Chapter 19 Publishing CRLs

Server and client applications that use public-key certificates as tokens of identification need access to information about the validity of a certificate; they need to know whether the certificate has been revoked. One of the standard, secure mechanisms for conveying this information is by publishing a list of revoked certificates. This list is known as the Certificate Revocation List (CRL).

• CRL Authorities
• CRL Issuing Points
• Reasons for Revoking a Certificate
• Updating CRLs Automatically
• Updating CRLs Manually

• The owner of the certificate has changed status and no longer has the right to use the certificate.
• The private key of a certificate owner has been compromised.
• The certificate owner doesn't want to use the certificate.
• The private key of the CA that issued the certificate has been compromised.

• By default, the server generates the CRL whenever a certificate is revoked. Because CRLs are published whenever they are generated, the server attempts to publish the CRL to the publishing directory every time it revokes a certificate. You can configure the server to generate the CRL at a regular interval instead, say every day or week, and thus change the publishing interval.
• The server publishes the CRL to the CA's entry in the directory, replacing the old CRL with the new one; the old CRL is not saved. For details about the CA's entry, see "Required Schema for Publishing CRLs".
• The server can generate and publish CRLs conforming to either X.509 version 1 or version 2 standards; you can configure it for either one by enabling or disabling the CRL extension-specific options in the server's configuration. The default configuration is to publish version 1 CRLs.
• The server supports some CRL extensions. These are listed in Table 19.1.

You can configure the Certificate Manager to publish CRLs to an LDAP-compliant directory currently configured for publishing end-entity certificates; see "Identifying a Certificate Manager's Publishing Directory"). The Certificate Manager publishes the CRL to the specified directory using the base DN and password you specified. To locate the CA's entry in the directory, the server uses the configuration specified for publishing the CA certificate; see "Configuring Mapper and Publisher Classes for the CA Certificate".

1. Access the CMS window (see "Accessing the CMS Window").
2. Click the Configuration tab.
3. In the navigation tree, click Certificate Manager.

The General Settings tab appears.



4. Click the Revocation List tab.
5. In the Update Frequency section, specify the interval for publishing the CRL to the directory:

Every time a certificate is revoked. Select this option if you want the Certificate Manager to generate the CRL every time it revokes a certificate. Keep in mind that the server attempts to publish the CRL to the configured directory whenever it is generated, in this case, every time a certificate is revoked. Publishing a CRL can be time consuming if the CRL is large. Configuring the Certificate Manager to publish CRLs every time a certificate is revoked may engage the server for a considerable amount of time; during this time, the server will not be able to service any requests it receives or update the directory with any changes it receives.

Update at this frequency. Select this option if you want the Certificate Manager to generate the CRL at regular intervals. In this case, the server publishes the CRL to the configured directory at configured intervals.

In the adjoining text field, type the interval, in minutes, at which the Certificate Manager should publish CRLs. For example, if you want the server to publish CRLs every day, you should type 1440 (minutes) in this field.

6. In the CRL Format section, specify the format for publishing the CRL:

Include expired certificates. Check this box if you want the server to publish expired certificates to the publishing directory.

Allow extensions. Check this box if you want to allow extensions in CRLs. If you enable this option, the server generates and publishes CRLs conforming to X.509 version 2 standard. If you disable this option, the server generates and publishes CRLs conforming to X.509 version 1 standard. By default, the server publishes version 1 CRLs.

Revocation list digest algorithm. Select the algorithm the server should use to sign the CRL for publishing. Available choices are MD2 with RSA, MD5 with RSA, SHA1 with RSA, and SHA1 with DSA.

7. To save your changes, click Save.

The CMS configuration is modified. If the changes you made require you to restart the server, you will be prompted accordingly. In that case, restart the server.

1. Go to the Certificate Manager Agent Services page. You must submit the proper client certificate to get access to this page.
2. Click Update Revocation List.

The Update Certificate Revocation List page appears.

3. From the Signature algorithm drop-down list, select the appropriate signature algorithm. Choices available are: MD5 with RSA Encryption and SHA-1 with RSA Encryption.
4. Click Update.

The Certificate Manager starts updating the directory with the CRL in its internal database. In some circumstances, for example, if the CRL is large, updating the directory may take considerable time. During this period, any changes made through Certificate Management System (for example, any new certificates issued or any certificates revoked) may not be included in the update. If you have issued or revoked any certificates during that time, you need to update the directory with those changes.

When the directory is updated, the Certificate Manager will display a status report. If the process gets interrupted for some reason, the subsystem logs an appropriate error message. Be sure to check logs if that happens; see "Monitoring Logs".