Show TOC

Installing Certificate Revocation ListsLocate this document in the navigation structure

Use

Certificate Revocation List files (CRLs) provided by a Certification Authority (CA) identify credentials, that can no longer be trusted. CRLs prevent you from applying a digital signature that is no longer valid, and let you know when digital signatures on incoming documents are invalid. CRLs should be updated on a regular basis (for example, daily or weekly).

CRLs are identified by the CRL distribution point (CRLdp), which is specified as a URL in the certificate itself. The following values must be specified when you install the CRL:

CRL Value

Description

URL

Must match the URL found in the CRLdp field of the certificate.

Filename

The file name of the CRL.
Caution

If you do not specify a URL/file name combination, the server does not have access to CRLs so that signatures chaining off that Trusted Anchor are considered invalid. However, if the certificate does not contain a CRLdp field to identify a URL for its CRLs, revocation checking cannot be performed and the server considers the signatures as always valid.

For releases lower SAP NetWeaver 7.3 EHP1 SP 07 ADS does not support a base64 encoded format. The CRL file format must be in binary format.

Procedure

  1. Start the SAP NetWeaver Administrator via the address http://<server>:<port>/nwa .

    <server> : AS Java where the ADS are installed

    <port> : HTTP port of the AS Java

  2. Choose Start of the navigation path Configuration Next navigation step Infrastructure Next navigation step Adobe Document Services End of the navigation path.

  3. Select Certificate Revocation Lists from the Show dropdown menu and choose Manage CRL Files .

  4. Choose Add New File .

  5. Browse the CRL file and choose Upload .

  6. Select Certificate Revocation Lists from the Show dropdown menu and choose Add New Object .

  7. Specify the URL of the CRL you installed.

  8. In the CRL File field, choose the name of the CRL file, and save.

  9. Restart the Document Services Trust Manager service and the PDF Manipulation Module service for the changes to take effect.

    More information: Starting or Stopping an ADS-Relevant Service .

Force Option to update CRL

To force the CRL update, the parameter CRLInvalidationPeriod in Document Service Trust Manager has to be set. The default value of this parameter is -1 , which means that the CRL update is not forced. The measure unit is in seconds. After setting the parameter, ADS retrieves the CRL information if CRL is older than this parameter time. This is independent from the CRL attribute Next Update .

Procedure

  1. Start the Config Tool where the ADS is installed.

  2. Select the node Start of the navigation path server Next navigation step cluster data Next navigation step template Next navigation step instance Next navigation step services Next navigation step com.adobe~TrustManagerService End of the navigation path.

  3. Set the value for CRLInvalidationPeriod .

  4. Save the value.

  5. Restart the AS Java server for the changes to take effect.