Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 224 / 450

The system maintains only one CRL for each CA. To create or update this CRL, do the
following:
1 Start YaST and open the CA module.
2
Enter the required CA, as described in Section 17.2.3, “Creating or Revoking a
Sub-CA” (page 204).
3
Click CRL. The dialog that opens displays a summary of the last CRL of this
CA.
4 Create a new CRL with Generate CRL if you have revoked new sub-CAs or
certificates since its creation.
5 Specify the period of validity for the new CRL (default: 30 days).
6
Click OK to create and display the CRL. Afterwards, you must publish this CRL.
NOTE
Applications that evaluate CRLs reject every certificate if CRL is not available
or expired. As a PKI provider, it is your duty always to create and publish a new
CRL before the current CRL expires (period of validity). YaST does not provide
a function for automating this procedure.
17.2.7 Exporting CA Objects to LDAP
The executing computer should be configured with the YaST LDAP client for LDAP
export. This provides LDAP server information at runtime that can be used when
completing dialog fields. Otherwise, although export may be possible, all LDAP data
must be entered manually. You must always enter several passwords (see
Table 17.3,
“Passwords during LDAP Export” (page 211)).
210 Security Guide