Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Installation and operating instructions

1
Red Hat Certificate
System 8.0
Using End User Services
Ella Deon Lackey
Copyright © 2009 Red Hat, Inc.
Copyright © 2009 Red Hat, Inc.. This material may only be distributed subject to the
terms and conditions set forth in the Open Publication License, V1.0 or later (the latest
version of the OPL is presently available at http://www.opencontent.org/openpub/).
Red Hat and the Red Hat "Shadow Man" logo are registered trademarks of Red Hat,
Inc. in the United States and other countries.
All other trademarks referenced herein are the property of their respective owners.
1801 Varsity Drive
Raleigh, NC 27606-2072 USA
Phone: [phone]
Phone: [phone]
Fax: [phone]
PO Box 13588 Research Triangle Park, NC 27709 USA
July 22, 2009
Abstract
This guide contains easy to follow information for end users who use Red Hat
Certificate System certificate authority and registration authority services to generate
or submit certificate requests, check on request status, receive certificates, and
revoke certificates.
1. A Look at End User Services in Red Hat Certificate System ...................................................... 2
1.1. About Certificates and Cryptography ............................................................................. 2
1.2. About CA Services ....................................................................................................... 5
1.3. About RA Services ....................................................................................................... 8
1.4. Supported Web Browsers ............................................................................................. 8
1.5. Supported Charactersets .............................................................................................. 9
1.6. Configuring Internet Explorer to Enroll Certificates .......................................................... 9
2. Getting and Managing Certificates through CA Services .......................................................... 10
2.1. Opening the CA Services Page ................................................................................... 10
2.2. Generating Certificate Requests .................................................................................. 11
2.3. Requesting Certificates ............................................................................................... 12

Using End User Services
2
2.4. Checking on Your Request Status ............................................................................... 15
2.5. Retrieving Your Certificates ......................................................................................... 16
2.6. Listing and Searching for Certificates .......................................................................... 18
2.7. Renewing Certificates ................................................................................................. 23
2.8. Revoking Certificates .................................................................................................. 27
2.9. Downloading CA Certificates and Certificate Chains ..................................................... 31
3. Getting and Managing Certificates through RA Services .......................................................... 32
3.1. Opening the RA Services Page ................................................................................... 32
3.2. Requesting Certificates ............................................................................................... 33
3.3. Checking on Your Request Status ............................................................................... 41
3.4. Retrieving and Importing Certificates ........................................................................... 42
3.5. Renewing User Certificates ......................................................................................... 44
4. Additional Reading ................................................................................................................ 46
5. Giving Feedback ................................................................................................................... 47
6. Revision History .................................................................................................................... 48
1. A Look at End User Services in Red Hat Certificate
System
Red Hat Certificate System provides a simple way for people to obtain certificates that they need to
protect common Internet-based actions, like sending email, logging into a computer, or accessing
a protected website. Any user can access Certificate System's web-based certificate management
interface to request or receive a certificate.
1.1. About Certificates and Cryptography
Red Hat Certificate System provides a way for a company or group to create and manage certificates
locally.
A certificate is a file which proves the identity of a person, server, router, website, or other entity.
Certificates can also be used to encrypt and decrypt information; this is a vital function which protects
sensitive communication — from online shopping to email — by safely encoding the traffic using
mathematical algorithms to create a cipher.
A certificate is part of an overall strategy for secure (encrypted) communication. Some web protocols
such as Secure Sockets Layer (SSL) and Transport Layer Security (TLS) use encryption to secure
Internet communications, as do VPNs, some intranets, email, and web browsers.
Secure communications are built around an SSL handshake. An SSL handshake is when a server
reaches out to a client (user) with some proof of its identity, such as a certificate; this is server
authentication. The client can then accept that certificate to continue with the connection. The server
may require some proof back from the user to verify his identity; this is client authentication. After the
server and client are shown to be authentic, then they can continue with their transactions.
The transactions are encoded using agreed upon methods, called ciphers. The cipher is used
in conjunction with a special number, called a key, to encrypt and decrypt the data being sent. A
certificate, along with identifying the user and the authority which issued it, defines what kind of
ciphers it supports and the public key for encrypting information.
There are a number of different ways that the information can be encrypted for safe sending and then
decrypted for safe reading: asymmetric keys, symmetric keys, and shared keys. A key, in broad terms,
is combined with a mathematical algorithm to scramble data; if someone knows the matching key, then
they can use it to unscramble the data. A key, then, locks and unlocks data. A public key is known to

