Schema - Netscape MANAGEMENT SYSTEM 6.2 - ADMINISTRATOR Administrator's Manual

Configuring the Directory for LDAP Publishing

Schema

For a Certificate Manager to publish certificates and CRLs to a directory, it must be
configured with specific attributes and object classes. This section discusses those
basic schema requirements.
Required Schema for Publishing End-Entity Certificates
The Certificate Manager publishes an end entity's certificate to the
userCertificate;binary
object. This attribute is multivalued; each value is a DER encoded binary X.509
certificate. The LDAP object class named
object class is supported by Directory Server versions 1.0, 3.x, 4.x, and later. The
mix-in object class named
can be combined with any other object class to allow certificate publication to that
object. Note that the Certificate Manager does not automatically add this object
class to the schema table of the corresponding Directory Server while publishing or
unpublishing end-entity certificates. If the directory object that it finds does not
allow the
specific certificate fails.
If you have created user entries as
attribute already exists in the directory. Otherwise, you must add the
userCertificate;binary
information on modifying directory schema, check the Directory Server
documentation.
Required Schema for Publishing the CA Certificate
The Certificate Manager publishes its own CA certificate in the
caCertificate;binary
started; this is the object that corresponds to the Certificate Manager's issuer name.
This is a required attribute of the
the Certificate Manager will add this object class to the directory entry for the CA,
provided that it finds the CA's directory entry.
Required Schema for Publishing CRLs
The Certificate Manager publishes the updated CRL to the CA's directory object
under this attribute:
This attribute is an attribute of the object class
value of the attribute is the DER encoded binary X.509 certificate revocation list.
The CA's entry must already be a certificate authority.
656 Netscape Certificate Management System Administrator's Guide • June 2003
attribute within the end entity's or subject's directory
strongAuthenticationUser
userCertificate;binary
attribute to your directory's schema table. For
attribute of the CA's directory object when the server is
certificateRevocationList;binary
inetOrgPerson
attribute, the addition or removal of that
, the
inetOrgPerson
certificationAuthority
certificationAuthority
allows this attribute. This
allows this attribute and
userCertificate;binary
object class. Note that
.
. The