Generate the Management, Postgres, Syslog or the SPIRIT identity certificates or all with the following X509v3 extensions and attributes:
Attributes |
Value |
Required |
Subject |
CN={session-manager-fqdn} |
Required |
Validity |
validity period |
Required |
Authority Key Identifier |
hash |
Required |
Subject Key Identifier |
hash |
Recommended |
Key Usage |
digitalSignature nonrepudiation keyEncipherment dataEncipherment keyAgreement |
Required Required Required Required Required |
Extended Key Usage |
id-kp-serverAuth = 1.3.6.1.5.5.7.3.3.1 id-kp-clientAuth = 1.3.6.1.5.5.7.3.3.2 |
Required Required |
Authority Information Access |
OCSP - URI:http://{ocsp-server}{:ocsp-port}{/ocsp-path} |
Optional |
CRL Distribution Points |
URI:http://{crl-server}{:crl-port}{/crl-path} URI:ldap://{crl-server}{:crl-port}{/crl-dn} |
Recommended Recommended |
Authority Key Identifiers are required elements in end entity certificates to accurately establish the trust chain. The URLs and DNs used to identify the location of CRLs in LDAP directories are complex. Therefore, entities configuring or consuming them must handle characters as defined by the LDAP URI specification in RFC 4516.