About Certificates and Cryptography
3
both groups in a secure connection, while a private key is held by one group. The public key encrypts
data; the private key is used to decrypt it.
A certificate is created out of several pieces of information:
• The identity of the entity (such as its name)
• A public key
• The name and digital signature of the certificate authority which issued the certificate
• The day that the certificate expires (called the validity period)
• A serial number
This information creates a fingerprint for the certificate.
Figure 1. Certificate Fingerprint
Some clients may require additional information, such as the issuing authority's certificate (CA
certificate). The CA certificate verifies the server which issued the user's certificate and provides some

Using End User Services
4
key information. Sometimes, a series of authorities issues certificates; Server 1 issues a certificate
to Server 2 which issues a certificate to Server 3. All of those successive CA certificates can be
downloaded and installed together; that's a certificate chain.
A certificate is issued or enrolled by a certificate authority (CA). (In Red Hat Certificate System, the CA
is performed by a system called the Certificate Manager.)
Figure 2. The Process for Issuing a Certificate
1. A user first generates a certificate request by supplying certain information.
2. This request is then given to the CA, and the CA validates that it is a legitimate request. This can
happen in different ways: a real person may review it, it could be guaranteed automatically, or it
could require that the user supply some other kind of credentials, such as login information for a
local directory or an existing certificate.
3. Assuming that the request is approved, the certificate is generated. A Certificate System
Certificate Manager uses certificate profiles to define the settings for a certificate. The profiles,
to users, are simple forms available through the CA services pages. In the Certificate Manager
server, these profiles define all kinds of information about the certificate, such as how long the
certificate is valid, what kind of ciphers it allows, what kind of certificate it is and how it can be
used, and limits set on the certificate information.
The information in the certificate request must match the requirements in the certificate profile;
otherwise, the certificate is rejected by the Certificate Manager.
4. If the certificate request conforms to the profile, then the Certificate Manager signals the browser
to generate the public/private key pair.
5. After generating the keys, the Certificate Manager generates the certificate.
6. The user retrieves the new certificate. This varies depending on how the local Red Hat Certificate
System is setup; the user may receive an email notification or the certificate could be immediately
available through the Certificate Manager services page. The certificate can always be retrieved
by searching the request ID and following the status link.
7. The certificate can be imported into a web browser, email program, site, server, router, or other
client (depending on the type of certificate) and it's ready for use.

About CA Services
5
After the certificate is created, it is valid for a certain amount of time, until the expiration date. Some
types of certificates can be renewed, which creates a new certificate using the same key pair, but with
a new expiration date and serial nu,ber. The renewed certificate is functionally identical to the original
certificate.
Alternatively, there can be a reason to invalidate a certificate before its expiration date, maybe
because it was compromised or because of a change in the user's situation. In that case, the
certificate can be revoked before its expiration date. When a certificate is revoked, the Certificate
Manager adds it to a list of revoked certificates called a certificate revocation list (CRL). When a
certificate is validated during authentication, the server checks its validity date (to make sure its
current) and its revocation status (by checking the CRL published by the CA).
1.2. About CA Services
A certificate authority (CA) is a trusted entity that issues certificates, verifies the certificate validity,
renews certificates, and publishes certificate revocation lists (CRLs). The CA performs all certificate
management functions. In Red Hat Certificate System, the CA is called the Certificate Manager.
The Certificate Manager's web services pages offer a number of different services for users:
• Submit requests for a large number of different certificate types through different certificate
enrollment forms (listed in Table 1, “Available Certificate Profiles”)
• Check the status of certificate requests
• List all submitted certificate requests
• Perform basic and advanced searches of certificate requests, issued certificates, CRLs, and expired
certificates
• Retrieve and import issued certificates
• Search CRLs for revoked certificates
• Download, import, or view CRLs
• Download, import, or view CA certificates and CA certificate chains
The Certificate Manager's end user web services offer a large number of default certificate submission
forms (called certificate enrollment forms or certificate profiles). These forms allow you to submit new
certificate requests to the CA. Along with the default profiles in Table 1, “Available Certificate Profiles”,
custom profiles can also be created that are specific for your group.
The Certificate Manager web services have a very flexible search feature to list and search all
certificate requests. The CA web services also allow you to import CA certificates and CA chains,
revoke certificates and check certificate revocation status, and import CRLs.
Profile Name Description
Security Domain Administrator Certificate
Enrollment
Enrolls Security Domain Administrator's certificates
with LDAP authentication against the internal LDAP
database.
Agent-Authenticated File Signing This certificate profile is for file signing with agent
authentication.

