Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора

Страница: 323 / 512

Chapter 14.
303
Publishing
Red Hat Certificate System includes a customizable publishing framework for the Certificate Manager,
enabling certificate authorities to publish certificates, certificate revocation lists (CRLs), and other
certificate-related objects to any of the supported repositories: an LDAP-compliant directory, a flat file,
and an online validation authority. This chapter explains how to configure a Certificate Manager to
publish certificates and CRLs to a file, to a directory, and to the Online Certificate Status Manager.
14.1. About Publishing
The Certificate System is capable of publishing certificates to a file or an LDAP directory and of
publishing CRLs to a file, an LDAP directory, or to an OCSP responder.
For additional flexibility, specific types of certificates or CRLs can be published to a single format or
all three. For example, CA certificates can be published only to a directory and not to a file, and user
certificates can be published to both a file and a directory.
NOTE
An OCSP responder only provides information about CRLs; certificates are not published
to an OCSP responder.
Different publishing locations can be set for certificates files and CRL files, as well as different
publishing locations for different types of certificates files or different types of CRL files.
Similarly, different types of certificates and different types of CRLs can be published to different places
in a directory. For example, certificates for users from the West Coast division of a company can be
published in one branch of the directory, while certificates for users in the East Coast division can be
published to another branch in the directory.
Setting up publishing involves configuring publishers, mappers, and rules.
14.1.1. About Publishers
Publishers
specify the location to which certificates and CRLs are published. When publishing to a
file, publishers specify the filesystem publishing directory. When publishing to an LDAP directory,
publishers specify the attribute in the directory that stores the certificate or CRL; a mapper is used
to determine the DN of the entry. For every DN, a different formula is set for deriving that DN. The
location of the LDAP directory is specified when LDAP publishing is enabled. When publishing a CRL
to an OCSP responder, publishers specify the hostname and URI of the Online Certificate Status
Manager.
14.1.2. About Mappers
Mappers
are only used in LDAP publishing. Mappers construct the DN for an entry based on
information from the certificate or the certificate request. The server has information from the subject
name of the certificate and the certificate request and needs to know how to use this information to
create a DN for that entry. The mapper provides a formula for converting the information available
either to a DN or to some unique information that can be searched in the directory to obtain a DN for
the entry.