1

I need to store a Certificate Revocation List in LDAP server (OpenDJ). I have used ldapmodify command to store a certificate in the LDAP server by adding entries to LDIF files. However, I am not really sure how to go about adding a revocation list in the LDAP server.

Any examples using LDIF would be really appreciated.

1
  • 2
    Well you're going to add it to either a new entry or an existing entry of type certificationAuthority, cRLDistributionPoint, or pkiCA, and you're going to add it to a certificateRevocationList attribute.
    – user207421
    Jul 22, 2015 at 2:08

1 Answer 1

2

As EJP pointed out, there is a standard schema for CRL.
Just one thing, LDAP doesn't have a specific syntax for CRLs or Certificates.
The CRL needs to be treated as an opaque blob and you will need to use the ;binary transfer option when creating, updating or retrieving the attribute.
In LDIF, it's as simple as:
certificateRevocationList;binary:: BASE64_Encoding of CRL

2
  • I should add that OpenDJ delivers the schema for CRLs by default. Jul 22, 2015 at 8:41
  • Thanks, that makes sense!
    – sunsin1985
    Jul 23, 2015 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.