Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора, Страница: 123 / 512

Certificate Manager Certificates
103
An agent can revoke any certificate issued by the Certificate Manager by searching for the certificate
in the agent services interface and then marking it revoked. Once a certificate is revoked, it is marked
revoked in the database and in the publishing directory, if the Certificate is set up for publishing.
If the internal OCSP service has been configured, the service determines the status of certificates by
looking them up in the internal database.
Automated notifications can be set to send email messages to end entities when their certificates are
revoked by enabling and configuring the certificate revoked notification message.
4.2. Certificate Manager Certificates
When a Certificate Manager is installed, the keys and requests for the CA signing certificate, SSL
server certificate, and OCSP signing certificate are generated. The certificates are created before the
configuration can be completed, either by the CA itself, by being automatically submitted to the root
CA in the PKI, or by submitting the requests to a third-party CA.
The CA certificate request is either submitted as a self-signing request to the CA, which then issues
the certificate and finishes creating the self-signed root CA, a third-party public CA, or another
Certificate System CA. When the external CA returns the certificate, the certificate is installed, and
installation of the subordinate CA is completed.
4.2.1. CA Signing Key Pair and Certificate
Every Certificate Manager has a CA signing certificate with a public key corresponding to the private
key the Certificate Manager uses to sign the certificates and CRLs it issues. This certificate is created
and installed when the Certificate Manager is installed. The default nickname for the certificate is
caSigningCert cert-
instance_ID
, where
instance_ID
identifies the Certificate Manager instance.
The default validity period for the certificate is five years.
The subject name of the CA signing certificate reflects the name of the CA that was set during
installation. All certificates signed or issued by the Certificate Manager include this name to identify the
issuer of the certificate.
The Certificate Manager's status as a root or subordinate CA is determined by whether its CA signing
certificate is self-signed or is signed by another CA, which affects the subject name on the certificates.
• If the Certificate Manager is a root CA, its CA signing certificate is self-signed, meaning the subject
name and issuer name of the certificate are the same.
• If the Certificate Manager is a subordinate CA, its CA signing certificate is signed by another CA,
usually the one that is a level above in the CA hierarchy (which may or may not be a root CA). If the
Certificate Manager is a subordinate CA in a CA hierarchy, the root CA's signing certificate must
be imported into individual clients and servers before the Certificate Manager can be used to issue
certificates to them.
NOTE
The CA name
cannot
be changed or all previously-issued certificates are invalidated.
Similarly, reissuing a CA signing certificate with a new key pair invalidates all certificates
that were signed by the old key pair.