Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора

Страница: 154 / 512

Chapter 5. Online Certificate Status Protocol Responder
134
4. For
defStore
, fill in the following values:
•
notFoundAsGood.
Sets the OCSP service to return an OCSP response of GOOD if the
certificate in question cannot be found in any of the CRLs. If this is not selected, the response is
UNKNOWN, which, when encountered by a client, results in an error message.
•
includeNextUpdate.
The Online Certificate Status Manager can include the timestamp of the
next CRL update time.
For
ldapStore
, fill in the following values:
•
numConns.
The total number of LDAP directories the OCSP service should check. By default,
this is set to 0. Setting this value shows the corresponding number of
host
,
port
,
baseDN
, and
refreshInSec
fields.
•
host.
The fully-qualified DNS hostname of the LDAP directory.
•
port.
The non-SSL port of the LDAP directory.
•
baseDN.
The DN to start searching for the CRL. For example,
O=example.com
.
•
refreshInSec.
How often the connection is refreshed. The default is 86400 seconds (daily).
•
caCertAttr.
Leave the default value,
cACertificate;binary
, as it is. It is the attribute to
which the Certificate Manager publishes its CA signing certificate.
•
crlAttr.
Leave the default value,
certificateRevocationList;binary
, as it is. It is the
attribute to which the Certificate Manager publishes CRLs.
•
notFoundAsGood.
Sets the OCSP service to return an OCSP response of GOOD if the
certificate in question cannot be found in any of the CRLs. If this is not selected, the response is
UNKNOWN, which, when encountered by a client, results in an error message.
•
includeNextUpdate.
The Online Certificate Status Manager can include the timestamp of the
next CRL update time.
5.9. Testing the OCSP Service Setup
Test whether the Certificate Manager can service OCSP requests properly by doing the following:
1. Turn on revocation checking in the browser or client.
2. Request a certificate from the CA that has been enabled for OCSP services.
3. Approve the request.
4. Download the certificate to the browser or client.
5. Make sure the CA is trusted by the browser or client.
6. Check the status of Certificate Manager's internal OCSP service.
Open the CA agent services page, and select the
OCSP Services
link.
7. Test the independent Online Certificate Status Manager subsystem.