Registration Authority; Data Recovery Manager; Online Certificate Status Manager; Token Processing System - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

1.2.2. Registration Authority

The Registration Authority subsystem handles certain certificate issuing tasks locally, such as
generating and submitting certificate requests. This effectively makes the RA a load-balancer for the
CA; a local RA can receive and verify the legitimacy of a certificate request (authenticate it) and then
forward valid requests to the CA to issue the certificate. Certificates can also be retrieved through the
RA and the status of the request can be checked through the RA, both of which lower demand on the
CA.
The RA is normally set up outside of the firewall, and the CA is set up behind the firewall so that
requests can be submitted to Certificate System externally, while the CA is protected.
The RA accepts requests for a smaller number of certificate types than the CA, including user, server,
and router certificates.

1.2.3. Data Recovery Manager

The Data Recovery Manager (DRM) is a key recovery authority, which means it works with the
Certificate Manager when a certificate is issued and stores private encryption keys. Those private keys
can be restored (in a PKCS #12 file) if a private encryption key is lost.
NOTE
The DRM only archives encryption keys, not signing keys, because that compromises
the non-repudiation properties of signing keys. Non-repudiation means that a user cannot
deny having performed some action, such as sending signed email, because they are the
only possessor of that signing key.

1.2.4. Online Certificate Status Manager

The Online Certificate Status Manager is an OCSP service, external to the Certificate Manager.
Although the Certificate Manager is configured initially with an internal OCSP service, an external
OCSP responder allows the OCSP subsystem to be outside the firewall and accessible externally,
while keeping the Certificate Manager behind the firewall. Like the RA, the OCSP acts as a load-
balancer for requests to the Certificate Manager.
The Online Certificate Status Manager verifies the status of a certificate by checking a certificate
revocation list, published by the Certificate Manager, to see if the specified certificate has been
revoked. More than one Certificate Manager can publish CRLs to a single OCSP.

1.2.5. Token Processing System

The Token Processing System (TPS) is the conduit between the user-centered Enterprise Security
Client, which interacts with the tokens, and the Certificate System backend subsystems, such as the
Certificate Manager. The TPS is required in order to manage smart cards.
The TPS communicates with the CA and DRM for processing token operations. The TPS also
communicates with the TKS to derive token-specific secret keys.
Registration Authority
7