Novell IFOLDER 3.7 - SECURITY ADMINISTRATION, Руководство администратора

Страница: 79 / 216

Installing and Configuring iFolder Services 79
no
vd
ocx
(e
n)
13
Ma
y 20
09
CA to create and distribute a new certificate before expiration. The extensions can contain any
additional information. An application is only required to be able to evaluate an extension if it is
identified as critical. If an application does not recognize a critical extension, it must reject the
certificate. Some extensions are only useful for a specific application, such as signature or
encryption.
Table 6-1
X.509v3 Certificate
YaST-Based PKI: YaST contains modules for the basic management of X.509 certificates. This
mainly involves the creation of CAs and their certificate. YaST provides tools for creating and
distributing CAs and certificates, but cannot currently offer the background infrastructure that allow
continuous update of certificates and CRLs. To set up a small PKI, you can use the available YaST
modules. However, you should use commercial products to set up an official or commercial PKI.
6.6.2 Creating a YaST-based CA
1 Start YaST and go to Security and Users > CA Management .
2
Click Create Root CA .
Field Content
Version The version of the certificate, for example, v3
Serial Number Unique certificate ID (an integer)
Signature The ID of the algorithm used to sign the certificate
Issuer Unique name (DN) of the issuing authority (CA)
Validity Period of validity
Subjectr Unique name (DN) of the owner
Subject Public Key Info InfoPublic key of the owner and the ID of the
algorithm
Issuer Unique ID Unique ID of the issuing CA (optional)
Subject Unique ID Unique ID of the owner (optional)
Extensions Optional additional information, such as KeyUsage
or BasicConstraints