|
Posted by Harkin on September 8, 2005, 8:40 am
Please log in for more thread options > nospam@dont.send.any.spam.here.gmail.com says...
>> > nospam@dont.send.any.spam.here.gmail.com says...
>> >> So I have my offline root CA finally setup and used the CAPolicy.inf
>> >> file
>> >> to
>> >> make sure that the extensions were not included in the cert. My
>> >> understanding is that I should remove the http and ldap lines from the
>> >> extensions in the manager and just leave the local path only. A few of
>> >> the
>> >> resources that I have checked (white papers, books,etc) say that I
>> >> should
>> >> go
>> >> in and modify these paths to point to something that is reachable for
>> >> the
>> >> clients when they get a cert from my ent sub CA. Which one is it?
>> >>
>> >>
>> >>
>> > You are talking about two different settings. Let me try and explain.
>> > 1) It is recommended to not have any CDP or AIA extensions in the
>> > actual
>> > root CA certificate. This is accomplished, as you mention, by
>> > configuring the CAPolicy.inf file. This file handles the extensions
>> > included in *the* root CA certificate.
>> >
>> > 2) It is required to have CDP and AIA extensions in any certificates
>> > issued *by* the root CA. This is accomplished on the Extensions tab.
>> > When you modify these paths (using certutil -setreg), you are modifying
>> > the CDP and AIA extensions in *subordinate CA certificates*
>> >
>> > HTH,
>> > Brian
>>
>> I have everything mostly setup with the exception of one item. For the
>> CDP
>> extensions on the issued certs (for the Ent sub) from the Root CA, do I
>> want
>> to keep the server name ( <ServerShortName> ) in there or should it be
>> taken
>> out?
>>
>>
>>
> I always recommend keeping the default names for all certificate (AIA)
> and CRL (CDP) paths. The default paths include unique naming, and also
> include versioning for down the road when the certificates expire and
> are renewed either with the same key pair or with a different key pair.
>
> The defaults for certificates are %1_%3%4.crt
> The defaults for CRLs are %3%8%9.crl
>
> Brian
What I meant was in the actual LDAP string for the CDP config on the RootCA.
The string looks like this:
Ldap:///CN=<CATruncatedName><CRLNameSuffix>,CN=<ServerShortName>,CN=CDP,CN=Public
Key Services,CN=Services,<ConfigurationContainer><CDPObjectClass>
Since this machine is not part of the directory, do I leave the machine name
out or do I leave it in and then publish it using the certutil -dspublish
command? Little unclear on this one. Thanks.
| 
XML Sitemap