Configuring The Ldap Database - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

Chapter 13. Basic Subsystem Management
-
dn:cn=schema
changetype: modify
delete: objectClasses
objectClasses: ( pkiSubsystem-oid NAME 'pkiSubsystem' DESC 'CMS defined class'
SUP top STRUCTURAL MUST ( cn $ Host $ SecurePort $ SubsystemName $ Clone ) MAY
( DomainManager $ SecureAgentPort $ SecureAdminPort
defined' )
-
add: objectClasses
objectClasses: ( pkiSubsystem-oid NAME 'pkiSubsystem' DESC 'CMS defined class'
SUP top STRUCTURAL MUST ( cn $ Host $ SecurePort $ SubsystemName $ Clone ) MAY
( DomainManager $ SecureAgentPort $ SecureAdminPort $SecureEEClientAuthPort $
UnSecurePort ) X-ORIGIN 'user defined' )
^C
b. Add the new port information to the security domain entry for this subsystem.
/usr/lib/mozldap/ldapmodify -p db_port -h db_host -D "cn=Directory Manager" -
w db_password
dn: cn=hostname:admin_port,cn=CAList,ou=Security Domain,dc=basedn
changetype: modify
add: SecureEEClientAuthPort
SecureEEClientAuthPort: new_port_number
^C

13.5. Configuring the LDAP Database

The Certificate System performs certificate- and key-management functions in response to the
requests it receives. These functions include the following:
• Storing and retrieving certificate requests
• Storing and retrieving certificate records
• Storing CRLs
• Storing ACLs
• Storing privileged user and role information
• Storing and retrieving end users' encryption private key records
To fulfill these functions, the Certificate System is incorporated with a Red Hat Directory Server,
referred to as the internal database or local database. The Directory Server is referenced as part of
the Certificate System configuration; when the Certificate System subsystem is configured, a new
database is created within the Directory Server. This database is used as an embedded database
exclusively by the Certificate System instance and can be managed using directory management tools
that come with the Directory Server.
The Certificate System instance database is listed with the other Directory Server databases in the
serverRoot/slapd-DS_name/db/ directory. These databases are named by default in the format
hostname-CS_instance_ID, which is the default format given during the instance configuration. For
example, for a Certificate Manager named ca1, the database name would be host.example.com-
ca1. The database name can be anything, depending on the name given during the configuration.
312
$ UnSecurePort ) X-ORIGIN 'user