Setting Up the Issuance of CRLsChapter 14 Revocation and CRLs 6058. You need to configure this new issuing point, and set up any CRL extensionsthat will be used in this CRL. See “Configuring CRLs for Each Issuing Point,”on page 605 for details on configuring an issuing point. See “Setting CRLExtensions,” on page 607 for details on setting up the CRL extensions.Configuring CRLs for Each Issuing PointYou can specify information, such as the generation interval, the CRL version(whether to include CRL extensions), and the signing algorithm the CertificateManager should use for signing the CRL object for each CRL defined by an issuingpoint. You need to configure the CRLs for each issuing point you set up.To configure CRLs for an issuing point:1. In the navigation tree, select Certificate Manager, and then select CRL IssuingPoints.2. Select the Issuing Point by selecting its name below the Issuing Points entry.3. Configure the CRL for this issuing point by specifying the fields in theRevocation List tab for that issuing point.You may want to expand the CMS console window by dragging at one of thecorners, some fields in this window do not appear large enough to read thecontent.In the Update Frequency section, specify the interval for publishing the CRL tothe directory:Every time a certificate is revoked, or taken off-hold. Select this option if youwant the Certificate Manager to generate the CRL every time it revokes acertificate. Keep in mind that the Certificate Manager attempts to publish theCRL to the configured directory whenever it is generated, in this case, everytime a certificate is revoked. Publishing a CRL can be time consuming if theCRL is large. Configuring the Certificate Manager to publish CRLs every time acertificate is revoked may engage the server for a considerable amount of time;during this time, the server will not be able to update the directory with anychanges it receives.(This setting is not recommended for a standard installation. You can select thisoption if you want to see the results of revocation immediately, for example,when testing whether the server publishes the CRL to a flat file.)Update at this frequency. Select this option if you want the CertificateManager to generate CRLs at regular intervals. In this case, the serverpublishes the CRL to the configured directory at the interval you specify.