Using End User Services
6
Profile Name Description
Agent-Authenticated Server Certificate
Enrollment
Enrolls server certificates with agent authentication.
Manual Certificate Manager Signing Certificate
Enrollment
Enrolls Certificate Authority certificates.
Signed CMC-Authenticated User Certificate
Enrollment
Enrolls user certificates by using the CMC certificate
request with CMC Signature authentication.
Directory-Authenticated User Dual-Use
Certificate Enrollment
Enrolls user certificates with directory-based
authentication.
Directory-Authenticated User Certificate Self-
Renew profile
Renews user certificates which were previously
enrolled with the caDirUserCert profile.
Manual User Signing & Encryption Certificates
Enrollment
Enrolls dual user certificates. It works only with
Netscape 7.0 or later.
RA Agent-Authenticated User Certificate
Enrollment
Enrolls user certificates with RA agent authentication.
Signed CMC-Authenticated User Certificate
Enrollment
Enrolls user certificates by using the CMC certificate
request with CMC Signature authentication.
Manual Security Domain Certificate Authority
Signing Certificate Enrollment
Enrolls Security Domain Certificate Authority
certificates.
Audit Signing Certificate Enrollment Enrolls a signing certificate to use for signing audit
logs; used automatically during any subsystem
configuration, with the exception of the RA.
Security Domain DRM Storage Certificate
Enrollment
Enrolls DRM storage certificates for DRMs within a
security domain; used automatically during a DRM
configuration.
Security Domain OCSP Manager Signing
Certificate Enrollment
Enrolls Security Domain OCSP Manager certificates.
Security Domain Server Certificate Enrollment Enrolls Security Domain server certificates.
Security Domain Subsystem Certificate
Enrollment
Enrolls Security Domain subsystem certificates.
Security Domain Data Recovery Manager
Transport Certificate Enrollment
Enrolls Security Domain Data Recovery Manager
transport certificates.
Renew certificate to be manually approved by
agents
Renews a certificate that was generated with the
caUserCert profile and must be manually renewed by
agents.
Manual OCSP Manager Signing Certificate
Enrollment
Enrolls OCSP Manager certificates.
Other Certificate Enrollment Enrolls other certificates.
RA Agent-Authenticated Agent User Certificate
Enrollment
Enrolls RA agent user certificates with RA agent
authentication.
Manual Registration Manager Signing
Certificate Enrollment
Enrolls Registration Manager certificates.
RA Agent-Authenticated Router Certificate
Enrollment
Enrolls router certificates after agent approval (as
opposed to automatic enrollment).

About CA Services
7
Profile Name Description
RA Agent-Authenticated Server Certificate
Enrollment
Enrolls server certificates with RA agent
authentication.
One Time Pin Router Certificate Enrollment Enrolls router certificates using an automatically-
generated, one-time PIN that the router can use to
retrieve its certificate.
Manual Server Certificate Enrollment Enrolls server certificates.
Manual Log Signing Certificate Enrollment Enrolls audit log signing certificates.
Simple CMC Enrollment Enrolls user certificates by using the CMC certificate
request with CMC Signature authentication.
Self-renew user SSL client certificates Renews SSL client certificates issued by the
caUserCert profile.
Temporary Device Certificate Enrollment Enrolls temporary keys to be used by servers or other
network devices on a token; used by the TPS for smart
card enrollment operations. These are temporary
keys, valid for about a week, and intended to replace a
temporarily lost token.
Enrolls an encryption key on a token; used by
the TPS for smart card enrollment operations.
These are temporary keys, valid for about a
week, and intended to replace a temporarily
lost token.
Temporary Token User Signing Certificate
Enrollment
Enrolls a signing key on a token; used by the TPS
for smart card enrollment operations. These are
temporary keys, valid for about a week, and intended
to replace a temporarily lost token.
Token Device Key Enrollment Enrolls keys to be used by servers or other network
devices on a token; used by the TPS for smart card
enrollment operations.
Token User MS Login Certificate Enrollment Enrolls key to be used by a person for logging into a
Windows domain or PC; used by the TPS for smart
card enrollment operations.
Token User Encryption Certificate Enrollment Enrolls an encryption key on a token; used by the TPS
for smart card enrollment operations.
smart card token encryption cert renewal
profile
Renews an encryption key that was enrolled on a
token using the caTokenUserEncryptionKeyEnrollment
profile; used by a TPS subsystem.
Token User Signing Certificate Enrollment Enrolls a signing key on a token; used by the TPS for
smart card enrollment operations.
smart card token signing cert renewal profile Renews a signing that was enrolled on a token using
the caTokenUserSigningKeyEnrollment profile; used
by a TPS subsystem.
Manual TPS Server Certificate Enrollment Enrolls TPS server certificates.
Manual Data Recovery Manager Transport
Certificate Enrollment
Enrolls Data Recovery Manager transport certificates.

