Online Certificate Status Manager; Deployment Scenarios; Single Certificate Manager - Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual

Deployment Scenarios

Key Archival
If you have set up a Data Recovery Manager as part of your PKI, the private encryption key
for an end-entity is requested and stored when the enrollment request is made.
Key Retrieval
If you have set up a Data Recovery Manager up as part of your PKI, you can retrieve the
private encryption keys of your users to decrypt messages or other documents that have
been encrypted with the private encryption key. CS provides a key retrieval system that can
only be activated by several agents approving the key retrieval at the same time to offer
maximum security of the stored keys.
See Chapter 6, "Data Recovery Manager" for complete details.

Online Certificate Status Manager

The Online Certificate Status Manager is an optional subsystem of CS that can act as a
stand-alone OCSP service. The Certificate Manager is configured with an internal OCSP
service. An external OCSP Responder is offered as a separate subsystem in case you want
the OCSP service provided outside a firewall while the Certificate Manager resides inside a
firewall, or to take the load of requests off the Certificate Manager.
The Online Certificate Status Manager performs the task of an online certificate validation
authority, by enabling OCSP-compliant clients to do real-time verification of certificates.
Note that an online certificate-validation authority is often referred to as an OCSP
responder. The Online Certificate Status Manager can receive CRLs from multiple
Certificate Managers and clients can query the Online Certificate Status Manager for the
revocation status of certificates issued by all these Certificate Managers.
When an OCSP Responder is set up with a Certificate Manager, and publishing is set up to
the OCSP responder, CRLs are published to it when they are issued or updated.
Deployment Scenarios

Single Certificate Manager

Some deployments may require only a single Certificate Manager that handles all
end-entity interactions and provides no key archival and recovery capabilities. This
Certificate Manager can use a signing certificate issued by a public certificate authority or
its own self-signed CA signing certificate to sign all the certificates it issues.
48 Red Hat Certificate System Administrator's Guide • September 2005