Reasons For Revoking A Certificate - Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual

framework, see "Setting CRL Extensions," on page 582" for more information on setting up
CRL extensions for issuing points. You can configure the Certificate Manager to generate
the CRL every time a certificate is revoked and at periodic intervals which is stored in its
internal database. If you configure the publishing feature, you can also publish the CRLs to
a file, an LDAP directory, or an OCSP responder.
Note that the Registration Manager cannot create or publish CRLs, although it can take
revocation requests and pass them on to the Certificate Manager.
A CRL is issued and digitally signed by the CA that issued the certificates listed in the
CRL. The CA may use a single key pair to sign both the certificates and CRLs it issues or
two separate key pairs, one for signing certificates and another one for signing CRLs.
By default, the Certificate Manager uses a single key pair for signing the certificates it
issues and CRLs it generates. You may choose to create another key pair for the Certificate
Manager and use it exclusively for signing the CRLs it generates. See "Getting a CRL
Signing Key Pair and Certificate," on page 104 for details on setting this up.

Reasons for Revoking a Certificate

A Certificate Manager can revoke any certificate it has issued. There are generally accepted
reason codes for revoking a certificate that are often included in the CRL. These include the
following:
= Unspecified—No particular reason is given.
0
= Key Compromised—The private key associated with the certificate has been
1
compromised in some way.
= CA Key Compromised—The private key associated with the CA that issued this
2
certificate has been compomised in some way.
= Affiliation Changed—The owner of the certificate is no longer affiliated with the issuer
3
of the certificate, and either no longer has rights to the access gained with the certificate or
no longer needs it.
= Certificate Superseded—Another certificate replaces the use of this one.
4
= Cessation of Operation—The CA that issued the certificate ceases to operate.
5
= Certificate is on Hold—The certificate is on hold pending further action. It is treated as
6
revoked, but may be taken off hold in the future.
Chapter 15 Revocation and CRLs
About CRLs
575