Testing Your Ocsp Setup - Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual

Testing Your OCSP Setup

Click OK.
6.
You're returned to the Revocation Store Info Management tab
Click Refresh.
7.
Testing Your OCSP Setup
To test whether the Certificate Manager can service OCSP requests properly, follow these
steps:
Turn On Revocation Checking in your browser or client.
1.
Request a certificate from the CA that has been enabled for OCSP services.
2.
Approve the request.
3.
184 Red Hat Certificate System Administrator's Guide • September 2005
port<n>. Type the nonSSL port of the LDAP directory. For example, 389.
baseDN<n>. Type the DN to start searching for the CRL. For example,
.
O=example.com
refreshInSec<n>. Type how often the connection is refreshed. The default is
86400 seconds (that is, refresh every day).
caCertAttr. Leave the default value,
attribute to which the Certificate Manager publishes its CA signing certificate.)
crlAttr. Leave the default value,
is. (It's the attribute to which the Certificate Manager publishes CRLs.)
notFoundAsGood. A certificate's status can typically be indicated by three
possible OCSP responses, namely GOOD, REVOKED, and UNKNOWN. Select
this option if you want the Online Certificate Status Manager to return an OCSP
response of GOOD if the certificate in question cannot be found in any of the
CRLs. If you deselect the option, the response will be UNKNOWN, which when
encountered by Red Hat Personal Security Manager (an OCSP-compliant client)
results in an error message.
includeNextUpdate. The Online Certificate Status Manager can include the time
stamp of next CRL update—a future update time for the CRL or the revocation
information—in the OCSP response that it sends to OCSP-compliant clients.
(According to the OCSP protocol, it is optional to include the time stamp of next
CRL update in an OCSP response.) Select this option if you want the OCSP
response to contain information about the next CRL update. Leave the option
deselected if you don't want the OCSP response to contain this information.
cACertificate;binary
certificateRevocationList;binary
, as it is. (It's the
, as it