6.0

You can configure certificate revocation checking on a View Connection Server instance or on a security
server. When a View Connection Server instance is paired with a security server, you configure certificate
revocation checking on the security server. The CA must be accessible from the View Connection Server or
security server host.
You can configure both CRL and OCSP on the same View Connection Server instance or security server.
When you configure both types of certificate revocation checking, View attempts to use OCSP first and falls
back to CRL if OCSP fails. View does not fall back to OCSP if CRL fails.
n
Logging in with CRL Checking on page 56
When you configure CRL checking, View constructs and reads a CRL to determine the revocation
status of a user certificate.
n
Logging in with OCSP Certificate Revocation Checking on page 56
When you configure OCSP certificate revocation checking, View sends a request to an OCSP
Responder to determine the revocation status of a specific user certificate. View uses an OCSP signing
certificate to verify that the responses it receives from the OCSP Responder are genuine.
n
Configure CRL Checking on page 57
When you configure CRL checking, View reads a CRL to determine the revocation status of a smart
card user certificate.
n
Configure OCSP Certificate Revocation Checking on page 57
When you configure OCSP certificate revocation checking, View sends a verification request to an
OCSP Responder to determine the revocation status of a smart card user certificate.
n
Smart Card Certificate Revocation Checking Properties on page 58
You set values in the locked.properties file to enable and configure smart card certificate revocation
checking.
Logging in with CRL Checking
When you configure CRL checking, View constructs and reads a CRL to determine the revocation status of a
user certificate.
If a certificate is revoked and smart card authentication is optional, the Enter your user name and password
dialog box appears and the user must provide a password to authenticate. If smart card authentication is
required, the user receives an error message and is not allowed to authenticate. The same events occur if
View cannot read the CRL.
Logging in with OCSP Certificate Revocation Checking
When you configure OCSP certificate revocation checking, View sends a request to an OCSP Responder to
determine the revocation status of a specific user certificate. View uses an OCSP signing certificate to verify
that the responses it receives from the OCSP Responder are genuine.
If the user certificate is revoked and smart card authentication is optional, the Enter your user name and
password dialog box appears and the user must provide a password to authenticate. If smart card
authentication is required, the user receives an error message and is not allowed to authenticate.
View falls back to CRL checking if it does not receive a response from the OCSP Responder or if the
response is invalid.
View Administration
56 VMware, Inc.