Table of Contents
Advertisement
MFP Chain
Validation
OCSP Certificate
Validation
OCSP Chain
Validation
The configuration information needed varies according to the Domain Controller Validation
method selected. Check the box below to indicate the desired method.
□
MFP Certificate Validation
□
MFP Chain Validation
□
OCSP Certificate Validation
□
OCSP Chain Validation
If MFP Certificate Validation or OCSP Certificate Validation is chosen, the certificate of each
CA that issued each Domain Controller certificate listed in item 1 in section 3.2.2 must be
installed on the device. If MFP Chain Validation or OCSP Chain Validation is chosen, the
certificate chain for each Domain Controller listed in item 1 in section 3.2.2 must be installed on
the device.
Each certificate needs to be in PEM (Base64) format; see section 7.5, Domain Controller
Certificates, for more information on generating the certificate file.
Certificate / Certificate Chain: Please have file ready at install time.
If one of the OCSP validation options is selected, the following information is needed about the
OCSP Responder/Repeater to be used.
Version 2.0.0
PKI Pre-Installation Guide
The PKI Authentication Application gets the certificate contained in
the Domain Controller's response to build the complete certificate
chain to a trusted Root CA. All certificates in this chain must have
been previously installed on the MFP. If the chain can be successfully
built, the response is considered trusted and the logon proceeds. If the
chain cannot be built, the logon will fail.
The PKI Authentication Application gets the certificate contained in
the Domain Controller's response and performs the same validation as
in the MFP Certificate Validation mode. If that succeeds, it then uses
an OCSP Responder/Repeater (such as Tumbleweed) to validate the
Domain Controller certificate has not been revoked or otherwise
marked as invalid. If that succeeds, the logon proceeds; otherwise, it
fails.
The PKI Authentication Application gets the certificate contained in
the Domain Controller's response and performs the same validation as
in the MFP Chain Validation mode. If that succeeds, it then uses an
OCSP Responder/Repeater (such as Tumbleweed) to validate that none
of the certificates in the certificate chain have been revoked or
otherwise marked as invalid. If that succeeds for each certificate in the
chain, the logon proceeds; otherwise, it fails.
Page 12
Advertisement
Table of Contents
