15.13. Module Reference

The following sections list and describe the publisher, mapper, and rule modules that are contained by default with the Certificate Manager.

15.13.1. Publisher Plug-in Modules

This section describes the publisher modules provided for the Certificate Manager. The modules are used by the Certificate Manager to enable and configure specific publisher instances.

15.13.1.1. FileBasedPublisher

The FileBasedPublisher plug-in module configures a Certificate Manager to publish certificates and CRLs to file. This mapper can publish base-64 encoded files, DER-encoded files, or both, depending on the checkboxes selected when the publisher is configured. The certificate and CRL content can be viewed by converting the files using the PrettyPrintCert and PrettyPrintCRL tools. For details on viewing the content in base-64 and DER-encoded certificates and CRLs, see Section 15.9, “Viewing Certificates and CRLs Published to File”.
By default, the Certificate Manager does not create an instance of the FileBasedPublisher module.

Table 15.4. FileBasedPublisher Configuration Parameters

Parameter Description
Publisher ID Specifies a name for the publisher, an alphanumeric string with no spaces. For example, PublishCertsToFile.
directory Specifies the complete path to the directory to which the Certificate Manager creates the files; the path can be an absolute path or can be relative to the Certificate System instance directory. For example, /export/CS/certificates.

15.13.1.2. LdapCaCertPublisher

The LdapCaCertPublisher plug-in module configures a Certificate Manager to publish or unpublish a CA certificate to the caCertificate;binary attribute of the CA's directory entry.
The module converts the object class of the CA's entry to a certificationAuthority, if it is not used already. Similarly, it also removes the certificationAuthority object class when unpublishing if the CA has no other certificates.
During installation, the Certificate Manager automatically creates an instance of the LdapCaCertPublisher module for publishing the CA certificate to the directory.

Table 15.5. LdapCaCertPublisher Configuration Parameters

Parameter Description
caCertAttr Specifies the LDAP directory attribute to publish the CA certificate. This must be caCertificate;binary.
caObjectClass Specifies the object class for the CA's entry in the directory. This must be certificationAuthority.

15.13.1.3. LdapUserCertPublisher

The LdapUserCertPublisher plug-in module configures a Certificate Manager to publish or unpublish a user certificate to the userCertificate;binary attribute of the user's directory entry.
This module is used to publish any end-entity certificate to an LDAP directory. Types of end-entity certificates include SSL client, S/MIME, SSL server, and OCSP responder.
During installation, the Certificate Manager automatically creates an instance of the LdapUserCertPublisher module for publishing end-entity certificates to the directory.

Table 15.6. LdapUserCertPublisher Configuration Parameters

Parameter Description
certAttr Specifies the directory attribute of the mapped entry to which the Certificate Manager should publish the certificate. This must be userCertificate;binary.

15.13.1.4. LdapCrlPublisher

The LdapCrlPublisher plug-in module configures a Certificate Manager to publish or unpublish the CRL to the certificateRevocationList;binary attribute of a directory entry.
During installation, the Certificate Manager automatically creates an instance of the LdapCrlPublisher module for publishing CRLs to the directory.

Table 15.7. LdapCrlPublisher Configuration Parameters

Parameter Description
crlAttr Specifies the directory attribute of the mapped entry to which the Certificate Manager should publish the CRL. This must be certificateRevocationList;binary.

15.13.1.5. LdapDeltaCrlPublisher

The LdapDeltaCrlPublisher plug-in module configures a Certificate Manager to publish or unpublish a delta CRL to the deltaRevocationList;binary attribute of a directory entry.
During installation, the Certificate Manager automatically creates an instance of the LdapDeltaCrlPublisher module for publishing CRLs to the directory.

Table 15.8. LdapDeltaCrlPublisher Configuration Parameters

Parameter Description
crlAttr Specifies the directory attribute of the mapped entry to which the Certificate Manager should publish the delta CRL. This must be deltaRevocationList;binary.

15.13.1.6. LdapCertificatePairPublisher

The LdapCertificatePairPublisher plug-in module configures a Certificate Manager to publish or unpublish a cross-signed certificate to the crossCertPair;binary attribute of the CA's directory entry.
The module also converts the object class of the CA's entry to a certificationAuthority, if it is not used already. Similarly, it also removes the certificationAuthority object class when unpublishing if the CA has no other certificates.
During installation, the Certificate Manager automatically creates an instance of the LdapCertificatePairPublisher module named LdapCrossCertPairPublisher for publishing the cross-signed certificates to the directory.

Table 15.9. LdapCertificatePairPublisher Parameters

Parameter Description
crossCertPairAttr Specifies the LDAP directory attribute to publish the CA certificate. This must be crossCertificatePair;binary.
caObjectClass Specifies the object class for the CA's entry in the directory. This must be certificationAuthority.

15.13.1.7. OCSPPublisher

The OCSPPublisher plug-in module configures a Certificate Manager to publish its CRLs to an Online Certificate Status Manager.
The Certificate Manager does not create any instances of the OCSPPublisher module at installation.

Table 15.10. OCSPPublisher Parameters

Parameter Description
host Specifies the fully qualified hostname of the Online Certificate Status Manager.
port Specifies the port number on which the Online Certificate Status Manager is listening to the Certificate Manager. This is the Online Certificate Status Manager's SSL port number.
path Specifies the path for publishing the CRL. This must be the default path, /ocsp/addCRL.