Validation

Certificate validation

When you validate a certificate, Digital Certificate Manager (DCM) verifies a number of items pertaining to the certificate to ensure the authenticity and validity of the certificate. Validating a certificate ensures that applications that use the certificate for secure communications or for signing objects are unlikely to encounter problems when using the certificate.

As part of the validation process, DCM checks that the selected certificate is not expired. DCM also checks that the certificate is not listed in a Certificate Revocation List (CRL) as revoked, if a CRL location exists for the CA that issued the certificate.

If you configure Lightweight Directory Access Protocol (LDAP) mapping to use a CRL, DCM checks the CRL when validating the certificate to make sure the certificate is not listed in the CRL. However, for the validation process to accurately check the CRL, the directory server (LDAP server) configured for LDAP mapping must contain the appropriate CRL. Otherwise, the certificate will not validate correctly. You must provide a binding DN and password to avoid having a certificate validate with a revoked status. Also, if you do not specify a DN and password when you configure LDAP mapping you will be binding anonymously to the LDAP server. An anonymous bind to an LDAP server does not provide the level of authority needed to access "critical” attributes, and the CRL is a “critical” attribute. In such a case, DCM may validate a certificate with a revoked status because DCM is unable to obtain the correct status from the CRL. If you want to access the LDAP server anonymously, you need to use the Directory Server Web Administration Tool and select the "Manage schema" task to change the security class (also referred to as "access class") of the certificateRevocationList and authorityRevocationList attributes from "critical" to "normal".

DCM also checks that the CA certificate for the issuing CA is in the current certificate store and that the CA certificate is marked as trusted. If the certificate has a private key (for example, server and client or object signing certificates), then DCM also validates the public-private key pair to ensure that the public-private key pair match. In other words, DCM performs a pubic key operation on data and ensures that the data can be recovered using a private key operation.

Application validation

When you validate an application, Digital Certificate Manager (DCM) verifies that there is a certificate assignment for the application and ensures that the assigned certificate is valid. Additionally, DCM ensures that if the application is configured to use a Certificate Authority (CA) trust list, that the trust list contains at least one CA certificate. DCM then verifies that the CA certificates in the application CA trust list are valid. Also, if the application definition specifies that Certificate Revocation List (CRL) processing occur and there is a defined CRL location for the CA, DCM checks the CRL as part of the validation process.

Validating an application can help alert you to potential problems that an application might have when it is performing a function that requires certificates. Such problems might prevent an application either from participating successfully in a Secure Sockets Layer (SSL) session or from signing objects successfully.