Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Руководство администратора

Страница: 215 / 564

Enabling Revocation Checking for the TPS and RA
193
If the CA's internal OCSP service is used, then the certificate to use for authentication is the CA
signing certificate, which is the default value (
caCert
) the
NSSOCSPDefaultName
parameter.
To use an external OCSP Manager, set the certificate nickname to the OCSP signing certificate
nickname for the OCSP Manager; by default, this is
ocspSigningCert
NSSOCSPDefaultName ocspSigningCert
5. Add the OCSP certificate used by the OCSP service to the subsystem's
cert8.db
database.
If the CA's internal OCSP service is used, then there is no need to import a certificate, because
the CA is already trusted by both the TPS and RA.
To use an OCSP Manager, then the certificate must be imported into the TPS or RA security
database:
a. Retrieve the OCSP signing certificate from the end-entities services pages for the CA. The
OCSP signing certificate has a subject name such as
CN=OCSP Signing Certificate,
O=Example Domain
.
Save the certificate to a file like
example.cert
.
b. Import the OCSP signing certificate into the subsystem's security database.
certutil -A -n "ocspSigningCert cert-pki-ocsp" -t CTu,Cu,Cu -d /var/lib/pki-tps/alias
-a -i /tmp/example.cert
Importing certificates into the security database is described in
Section 16.5.1.2, “Installing
Certificates Using certutil”
.
c. Import the OCSP signing certificate into the subsystem's security database.
certutil -A -n "ocspSigningCert cert-pki-ocsp" -t u,u,u -d /var/lib/pki-ca/alias -a -
i /tmp/example.cert
Importing certificates into the security database is described in
Section 16.5.1.2, “Installing
Certificates Using certutil”
.
6. Configure the OCSP timeout value. The parameter determines how long the TPS waits for a
response from the OCSP responder before timing out. The default value (60 seconds) is usually
fine, but when there is spotty network performance, it is better to set a higher value to keep the
slower transactions from timing out unnecessarily.
NSSOCSPTimeout 90
If the timeout is not set, there is a default value of 60 seconds.
7. Configure how the OCSP cache is handled for the TPS. Not setting any cache parameters simply
uses the default settings. The cache parameters can be configured to enable more frequent OCSP
checks.
The TPS uses the OCSP services provided by the NSS security libraries. The idea of the OCSP
cache is to keep a record of recent responses from the OCSP server. If not too much time has