By default Safeguard Authentication Services for Smart Cards retrieves any CRLs that are required to verify the certificates presented by Active Directory and automatically updates these as they expire and new certificates are issued. To be able to retrieve CRLs, the certificates to which they correspond must contain a CRL distribution points extension that contains an LDAP URI from which to download the CRL.
CRLs are stored in the /var/opt/quest/vas/crls directory.
Safeguard Authentication Services provides a number of vas.conf options for configuring bootstrapping behavior.
| Option | Function |
|---|---|
| auto-crl-download | Whether to automatically download CRLs as needed. |
| auto-crl-removal | Whether to remove out-of-date CRLs from the cache automatically. |
| bootstrap-trusted-certificate | Whether trusted certificates should be automatically retrieved from Active Directory. |
| trusted-certs-update-interval | How often trusted certs and CRL should be updated (default 8 hours). |
| auto-crl-download-bind-type | How to bind to the LDAP directory when retrieving CRLs. |
By default certificates and CRLs are updated if the trusted-certs-update-interval has expired, and then only during the login process. You can request an update of the trusted certificates directory manually by using the vastool smartcard trusted-certs command, as follows:
vastool smartcard trusted-certs update
Note: You can schedule an update during off hours using a cron job.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Conditions d’utilisation Confidentialité Cookie Preference Center
