Cmc Revocation; Setting Up Cmc Revocation - Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Administration Manual

Chapter 14. Revocation and CRLs
To change the form appearance to suit an organization's requirements, edit the
UserRevocation.html, the form that allows SSL client authenticated revocation of client or
personal certificates. The file is the in /var/lib/instance_ID/webapps/subsystem_type/
ee/subsystem_type directory.

14.2. CMC Revocation

CMC revocation allows users to set up a revocation client, sign the revocation request with an agent
certificate, and then send the signed request to the Certificate Manager. When this method is used,
the Certificate Manager automatically issues certificates when a valid certificate request signed with
the agent's certificate is received and automatically revokes a certificate when a valid revocation
request signed with the agent's certificate is received.

14.2.1. Setting up CMC Revocation

To use CMC to revoke certificates, do the following:
• Set up an instance of the CMCAuth Authentication plug-in module. An instance is enabled and
configured by default.
• Use the agent certificate to sign revocation requests.
14.2.1.1. revoker Utility
The CMC revocation utility, revoker, is used to sign a revocation request with an agent's certificate.
This utility has the following syntax:
revoker -d /instance/alias/ -n cert_nickname -i issuerName -s serialName
-m reason -c comment
-d is the directory where the cert8.db, key3.db, and secmod.db databases containing the agent
certificate are located. -n is the nickname of the agent's certificate. -i is the issuer name of the
certificate being revoked. -s is the serial number of the certificate being revoked in decimal value. -m
is the reason the certificate is being revoked, which can be any of the following:
• 0 , unspecified
• 1 , the key was compromised
• 2 , the CA key was compromised
• 3 , the employee's affiliation changed
• 4 , the certificate has been superseded
• 5 , cessation of operation
• 6 , the certificate is on hold
-c adds comments about the request.
322