이 콘텐츠는 선택한 언어로 제공되지 않습니다.
7.2. Performing a CMC Revocation
Similar to Certificate Management over CMS (CMC) enrollment, CMC revocation enables users to set up a revocation client, and sign the revocation request with either an agent certificate or a user certificate with a matching
subjectDN attribute. Then the user can send the signed request to the Certificate Manager.
Alternatively, CMC revocation can also be authenticated using the Shared Secret Token mechanism. For details, see Enabling the CMC Shared Secret Feature.
Regardless of whether a user or agent signs the request or if a Shared Secret Token is used, the Certificate Manager automatically revokes the certificate when it receives a valid revocation request.
Certificate System provides the following utilities for CMC revocation requests:
CMCRequest. For details, see Section 7.2.1, “Revoking a Certificate UsingCMCRequest”.CMCRevoke. For details, see Section 7.2.2, “Revoking a Certificate UsingCMCRevoke”.
Important
Red Hat recommends using the
CMCRequest utility to generate CMC revocation requests, because it provides more options than CMCRevoke.
7.2.1. Revoking a Certificate Using CMCRequest
To revoke a certificate using
CMCRequest:
- Create a configuration file for the CMC revocation request, such as
/home/user_name/cmc-request.cfg, with the following content:#numRequests: Total number of PKCS10 requests or CRMF requests. numRequests=1 #output: full path for the CMC request in binary format output=/home/user_name/cmc.revoke.userSigned.req #tokenname: name of token where user signing cert can be found #(default is internal) tokenname=internal #nickname: nickname for user signing certificate which will be used #to sign the CMC full request. nickname=signer_user_certificate #dbdir: directory for cert9.db, key4.db and pkcs11.txt dbdir=/home/user_name/.dogtag/nssdb/ #password: password for cert9.db which stores the user signing #certificate and keys password=myPass #format: request format, either pkcs10 or crmf. format=pkcs10 ## revocation parameters revRequest.enable=true revRequest.serial=45 revRequest.reason=unspecified revRequest.comment=user test revocation revRequest.issuer=issuer revRequest.sharedSecret=shared_secret
- Create the CMC request:
# CMCRequest /home/user_name/cmc-request.cfg
If the command succeeds, theCMCRequestutility stores the CMC request in the file specified in theoutputparameter in the request configuration file. - Create a configuration file, such as
/home/user_name/cmc-submit.cfg, which you use in a later step to submit the CMC revocation request to the CA. Add the following content to the created file:#host: host name for the http server host=>server.example.com #port: port number port=8443 #secure: true for secure connection, false for nonsecure connection secure=true #input: full path for the enrollment request, the content must be #in binary format input=/home/user_name/cmc.revoke.userSigned.req #output: full path for the response in binary format output=/home/user_name/cmc.revoke.userSigned.resp #tokenname: name of token where SSL client authentication certificate #can be found (default is internal) #This parameter will be ignored if secure=false tokenname=internal #dbdir: directory for cert9.db, key4.db and pkcs11.txt #This parameter will be ignored if secure=false dbdir=/home/user_name/.dogtag/nssdb/ #clientmode: true for client authentication, false for no client #authentication. This parameter will be ignored if secure=false clientmode=true #password: password for cert9.db #This parameter will be ignored if secure=false and clientauth=false password=password #nickname: nickname for client certificate #This parameter will be ignored if clientmode=false nickname=signer_user_certificate
Important
If the CMC revocation request is signed, set thesecureandclientmodeparameters totrueand, additionally, fill thenicknameparameter. - Depending on who signed the request, the
servletparameter in the configuration file forHttpClientmust be set accordingly:- If an agent signed the request, set:
servlet=/ca/ee/ca/profileSubmitCMCFull
- If a user signed the request, set:
servlet=/ca/ee/ca/profileSubmitSelfSignedCMCFull
- Submit the CMC request:
# HttpClient /home/user_name/cmc-submit.cfg
For further details about revoking a certificate using
CMCRequest, see the CMCRequest(1) man page.
7.2.2. Revoking a Certificate Using CMCRevoke
The CMC revocation utility,
CMCRevoke, is used to sign a revocation request with an agent's certificate. This utility simply passes the required information — certificate serial number, issuer name, and revocation reason — to identify the certificate to revoke, and then the require information to identify the CA agent performing the revocation (certificate nickname and the database with the certificate).
The reason the certificate is being revoked can be any of the following (with the number being the value passed to the
CMCRevoke utility):
0— unspecified1— the key was compromised2— the CA key was compromised3— the employee's affiliation changed4— the certificate has been superseded5— cessation of operation6— the certificate is on hold
The available tool arguments are described in detail in the Command-Line Tools Guide.
7.2.2.1. Testing CMCRevoke
- Create a CMC revocation request for an existing certificate.
CMCRevoke -d/path/to/agent-cert-db -nnickname -iissuerName -sserialName -mreason -ccomment
For example, if the directory containing the agent certificate is~jsmith/.mozilla/firefox/, the nickname of the certificate isAgentCert, and the serial number of the certificate is22, the command is as shown:CMCRevoke -d"~jsmith/.mozilla/firefox/" -n"ManagerAgentCert" -i"cn=agentAuthMgr" -s22 -m0 -c"test comment"
Note
Surround values that include spaces in quotation marks.Important
Do not have a space between the argument and its value. For example, giving a serial number of 26 is-s26, not-s 26. - Open the end-entities page.
http
s://server.example.com:8443/ca/ee/ca - Select the Revocation tab.
- Select the CMC Revoke link on the menu.
- Paste the output from the
CMCRevokeinto the text area. - Remove
-----BEGIN NEW CERTIFICATE REQUEST-----and----END NEW CERTIFICATE REQUEST-----from the pasted content. - Click .
- The returned page should confirm that correct certificate has been revoked.