Using End User Services
8
Profile Name Description
Manual User Dual-Use Certificate Enrollment Enrolls user certificates.
Manual device Dual-Use Certificate Enrollment
to contain UUID in SAN
Enrolls certificates for devices which must contain a
unique user ID number (UUID) as a component in the
certificate's subject alternate name extension.
Domain Controller Enrolls certificates to be used by a Windows domain
controller.
Table 1. Available Certificate Profiles
1.3. About RA Services
The Red Hat Certificate System Registration Authority (RA), similar to the Certificate Manager, can
accept certificate requests. The RA doesn't issue or enroll the certificates; instead, it authenticates the
entity making the request locally, then forwards the request to the CA to generate the certificate. The
RA is in essence a load balancer for certificate management.
The RA web services page offers several different options:
• Submit certificate requests and renew certificates (through enrollment forms listed in Table 2,
“Available RA Certificate Profiles”)
• Check the status of pending certificate requests
• Retrieve issued certificates
The RA has fewer certificate enrollment options than the Certificate Manager, and the RA interface
is more simple than the Certificate Manager's web services pages. The benefit of the RA interface is
that it can be quicker to submit requests, receive approval, check request status, and retrieve issued
certificates.
The RA is essentially a load balancer for a CA, since the CA still issues the certificates but the process
of approving the certificate request is handled separately.
Profile Name Description
User Enrollment Enrolls and renews user certificates.
Server Certificate Enrollment Enrolls server certificates.
RA Agent Enrollment Enrolls certificates for RA agents.
SCEP Enrollment Enrolls router certificates, complying with Cisco SCEP
standards.
Table 2. Available RA Certificate Profiles
1.4. Supported Web Browsers
The services pages for the subsystems require a web browser that supports SSL. Two browsers are
supported:
• Mozilla Firefox 1.0 and higher
• Microsoft Internet Explorer 6 and higher

Supported Charactersets
9
NOTE
Browsers for Mac, such as Safari, and other types of web browsers, such as Opera,
are not supported for the end-entities pages. This means that some operations may not
complete successfully or forms may not be displayed properly.
If DNS is properly configured, then an IPv4 or IPv6 address can be used to connect to the services
pages. For example:
https://1.2.3.4:9444/ca/services
https://[00:00:00:00:123:456:789:00:]:9444/ca/services
1.5. Supported Charactersets
Red Hat Certificate System fully supports UTF-8 characters in the CA end users forms for specific
fields. This means that end users can submit certificate requests with UTF-8 characters in those fields
and can search for and retrieve certificates and CRLs in the CA and retrieve keys in the DRM when
using those field values as the search parameters.
Four fields fully-support UTF-8 characters:
• Common name (used in the subject name of the certificate)
• Organizational unit (used in the subject name of the certificate)
• Requester name
• Additional notes (comments appended by the agent to the certificate)
NOTE
This support does not include supporting internationalized domain names, like in email
addresses.
1.6. Configuring Internet Explorer to Enroll Certificates
Because of the security settings in Microsoft Windows Vista, requesting and enrolling certificates
through the end entities pages using Internet Explorer 7 and 8 requires extra browser configuration.
The browser has to be configured to trust the CA before it can access the CA's secure end entities
pages.
NOTE
This configuration is not necessary to use Internet Explorer 7 and 8 on Microsoft Windows
2000, 2003, or XP.
1. Open Internet Explorer.
2. Import the CA certificate chain.

