Configuring The Online Certificate Status Manager; Adding Users; Configuring Authorization - Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual

❍
❍
After configuring both the Certificate Manager and the Online Certificate Status
5.
Manager, restart both.
To verify that the CA is properly connected to the OCSP responder, see "Verify
6.
Certificate Manager and Online Certificate Status Manager Connection," on page 182.

Configuring the Online Certificate Status Manager

This section details the areas that you can configure for the Online Certificate Status
Manager and points you to specific information on configuring those sets of features.

Adding Users

Once the Online Certificate Status Manager is installed, you need to add users and assign
them to the administrator, agent, and auditor roles. See Chapter 9, "Authorization" for
details on adding users and assigning them to groups.

Configuring Authorization

Each subsystem has a set of predefined groups that are assigned a default set of privileges.
You create users in the CS database and then assign them to that group to give them the
privileges of that group. The privileges assigned to a role are controlled by Access Control
Instructions (ACIs) placed in Access Control Lists (ACLs). ACLs define points that need
specific authorization. Generally, each defines a distinct set of functionality for the server.
ACIs define what operations can or cannot be performed by a user, group, or IP address for
that particular ACL. You can change the default ACIs set up in the ACLs to change the
privileges. You can also create new groups and assign privileges to those groups by adding
ACI entries for that group in the ACLs. For complete details about creating users, assigning
users to groups, creating groups, and changing ACIs and ACLs, see Chapter 9,
"Authorization."
Identify every Certificate Manager that will publish to the OCSP Responder to the
OCSP Responder. "Identifying the CA to the OCSP Responder," on page 181 for
complete details.
You may need to configure trust settings depending on who signed the OCSP
signing certificate. See "OCSP Certificates," on page 179 for details.
Configuring the Online Certificate Status Manager
Chapter 5 OCSP Responder 177