User's Manual

Certificate Validation with Certificate Revocation Lists

Conﬁguring Secure Sockets Layer Authentication 7-35

does not give the complete chain and you do not have the appropriate trust

points to complete it.

Action: Use Oracle Wallet Manager to install the trust points that are required

to complete the chain. See "Importing a Trusted Certiﬁcate" on page 8-25

Certiﬁcate Validation with Certiﬁcate Revocation Lists

The process of determining whether a given certiﬁcate can be used in a given

context is referred to as certiﬁcate validation. Certiﬁcate validation includes

determining that

■ A trusted certiﬁcate authority (CA) has digitally signed the certiﬁcate

■ The certiﬁcate's digital signature corresponds to the independently-calculated

hash value of the certiﬁcate itself and the certiﬁcate signer's (CA's) public key

■ The certiﬁcate has not expired

■ The certiﬁcate has not been revoked

The SSL network layer automatically performs the ﬁrst three validation checks, but

you must conﬁgure certiﬁcate revocation list (CRL) checking to ensure that

certiﬁcates have not been revoked. CRLs are signed data structures that contain a

list of revoked certiﬁcates. They are usually issued and signed by the same entity

who issued the original certiﬁcate. (See certiﬁcate revocation lists)

This section contains the following topics:

■ What CRLs Should You Use?

■ How CRL Checking Works

■ Conﬁguring Certiﬁcate Validation with Certiﬁcate Revocation Lists

■ Certiﬁcate Revocation List Management

■ Troubleshooting Certiﬁcate Validation

What CRLs Should You Use?

You should have CRLs for all of the trust points that you honor. The trust points are

the trusted certiﬁcates from a third party identity that is qualiﬁed with a level of

trust. Typically, the certiﬁcate authorities you trust are called trust points.