Validation Authority Peer Publisher

ENTERPRISE EDITION This is an EJBCA Enterprise Edition (EE) feature.

Much like the legacy VA Publisher, the VA Peer Publisher publishes issued certificates from an EJBCA CA to a VA, but over TLS using our Peers protocol.

images/download/attachments/16230197/Screen_Shot_2018-05-03_at_15.10.29.png

Settings

Setting

Description

Peer System

An EJBCA instance to publish certificate objects to.

Publish only revoked certificates

If selected, only revoked certificate are stored on the VA. The OCSP responder of the VA must have the 'nonexistingisgood' (conf/ocsp.properties) enabled if only revoked certificates are published. A publisher for CA certificates (used on an Edit Certificate Authorities page) must have this disabled.

Store CRL at the Validation Authority

Should be set if the CRL store service of the VA should be used for a CA (only has a meaning for publishers used on an Edit Certificate Authorities page). Note that to use this option you must enable Store certificate at the Validation Authority and clear Publish only revoked certificates since the CA certificate(s) must be stored in the VA when CRLs are stored there.

Publish only revoked certificates

If selected, only revoked certificate are stored on the VA. The OCSP responder of the VA must have the 'nonexistingisgood' (conf/ocsp.properties) enabled if only revoked certificates are published. A publisher for CA certificates (used on an Edit Certificate Authorities page) must have this disabled.

Include database integrity information

Select to also export database integrity protection columns from the CA

Ignore newer entries at peer

Do not overwrite newer entries on the VA, which could happen as a result of a split-brain in a cluster.

Don't store certificate meta data except for CA and OCSP signing certificates

Personally identifiable information as relevant for the General Data Protection Regulation (GDPR) will not be transmitted to the VA.