Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Руководство администратора

Страница: 234 / 564

Chapter 8. Publishing Certificates and CRLs
212
more than one mapper set for a type of certificate. This can be useful, for example, to publish
certificates for two sets of users from different divisions of a company who are located in different
parts of the directory tree. A mapper is created for each of the groups to specify a different branch
of the tree.
For details about setting up mappers, see
Section 8.2.3.3, “Creating Mappers”
.
4. Create rules to connect publishers to mappers, as described in
Section 8.2.4, “Creating Rules”
.
8.2.3.1. Configuring the LDAP Directory
Before certificates and CRLs can be published, the Directory Server must be configured to work with
the publishing system.
1. Set up the entry for the CA. For the Certificate Manager to publish its CA certificate and CRL, the
directory must include an entry for the CA.
The Certificate Manager automatically creates an entry for the CA in the directory. This option is
set in both the CA and CRL mapper instances and enabled by default. If the directory restricts
the Certificate Manager from creating entries in the directory, turn off this option in those mapper
instances, and add an entry for the CA manually in the directory.
When adding the CA's entry to the directory, select the entry type based on the DN of the CA:
• If the CA's DN begins with the
cn
component, create a new
person
entry for the CA. Selecting
a different type of entry may not allow the
cn
component to be specified.
• If the CA's DN begins with the
ou
component, create a new
organizationalunit
entry for
the CA.
The entry does not have to be in the
certificationAuthority
object class. The Certificate
Manager will convert this entry to the
certificationAuthority
object class automatically by
publishing its CA's signing certificate.
For more information on creating directory entries, see the Red Hat Directory Server
documentation.
2. Add the correct schema elements to the CA and user directory entries.
For a Certificate Manager to publish certificates and CRLs to a directory, it must figured with
specific attributes and object classes.
Certificate Type Schema Reason
End-entity userCertificate;binary
(attribute) This is the attribute to which the Certificate
Manager publishes the certificate.
This is a multi-valued attribute, and each
value is a DER-encoded binary X.509
certificate. The LDAP object class named
inetOrgPerson
allows this attribute. The
strongAuthenticationUser
object class
allows this attribute and can be combined with
any other object class to allow certificates to
be published to directory entries with other