Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Руководство администратора

Страница: 317 / 554

CRL Distribution Points Extension Default
295
Parameter Description
path length; for example, if the issuer's path length is 4, the
path length in the subordinate CA certificate will be set to 3.
Table 13.4. Basic Constraints Extension Default Configuration Parameters
13.7.4. CRL Distribution Points Extension Default
This default attaches the CRL Distribution Points extension to the certificate. This extension identifies
locations from which an application that is validating the certificate can obtain the CRL information to
verify the revocation status of the certificate.
For general information about this extension, see
Section A.3.5, “CRLDistributionPoints”
.
The following constraints can be defined with this default:
• Extension Constraint; see
Section 13.8.3, “Extension Constraint”
.
• No Constraints; see
Section 13.8.6, “No Constraint”
.
This default defines up to five locations, with parameters for each location. The parameters are
marked with an
n
in the table to show with which location the parameter is associated.
Parameter Description
Critical Select
true
to mark this extension critical; select
false
to
mark the extension noncritical.
Type_
n
Specifies the type of CRL distribution point. The
permissible values are
DirectoryName
,
URIName
, or
RelativeToIssuer
. The type must correspond to the value
in the
Name
field.
Name_
n
Specifies the name of the CRL distribution point, the name can
be in any of the following formats:
• An X.500 directory name in the RFC 2253 syntax. The name
looks similar to the subject name in a certificate, like
cn=CA
Central, ou=Research Dept, o=Example Corporation, c=US
.
• A URIName, such as
http://testCA.example.com:80
.
• An RDN which specifies a location relative to the CRL
issuer. In this case, the value of the
Type
attribute must be
RelativeToIssuer
.
Reasons_
n
Specifies revocation reasons covered by the CRL maintained
at the distribution point. Provide a comma-separated list of the
following constants:
• unused
• keyCompromise
• cACompromise
• affiliationChanged