Release Notes › Policy Server Release Notes › Changes to Existing Features › Certificate Revocation List Checking

Certificate Revocation List Checking

In previous versions, if the Policy Server was configured to use the CRL Distribution Point (CDP) to locate a certificate revocation list (CRL), the only supported URL type was LDAP.

If the Policy Server is configured to use the CDP, the following URL types are now supported:

• LDAP
• HTTP
• HTTPS

  Note: The HTTP and HTTPS URL types are only supported for distribution points in certificates.

If an HTTPS distribution point is used, be sure that a valid CA public certificate or certificate bundle file is present in policy_server_home/config or the connection to the HTTPS server fails.

• policy_server_home

  Specifies the Policy Server installation path.

Additionally, the certificate or certificate bundle must:

• Be in pem format (base64 encoded). A certificate in a different format can be converted to the pem format using the OpenSSL command–line utility.

  Note: For more information about the OpenSSL utility, see the OpenSSL documentation.

• Be named cert.pem.
• Contain the CA root certificate for each distribution point.

Note: For more information about configuring CRL checking, see the Policy Server Configuration Guide, the Programming Guide for C, or the Programming Guide for Perl.

STAR Issue: 17289899-2