Configuring Certificate Manager to Publish to Files676 Netscape Certificate Management System Installation and Setup Guide • October 2001In the adjoining text field, type the interval, in minutes, at which the CertificateManager should publish CRLs. For example, if you want the server to publishCRLs every day, you should type 1440 in this field.with a skew of. If you configure the Certificate Manager to update the CRLautomatically every time period, the server by default adds a 5 second skew tothe next update time to allow time to create the CRL and publish it. Forexample, if you configure the server to update the CRL every 20 minutes, andif the CRL is updated at 16:00:00, the CRL will be updated again at 16:19:55.You can change the skew by editing the default value, which is specified inseconds.3. In the CRL Cache section, specify whether to enable CRL caching:Enable cache. Check this box to enable CRL caching. Leave the box uncheckedif you don’t want the server to maintain a cache.Update interval. If you enabled caching, type the interval for updating thecache.4. In the CRL Format section, specify the format for publishing the CRL:Include expired certificates. Check this box if you want the server to includerevoked certificates that have expired in the CRL.Allow extensions. Check this box if you want to allow extensions in the CRL. Ifyou enable this option, the server generates and publishes CRLs conforming toX.509 version 2 standard. If you disable this option, the server generates andpublishes CRLs conforming to X.509 version 1 standard. By default, the serverpublishes version 1 CRLs. If you enable this option, be sure to set the requiredCRL extensions as described in “Step E. Set the CRL Extensions” on page 676.Revocation list signing algorithm. Select the algorithm the server should useto sign the CRL. If the Certificate Manager’s signing key type is RSA, select MD2with RSA, MD5 with RSA, or SHA-1 with RSA. If the Certificate Manager’ssigning key type is DSA, select SHA-1 with DSA.5. To save your changes, click Save.The configuration is modified. If the changes you made require you to restartthe server, you are prompted accordingly. Don’t restart the server yet; you canrestart it after you’ve made all the required changes.Step E. Set the CRL ExtensionsComplete this step only if you configured the Certificate Manager to publishversion 2 CRLs in the previous step—that is, if you selected the “Allow extensions”option in “Step D. Specify CRL Details” on page 674.