Using End User Services
10
a. Open the unsecure end services page for the CA.
http://server.example.com:9180/ca/ee/ca
b. Click the Retrieval tab.
c. Click Import CA Certificate Chain in the left menu, and then select Download the CA
certificate chain in binary form.
d. When prompted, save the CA certificate chain file.
e. In the Internet Explorer menu, click Tools, and select Internet Options.
f. Open the Content tab, and click the Certificates button.
g. Click the Import button. In the import window, browse for and select the imported certificate
chain.
The import process prompts for which certificate store to use for the CA certificate chain.
Select Automatically select the certificate store based on the type of certificate.
h. Once the certificate chain is imported, open the Trusted Root Certificate Authorities tab to
verify that the certificate chain was successfully imported.
3. After the certificate chain is imported, Internet Explorer can access the secure end services pages.
Open the secure site.
https://server.example.com:9443/ca/ee/ca
4. There is probably a security exception when opening the end services pages. Add the CA services
site to Internet Explorer's Trusted Sites list.
a. In the Internet Explorer menu, click Tools, and select Internet Options.
b. Open the Security tab, and click Sites to add the CA site to the trusted list.
c. Set the Security level for this zone slider for the CA services page to Medium; if this security
setting is too restrictive in the future, then try resetting it to Medium-low.
5. Close the browser.
To verify that Internet Explorer can be used for enrollments, try enrolling a user certificate, as
described in Section 2.3, “Requesting Certificates”.
2. Getting and Managing Certificates through CA Services
The Certificate Manager is the subsystem which functions as a certificate authority in Red Hat
Certificate System and issues and manages certificates.
2.1. Opening the CA Services Page
The URL for the CA web services can vary depending on your group's server deployment. The default
way to connect to the CA web services is to connect to the server over port 9180. For example:

Generating Certificate Requests
11
https://server.example.com:9180/
That opens a menu with links to regular user services or agent services. To get directly to the regular
user pages, add /ca/ee/ca/ to the end of the URL. For example:
https://server.example.com:9180/ca/ee/ca/
If DNS is properly configured, then an IPv4 or IPv6 address can be used to connect to the services
pages, as well as a hostname or fully-qualified domain name. For example:
https://1.2.3.4:9444/ca/services
https://[00:00:00:00:123:456:789:00:]:9444/ca/services
2.2. Generating Certificate Requests
Most user profiles in the CA do not require you to generate a certificate request separately. However,
there can be situations where you need to request a certificate that doesn't match the default
configuration in the certificate profiles. In that case, you can generate a certificate request and submit
it using the Other Certificates profile.
One common example is requesting an ECC certificate. Elliptic curve cryptography (ECC) is a strong
cryptographic algorithm which is very secure and very fast. By default, a Certificate System CA issues
RSA certificates (a different cryptographic algorithm), but a CA can be configured to support ECC
as well. The CA profiles, however, will only generate RSA keys for a certificate, even though they
can process both RSA and ECC requests. So, if you want an ECC certificate, you need to prepare a
separate certificate request (and generate the ECC keys) and then submit it through the certificate
profile.
Windows and Red Hat Enterprise Linux both have a tool called certutil that can generate
certificate requests, with slightly different options and settings. There may also be tools or services in
your organization that generate certificate requests.
For example (and this command should all be on one line):
certutil -R -k ec -g 256 -s "CN=example cert server.example.com,
[email protected], O=Example Domain" -o request.cert -v 12 -d . -1 -7 -8
For information about using the certutil command, see http://www.mozilla.org/projects/security/pki/
nss/tools/certutil.html.
Option Description
-R Flag to generate a certificate request.
-k The key type to use; the only native option is rsa. If the CA is ECC-enabled (described
in the Installation Guide), then this can also be ec.
-g The key size. The recommended size for RSA keys is 2048 and for ECC, 256.
-s The subject name of the certificate.

