Federation Security Services Guide › Manage the Key Database for Signing and Encryption › Modify the Key Database Using smkeytool › Smkeytool Command Syntax and Options › addRevocationInfo Option

addRevocationInfo Option

Specifies the location of a CRL so the smkeydatabase can locate the list during the SAML authentication process. The smkeydatabase does not store the contents of a CRL, but merely reads the CRL contents when the Policy Server starts and after a refresh interval has elapsed.

Important! If you add a CRL entry to the smkeydatabase, you must restart the Policy Server.

Arguments for addRevocationInfo are as follows:

• -issueralias <issuer_alias>

  Required. Alias name of the Certificate Authority who issues the CRL.

  Example: -issueralias verisignCA

• -type (ldapcrl | filecrl)

  Required. Specifies whether the list is a certificate file or an LDAP CRL. The options are ldapcrl or filecrl.

• -location <location>

  Required. Specifies the location of the CRL. For a file, specify the full path to the file. For an LDAP CRL, specify the full path to the LDAP server node.

  Example of file location: -location c:\crls\siteminder_root_ca.crl

  Example of LDAP CRL location: -location "http://localhost:880/sn=siteminderroot, dc=crls,dc=com"