Manually Updating Certificates In The Directory - Red Hat CERTIFICATE SYSTEM 7.2 - ADMINISTRATION Administration Manual

Chapter 14. Publishing
• Publish certificates that were issued while the Directory Server was down. Similarly, unpublish
certificates that were revoked or that expired while Directory Server was down.
• Publish or unpublish a range of certificates based on serial numbers, from serial number xx to serial
number yy.
A Certificate Manager's publishing directory can be manually updated by a Certificate Manager agent
only.

14.10.1. Manually Updating Certificates in the Directory

The Update Directory Server form in the Certificate Manager agent services page can be used to
update the directory manually with certificate-related information. This form initiates a combination of
the following operations:
• Update the directory with certificates.
• Remove expired certificates from the directory.
Removing expired certificates from the publishing directory can be automated by scheduling an
automated job. For details, see
• Remove revoked certificates from the directory.
Manually update the directory with changes by doing the following:
1. Open the Certificate Manager agent services page.
2. Select the Update Directory Server link.
3. Select the appropriate options, and click Update Directory.
The Certificate Manager starts updating the directory with the certificate information in its internal
database. If the changes are substantial, updating the directory can take considerable time. During
this period, any changes made through the Certificate Manager, including any certificates issued
or any certificates revoked, may not be included in the update. If any certificates are issued or
revoked while the directory is updated, update the directory again to reflect those changes.
When the directory update is complete, the Certificate Manager displays a status report. If the process
is interrupted, the server logs an error message.
If the Certificate Manager is installed as a root CA, the CA signing certificate may get published using
the publishing rule set up for user certificates when using the agent interface to update the directory
with valid certificates. This may return an object class violation error or other errors in the mapper.
Selecting the appropriate serial number range to exclude the CA signing certificate can avoid this
problem. The CA signing certificate is the first certificate a root CA issues.
• Modify the default publishing rule for user certificates by changing the value of the predicate
parameter to HTTP_PARAMS.certType!=ca.
• Use the LdapCaCertPublisher publisher plug-in module to add another rule, with the predicate
parameter set to HTTP_PARAMS.certType==ca, for publishing subordinate CA certificates.
328
Chapter 18, Automated Jobs.