Table of Contents
Advertisement
AuthInfoAccessExt Plug-in Module
If you configure a Certificate Manager to publish CRLs to an OCSP responder and
want to include the authority information access extension referencing to the
responder, you should configure an instance of this policy as follows: access
method is set to
which the OCSP responder listens to OCSP requests. This way, OCSP-compliant
applications can verify the revocation status of certificates issued by the Certificate
Manager by accessing the validation authority using the OCSP method.
During installation, Certificate Management System automatically creates an
instance of the authority information access extension policy. See
"AuthInfoAccessExt Rule" on page 141.
NOTE
Configuration Parameters of AuthInfoAccessExt
In the CMS configuration file, the
<subsystem>.Policy.impl.AuthInfoAccessExt.class=
com.netscape.certsrv.policy.AuthInfoAccessExt
or
ra
In the CMS window, the module is identified as
shows how the configurable parameters for the module are displayed in the CMS
window.
136
Netscape Certificate Management System Plug-ins Guide • October 2001
, name type is set to URI, and name value is set to the URL at
ocsp
The CMS configuration file (
jss.ocspcheck.enable
CMS manager should use Online Certificate Status Protocol (OCSP)
to verify the revocation status of the certificate it receives as a part
of SSL client or server authentication (from clients or servers it
makes connections with). If you change the value of this parameter
to
, the CMS manager reads the Authority Information Access
true
extension in the certificate and verifies the revocation status of the
certificate from the OCSP responder specified in the extension.
(prefix identifying the subsystem).
) includes a parameter named
CMS.cfg
, which enables you to specify whether a
AuthInfoAccessExt
AuthInfoAccessExt
module is identified as
, where
<subsystem>
. Figure 4-2
is
ca
Advertisement
Table of Contents
