|
Data items
The data items that
CRLOptionSpec
variables
contain.
alwaysConsultLocalURL
A
boolean
value
specifies whether to use the CRL location provided as a local URI
before any specified locations within a certificate. The CRL location
provided is used for revocation checking. When this value is set
to
true
, it means the local URI is used first.
The default value of
false
indicates that locations
specified in the certificate are used before the local URI is used.
goOnline
A
boolean
value
that indicates whether to access the network to retrieve CRL information.
Accessing the network to retrieve the most recent CRL list can improve
network performance by going online only when necessary. When the value
is set to
false
, CRL information is not retrieved
online. The default value of
true
indicates that
CRL information is accessed online.
ignoreValidityDates
A
boolean
value
that indicates whether to use thisUpdate and nextUpdate times. Ignoring
the response’s thisUpdate and nextUpdate times prevents any negative
effect on response validity. The thisUpdate and nextUpdate times
are retrieved from external sources by using HTTP or LDAP and can
be different for each revocation information. A value of
true
indicates
that the validity dates are ignored. The default value of
false
indicates
that validity dates are used.
LDAPServer
A
string
value
that represents the URL or path of the Lightweight Directory Access
Protocol (LDAP) server. The LDAP server is used to retrieve information about
the certificate revocation list (CRL). For example, you can type
www.ldap.com
for
the URL or
ldap://ssl.ldap.com:200
for the path and
port. The LDAP server searches for CRL information using the distinguished name
(DN) according to the rules specified in
RFC
3280
, section 4.2.1.14.
localURI
A
string
value
that represents the URL for the local CRL store. This value is used only
if the alwaysConsultLocalURL value is set to
true
.
The default value is
null
.
requireAKI
A
boolean
value
that specifies whether an AKI extension must be present in a CRL.
An
authority key identifier (AKI)
helps to identify the next
certificate within a certificate chain. A value of
true
indicates
that the AKI extension is required. The default value of
false
indicates
that the AKI extension is not required.
revocationCheckStyle
A
RevocationCheckStyle
value
that specifies the type of revocation check that is performed when
verifying a signature in a PDF document.
Datatype specific settings
Properties for configuring the certificate revocation options.
Consult Local URI First
Select this option to use the CRL location
provided as a local URI before any specified locations within a
certificate. The CRL location provided is used for revocation checking.
When this option is selected, it means the local URI is used first.
When this option is deselected, the locations specified in the certificate
are used before the local URI is used. By default, the option is
deselected.
Local URI for CRL Lookup
Sets the URL for the local CRL store.
This value is used only if the Consult Local URI First option is
selected.
Revocation Check Style
Sets the revocation-checking style used for
verifying the trust status of the CRL provider’s certificate from
its observed revocation status. The default is BestEffort. Select
one of these values:
-
NoCheck:
-
Does not check for revocation.
-
BestEffort:
-
Checks for revocation of all certificates when possible.
-
CheckIfAvailable:
-
Checks for revocation of all certificates only when revocation
information is available.
-
AlwaysCheck:
-
Checks for revocation of all certificates.
LDAP Server
Sets the URL or path of the Lightweight Directory
Access Protocol (LDAP) server used to retrieve information about
the certificate revocation list (CRL). The LDAP server searches
for CRL information using the distinguished name (DN) according
to the rules specified in
RFC
3280
, section 4.2.1.14. For example, you can type
www.ldap.com
for
the URL or
ldap://ssl.ldap.com:200
for the path
and port.
Go Online for CRL Retrieval
Select this option to access
the network to retrieve CRL information. Accessing the network to
retrieve the most recent CRL list can improve network performance
by going online only when necessary. When this option is deselected,
CRL information is not retrieved online. By default, the option
is selected.
Ignore Validity Dates
Select this option to use thisUpdate and
nextUpdate times. Ignoring the response’s thisUpdate and nextUpdate
times prevents any negative effect on response validity. The thisUpdate
and nextUpdate times are retrieved from external sources by using
HTTP or LDAP and can be different for each revocation information.
When the option is deselected, the thisUpdate and nextUpdate time
are ignored. By default, the option deselected.
Require AKI Extension in CRL
Select this option to specify that
the Authority Key Identifier (AKI) extension must be present in
the CRL. The AKI extension can be used for CRL validation. When this
option is deselected, the presence of the AKI extension the CRL
is not required. By default, the option is deselected.
|
|
|
