Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Administration Manual page 352

Chapter 14. Revocation and CRLs
• The Update Frequency section sets the different intervals when the CRLs are generated and
published to the directory.
• Every time a certificate is revoked or released from hold. This sets the Certificate
Manager to generate the CRL every time it revokes a certificate. The Certificate Manager
attempts to publish the CRL to the configured directory whenever it is generated. Publishing
a CRL can be time consuming if the CRL is large. Configuring the Certificate Manager to
publish CRLs every time a certificate is revoked may engage the server for a considerable
amount of time; during this time, the server will not be able to update the directory with any
changes it receives.
This setting is not recommended for a standard installation. This option should be selected
to test revocation immediately, such as testing whether the server publishes the CRL to a flat
file.
• Update the CRL at. This field sets a daily time when the CRL should be updated. To specify
multiple times, enter a comma-separate list of times, such as 01:50,04:55,06:55.
• Update the CRL every. This checkbox enables generating and publishing CRLs at the
interval set in the field. For example, to publish CRLs every day, select the checkbox, and
enter 1440 in this field.
• Next update grace period. If the Certificate Manager updates the CRL at a specific
frequency, the server can be configured to have a grace period to the next update time to
allow time to create the CRL and publish it. For example, if the server is configured to update
the CRL every 20 minutes with a grace period of 2 minutes, and if the CRL is updated at
16:00, the CRL is updated again at 16:18.
5. The Cache tab sets whether caching is enabled and the cache frequency.
330