SANtricity 11 Manuals (CA08872-010)

to Japanese version

What do I need to know about certificate revocation checking?

SANtricity System Manager allows you to check for revoked certificates by using an Online Certificate Status Protocol (OCSP) server, instead of uploading Certificate Revocation Lists (CRLs).

Revoked certificates should no longer be trusted. A certificate might be revoked for several reasons; for example, if the Certificate Authority (CA) improperly issued the certificate, a private key was compromised, or the identified entity did not adhere to policy requirements.

After you establish a connection to an OCSP server in SANtricity System Manager, the storage system performs revocation checking whenever it connects to External Key Management Server (EKMS), Lightweight Directory Access Protocol over SSL (LDAPS) server, or a Syslog server. The storage system attempts to validate these servers' certificates to ensure that they have not been revoked. The server then returns a value of "good," "revoked," or "unknown" for that certificate. If the certificate is revoked or the array cannot contact the OCSP server, the connection is refused.

Specifying an OCSP responder address in SANtricity System Manager or in the command line interface (CLI) overrides the OCSP address found in the certificate file.

Top of Page