Using End User Services
12
Option Description
NOTE
Certificate System supports all UTF-8 characters for the common name
and organizational unit elements included in the subject name of the
certificate.
-o The output file to which to save the certificate request.
-v The validity period, in months.
-d Certificate database directory; this is the directory for the subsystem instance.
numbers 1-8 These set the available certificate extensions. Only eight can be specified through the
certutil tool:
• Key Usage: 1
• Basic Constraints: 2
• Certificate Authority Key ID: 3
• CRL Distribution Point: 4
• Netscape Certificate Type: 5
• Extended Key Usage: 6
• Email Subject Alternative Name: 7
• DNS Subject Alternative Name: 8
-a Outputs the certificate request to an ASCII file instead of binary.
Table 3. Options for Requesting Certificates with certutil
2.3. Requesting Certificates
Certificate requests are submitted to the Certificate Manager through the forms listed in the
Enrollment tab. The Certificate Manager has a variety of different certificate request submission forms
(called certificate profiles). The type of form to use depends on the type of certificate you need. The
different certificate profiles are listed in Table 1, “Available Certificate Profiles”.
Most user certificates can be requested directly through the enrollment forms; there is no need to
generate a separate certificate request. Other types of certificates (especially certificates for servers or
applications), may require generating a separate certificate request, and then submitting that through
the enrollment form. Generating certificate requests is covered in Section 2.2, “Generating Certificate
Requests”.
To submit a certificate request:
1. Click the name of the submission form to use.

Requesting Certificates
13
2. Fill in the information required for the certificate.
There are basically two kinds of certificate enrollment forms. One kind accepts certificate request
blobs, and the other requires additional user information to build the subject name of the certificate
(a major part of its identifier).
To submit a certificate request:
• Set the certificate format to generate. There are two options, PKCS #10 (the most common one)
or CRMF.
• Paste in the base 64-encoded certificate request.

Using End User Services
14
NOTE
The way that you generate the base 64-encoded certificate request depends on
your network setup. There may be an online form you can use to create a certificate
request, the client you are requesting the certificate for may have a built-in request
tool, or you can use tools such as certutil. The options for creating a certificate
request are covered more in the Certificate System Administrator's Guide.
For other types of certificate profiles, the form requires information about the requester in order to
create the subject name of the new certificate.1
• The certificate format may be automatically set to PKCS#10 or CRMF, depending on the profile,
and the key size is selected by the requester.
• Fill in the subject name information, such as the username (UID), email address, location, and
organization information.

Checking on Your Request Status
15
Other forms may require other information. For example, file signing profiles require a URL to the
external file that will be signed by the CA.
NOTE
The CA certificate request forms support all UTF-8 characters for the common name,
organizational unit, and requester name fields.
This support does not include supporting internationalized domain names.
3. For every certificate enrollment, fill in the requester information. All certificate forms take the name,
phone number, and email address of the requester. The email address may be required if you will
be notified by email when the certificate is issued.
4. Click the Submit button.
2.4. Checking on Your Request Status
1. Click the Retrieval tab.
2. Enter the request ID number (the one returned when you submitted the request) in the Request
identifier field. To search for or list requests, see Section 2.6, “Listing and Searching for
Certificates”.

Using End User Services
16
3. The request status is shown as pending, rejected, or completed. If the request has been
completed, click the link to retrieve the issued certificate.
2.5. Retrieving Your Certificates
After a certificate is generated by the Certificate Manager, it can be copied to a file or imported directly
into your browser.
1. Click the Retrieval tab in the CA web services page.
2. Open the certificate, either by checking the status2 and opening it or by finding it in a list3 of issued
certificates.

Retrieving Your Certificates
17
3. The certificate page has three major sections: the certificate fingerprint, the base 64-encoded
certificate, and the certificate with the CA certificate chain. The certificate fingerprint shows the
summary of the information contained in the base 64-encoded version, such as the serial number,
issuing CA, validity period, and key information.
To copy the certificate, scroll to the base 64-encoded blob and simple copy and paste.
4. To import the certificate directly into your web browser or email client, scroll to the bottom of the
certificate's page, and click the Import ... Certificate button.

Using End User Services
18
2.6. Listing and Searching for Certificates
The Retrieval tab has two ways to search for certificates. The List Certificates page has a basic
search for every issued certificates, while the Search for Certificates page has advanced search
options which narrow down results based on specific information about the certificate.
2.6.1. Listing Certificates (Basic Search)
1. Click the Retrieval tab.
2. On the left, click the List Certificates link.
3. Fill in the serial number range and, if you want, filter out revoked or expired certificates. Leaving
the lowest and highest fields blank returns all certificates that have been issued.

Listing and Searching for Certificates
19
4. Every certificate within that range is returned. To open the retrieval page for the certificate, click
the link.

Using End User Services
20
2.6.2. Searching for Certificates (Advanced Search)
1. Click the Retrieval tab.
2. On the left, click the Search Certificates link.
3. Fill in the search criteria. The Search form offers a number of different search areas:
•Serial number range for every certificate issued within that serial number block, same as with
listing certificates.