|
Digital Certificates identify communication entities in a Public Key Infrastructure (PKI). Certificate Authorities (CAs) issue certificates with a validity period. During validation, communicating entities ensure the certificate has not expired and also check the revocation status of the certificate. At times, the issuing CA might want to revoke the certificate before it expires. For example, when an employee leaves the company, the CA must revoke the certificates issued to that employee to avoid misuse. Session Manager 7.1 uses the Certification Revocation List (CRL) method for checking certificate revocation.
CRLs contain a list of serial numbers for certificates that are revoked. Entities with a revoked certificate must no longer be trusted. To revoke a certificate:
The Certificate Authority (CA) administrator can log on to a CA and revoke the certificate.
The CA publishes the CRL to an HTTP or LDAP repository referenced in the CRL Distribution Point (CDP) extension of a certificate.
Session Manager performs the required certificate revocation checks based on the global Certificate Revocation Check policy that is configured on System Manager.
If Certificate Revocation Checking is enabled, every certificate exchanged while establishing a TLS connection is verified against a CRL. Before using a CRL, Session Manager verifies the validity of CA’s digital signature in a CRL.
System Manager provides the ability to periodically download CRLs in advance to make them available before a TLS connection is attempted. If a CRL is not previously downloaded, the system might attempt to download the CRL when trying to establish a TLS connection. In that case, the system attempts to download the CRLs from the URI specified in the certificate’s CRL Distribution Point (CDP) extension. Multiple CDP locations may be included in the CDP extension. If multiple CDP locations are specified, an attempt is made to download a CRL from the first location, followed by the next location, and so on, until the system either downloads a CRL or times out.