Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора

Страница: 13 / 512

xiii
18.3.3. Configuration Parameters of requestInQueueNotifier ...................................... 410
18.3.4. Configuration Parameters of publishCerts ...................................................... 411
18.3.5. Configuration Parameters of unpublishExpiredCerts ....................................... 412
18.3.6. Frequency Settings for Automated Jobs ........................................................ 413
18.4. Managing Job Plug-ins ............................................................................................ 414
18.4.1. Registering or Deleting a Job Module ............................................................ 414
19. Configuring the Certificate System for High Availability 417
19.1. High Availability Overview ....................................................................................... 417
19.1.1. Architecture of a Failover System ................................................................. 417
19.1.2. Load Balancing ............................................................................................ 418
19.2. Cloning Preparation ................................................................................................ 418
19.2.1. Diagnostics .................................................................................................. 419
19.3. Testing the Cloned Configuration ............................................................................. 419
19.4. Clone-Master Conversion ........................................................................................ 420
19.4.1. Converting a Master CA into a Cloned CA ..................................................... 421
19.4.2. Converting a Cloned CA into a Master CA ..................................................... 422
19.4.3. Converting a Master OCSP into a Cloned OCSP .......................................... 423
19.4.4. Converting a Cloned OCSP into a Master OCSP .......................................... 423
A. Certificate and CRL Extensions 425
A.1. Introduction to Certificate Extensions ......................................................................... 425
A.1.1. Structure of Certificate Extensions .................................................................. 426
A.1.2. Sample Certificate Extensions ........................................................................ 427
A.2. Note on Object Identifiers ......................................................................................... 428
A.3. Standard X.509 v3 Certificate Extensions .................................................................. 429
A.3.1. authorityInfoAccess ........................................................................................ 429
A.3.2. The authorityKeyIdentifier ............................................................................... 430
A.3.3. basicConstraints ............................................................................................ 431
A.3.4. certificatePolicies ........................................................................................... 431
A.3.5. CRLDistributionPoints .................................................................................... 431
A.3.6. extKeyUsage ................................................................................................. 432
A.3.7. issuerAltName Extension ............................................................................... 433
A.3.8. keyUsage ...................................................................................................... 433
A.3.9. nameConstraints ........................................................................................... 435
A.3.10. OCSPNocheck ............................................................................................ 435
A.3.11. policyConstraints .......................................................................................... 435
A.3.12. policyMappings ............................................................................................ 436
A.3.13. privateKeyUsagePeriod ................................................................................ 436
A.3.14. subjectAltName ........................................................................................... 436
A.3.15. subjectDirectoryAttributes ............................................................................. 437
A.3.16. subjectKeyIdentifier ...................................................................................... 437
A.4. Introduction to CRL Extensions ................................................................................. 438
A.4.1. Structure of CRL Extensions .......................................................................... 438
A.4.2. Sample CRL and CRL Entry Extensions ......................................................... 439
A.5. Standard X.509 v3 CRL Extensions .......................................................................... 439
A.5.1. Extensions for CRLs ...................................................................................... 440
A.5.2. CRL Entry Extensions .................................................................................... 446
A.6. Netscape-Defined Certificate Extensions ................................................................... 448
A.6.1. netscape-cert-type ......................................................................................... 448
A.6.2. netscape-comment ........................................................................................ 448
B. Introduction to Public-Key Cryptography 449