Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора

Страница: 325 / 512

OCSP Publishing
305
14.1.6. OCSP Publishing
There are two forms of Certificate System OCSP services, an internal service for the Certificate
Manager and the Online Certificate Status Manager. The internal service checks the internal database
of the Certificate Manager to report on the status of a certificate. The internal service is not set for
publishing; it uses the certificates stored in its internal database to determine the status of a certificate.
The Online Certificate Status Manager checks CRLs sent to it by Certificate Manager. A publisher is
set for each location a CRL is sent and one rule for each type of CRL sent.
For detailed information on both OCSP services, see
Chapter 5, Online Certificate Status Protocol
Responder
.
14.1.7. How Publishing Works
When publishing is enabled, every time a certificate or a CRL is issued, updated, or revoked, the
publishing system is invoked. The certificate or CRL is evaluated by the rules to see if it matches the
type and predicate set in the rule. The type specifies if the object is a CRL, CA certificate, or any other
certificate. The predicate sets more criteria for the type of object being evaluated. For example, it can
specify user certificates, or it can specify West Coast user certificates. To use predicates, a value
needs to be entered in the predicate field of the publishing rule, and a corresponding value (although
formatted somewhat differently) needs to be contained in the certificate or certificate request to match.
The value in the certificate or certificate request may be derived from information in the certificate,
such as the type of certificate, or may be derived from a hidden value that is placed in the request
form. If no predicate is set, all certificates of that type are considered to match. For example, all CRLs
match the rule if
CRL
is set as the type.
Every rule that is matched publishes the certificate or CRL according to the method and location
specified in that rule. A given certificate or CRL can match no rules, one rule, more than one rule, or all
rules. The publishing system attempts to match every certificate and CRL issued against all rules.
When a rule is matched, the certificate or CRL is published according to the method and location
specified in the publisher associated with that rule. For example, if a rule matches all certificates
issued to users, and the rule has a publisher that publishes to a file in the location
/etc/CS/
certificates
, the certificate is published as a file to that location. If another rule matches all
certificates issued to users, and the rule has a publisher that publishes to the LDAP attribute
userCertificate;binary
attribute, the certificate is published to the directory specified when
LDAP publishing was enabled in this attribute in the user's entry.
For rules that specify to publish to a file, a new file is created when either a certificate or a CRL is
issued in the stipulated directory.
For rules that specify to publish to an LDAP directory, the certificate or CRL is published to the entry
specified in the directory, in the attribute specified. The certificate or CRL replaces any existing
certificate or CRL that is already published to this attribute.
For rules that specify to publish to an Online Certificate Status Manager, a CRL is published to this
manager. Certificates are not published to an Online Certificate Status Manager.
For LDAP publishing, the location of the user's entry needs to be determined. Mappers are used to
determine the entry to which to publish. The mappers can contain an exact DN for the entry, some
variable that associates information that can be gotten from the certificate to create the DN, or enough
information to search the directory for a unique attribute or set of attributes in the entry to ascertain the
correct DN for the entry.