
2.
Stop the master CA server by issuing the following command in that directory:
./stop-cert
3.
Go to the master CA configuration directory at the command line:
cd <serverRoot>/cert-<masterID>/config
4.
Open the CMS.cfg file for editing, and add the following line to affect the next
update field in the CRL:
ca.crl.extendedNextUpdate=false
5.
Close and save the CMS.cfg file.
6.
Go to the master CA directory at the command line:
cd <serverRoot>/cert-<masterID>