The three directories each contain a complete CA with server signing
certificate, OCSP signing certificate and a selection of server
-certificates under each domain.
+certificates under each domain. The "server1" certificates have
+a CRL distribution point extension; the "server2" ones instead have
+a Authority Key extension/
For each directory there are a number of subdirectories.
rest expire in 2038). The "1" and "2" systems/certs have
equivalent properties.
-In each certicate subdir: the ".db" files are NSS version of the cert,
+In each certificate subdir: the ".db" files are NSS version of the cert,
the ".pem", ".key" and ".unlocked.key" are usable by OpenSSL (the
ca_chain.pem being a copy of the CA public information and signer
public information).
is out-of-date, and "revoked" meaning the cert has been revoked.
-The files were created using the genall script which utilises a
+The files were created using the "genall" script which utilises a
combination of tools,
openssl
http://people.redhat.com/mpoole/clica/
+NOTE:
+ During running of "genall" you need to manipulate the system
+ date/time. Shutdown ntpd service before doing this, and restart
+ after.