Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Руководство администратора

Страница: 501 / 554

Extensions for CRLs
479
A.5.1.6. issuingDistributionPoint
A.5.1.6.1. OID
2.5.29.28
A.5.1.6.2. Criticality
PKIX requires that this extension be critical if it exists.
A.5.1.6.3. Discussion
The Issuing Distribution Point CRL extension identifies the CRL distribution point for a particular CRL
and indicates what kinds of revocation it covers, such as revocation of end-entity certificates only, CA
certificates only, or revoked certificates that have a limited set of reason codes.
PKIX Part I does not require this extension.
A.5.1.6.4. Parameters
Parameter Description
enable
Sets whether the extension is enabled; the default is disabled.
critical
Marks the extension as critical, the default, or noncritical.
pointType
Specifies the type of the issuing distribution point from the
following:
•
directoryName
specifies that the type is an X.500
directory name.
•
URIName
specifies that the type is a uniform resource
indicator.
pointName
Gives the name of the issuing distribution point. The name of
the distribution point depends on the value specified for the
pointType
parameter.
• For
directoryName
, the name must be an X.500
name. For example,
cn=CRLCentral,ou=Research
Dept,o=Example Corporation,c=US
• For
URIName
, the name must be a URI that is an absolute
pathname and specifies the host. For example,
http://
testCA.example.com/get/crls/here/
.
NOTE
The CRL may be stored in the directory entry
corresponding to the CRL issuing point, which may
be different than the directory entry of the CA.
onlySomeReasons
Specifies the reason codes associated with the distribution
point.