Federation Manager Guide › Keys and Certificates for Secure Federated Communication › Certificate Revocation List Usage › Designating a CRL

Designating a CRL

You can ensure that only valid certificates are being used for federation-related PKI functions by using CRLs against which certificates can be checked.

Important! Federation Manager explicitly requests LDAP CRLs in binary transfer encoding, using the certificateRevocationList;binary LDAP attribute. This means that the CRL data must be stored in this attribute. When a Certificate Authority (CA) publishes a CRL using the LDAP protocol, it must return the CRL data in binary format, in accordance with RFC4522 and RFC4523.

For Federation Manager to use a CRL, you have to specify the CRL location.

To specify the location of a CRL

1. Select Certs and Keys, Revocation Lists (CRL).

   The list of available CRL locations is displayed.

2. Click Add.

   The Add Certificate Revocation List is displayed.

   Note: You can click Help for a description of fields, controls, and their respective requirements.

3. Specify an alias for the CRL and the location (URL) of the certificate revocation list.

   The location has to be a file path for a file CRL and an LDAP search path for an LDAP CRL.

4. Click Save.

The CRL is now added to the key database.