Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора

Страница: 25 / 512

CRLs
5
1.1.11. CRLs
The Certificate System can create certificate revocation lists (CRLs) from a configurable framework
which allows user-defined issuing points so a CRL can be created for each issuing point. Delta
CRLs can also be created for any issuing point that is defined. CRLs can be issued for each type of
certificate or for a specific subset of a type of certificate. The extensions used and the frequency and
intervals when CRLs are published can all be configured.
The Certificate Manager issues X.509-standard CRLs. A CRL can be automatically updated whenever
a certificate is revoked or at specified intervals. See
Chapter 13, Revocation and CRLs
for details.
1.1.12. Publishing
Certificates can be published to files and an LDAP directory, and CRLs to files, an LDAP directory, and
an OCSP responder. The publishing framework provides a robust set of tools to publish to all three
places and to set rules to define with more detail which types of certificates or CRLs are published
where. The default publishing modules can be enabled and configured, or additional publishing plug-in
modules can be created using the CS SDK. See
Chapter 14, Publishing
for details.
1.1.13. Notifications
The notification feature sets up automated messages when a particular event occurs, such as when
a certificate is issued or revoked. The notification framework comes with default modules that can be
enabled and configured, or additional notification plug-in modules can be created using the CS SDK.
See
Chapter 17, Automated Notifications
for details.
1.1.14. Jobs
The jobs feature sets up automated jobs that run at defined intervals. The default jobs can be enabled
and configured, or additional jobs plug-in modules can be created using the CS SDK. See
Chapter 18,
Automated Jobs
for details.
1.1.15. Dual Key Pairs
The Certificate System supports generating dual key pairs, separate key pairs for signing and
encrypting email messages and other data. To support separate key pairs for signing and encrypting
data, dual certificates are generated for end entities, and the encryption keys are archived. If a client
makes a certificate request for dual key pairs, the server issues two separate certificates.
1.1.16. HSMs and Crypto Accelerators
The Certificate System supports hardware security modules (HSMs) and crypto accelerators provided
by third-party vendors of PKCS #11-compliant tokens.
The server can be configured to use different PKCS #11 modules to generate and store key pairs
(and certificates) for all Certificate System subsystems � CA, DRM, OCSP, TKS, and TPS. PKCS #11
hardware devices also provide key backup and recovery features for the information stored on the
hardware token. Refer to the PKCS #11 vendor documentation for information on retrieving keys from
the tokens.