Communicator Help: Using AOL<sup><font size=-2>®</font></sup> Communicator Identity Manager

Contents | Index | Tutorial Movies

Using AOL Communicator Identity Manager

Controlling Certificate Validation

Certificate validation is an advanced feature available only to users who use digital certificates.

You shouldn't adjust your validation preferences unless you have one or more of your own certificates and have discussed the appropriate settings with your system administrator or certificate issuer.

Settings & Preferences:
Certificate Validation Preferences
Manage CRLs

Certificate Validation Preferences

Certificate Validation Preferences control the way AOL Communicator validates certificates, or digital IDs.

You shouldn't adjust these preferences unless you have one or more of your own certificates and have discussed the appropriate settings with your system administrator or certificate issuer.

If you are not already viewing your Certificate Validation preferences, open the Edit menu in Identity Manager, choose Security Preferences, and click Certificate Validation.

CRL

A certificate revocation list (CRL) is a list of revoked certificates that is generated and signed by a certificate authority (CA). It's possible to download a CRL for use by AOL Communicator to check that certificates are still valid before permitting their use for authentication.

Manage CRLs: Click this button to see a list of the CRLs currently available to AOL Communicator.

OCSP

The Online Certificate Status Protocol (OCSP) makes it possible for AOL Communicator to perform an online check of a certificate's validity each time the certificate is viewed or used. This process involves checking the certificate against a certificate revocation list (CRL) maintained at a specified web site. Your computer must be online for OCSP to work.

To specify how AOL Communicator uses OCSP, choose one of these settings in the OCSP section of Certificate Validation Preferences:

- Do not use OCSP for certificate verification: Select this setting if you don't want AOL Communicator to perform an online status check each time it verifies a certificate. Instead, whenever AOL Communicator performs certificate verification, it only confirms the certificate's validity period and that it is correctly signed by a CA whose own CA certificate is both listed under the Certificate Authorities tab (in the main Identity Manager window) and marked as trusted for issuing that kind of certificate.
- Use OCSP to verify only certificates that specify an OCSP service URL: Select this setting if you want AOL Communicator to perform an online status check each time it verifies a certificate that specifies a URL for the purpose of performing such a check. If a URL is specified by the certificate, AOL Communicator makes sure that the certificate is listed there as valid and checks the validity period and trust settings.
- Use OCSP to verify all certificates, using the URL and signer specified here: Select this setting if you want AOL Communicator to perform an online status check each time it verifies any certificate. If you select this setting, you should also choose the certificate from the Response Signer pop-up menu that identifies the signer of the OCSP responses. With this setting, the only certificates Certificate Manager recognizes are those that can be verified by an OCSP response signed with the Response Signer certificate (or signed using a certificate that chains to it).
  When you choose a Response Signer certificate, Certificate Manager fills in the Service URL (if available) for that signer automatically. If the Service URL is not filled in automatically, you must provide it yourself; ask your system administrator for details.

Related topics:

Getting Started With Identity Manager (page 239)
Getting Your Own Certificate (page 243)

<< back to top

Manage CRLs

The Manage CRLs window displays a list of the CRLs that you have installed for use by AOL Communicator.

You shouldn't adjust your CRL settings unless you have discussed them with your system administrator or certificate issuer.

If you are not already viewing the Manage CRLs window, open the Edit menu in Identity Manager, choose Security Preferences, click Certificate Validation, and click Manage CRLs.

To select a CRL, click it. You can then perform any of these actions:

- Import: Allows you to specify (as a URL or file) and import a CRL
- Delete: Deletes the CRL permanently from your hard disk. Don't do this unless you're sure you no longer need the CRL for validating certificates. If in doubt, consult your system administrator.
- Update: Immediately updates the selected CRL (if possible).
- Edit Prefs: Opens a window that allows you to activate automatic CRL updates for the selected CRL and specify how frequently they should be performed.

The Manage CRLs window provides the following information about each CRL:

- Organization (O): The name of the organization that issued the CRL.
- Organizational Unit (OU): The name of the organizational unit that issued the CRL (such as the root CA for a particular kind of certificate).
- Last Update: The date on which AOL Communicator's copy of this CRL was last updated.
- Next Update: The next date on which an updated version of this CRL will be published by the CRL issuer.
- Auto Update: Indicates whether Auto Update has been enabled for this CRL. To view the settings that control auto updating, select the CRL and click Settings.
- Status:
  If Auto Update has not been enabled, or if it has been enabled but the next scheduled update has not yet occurred, this field will be blank.
  After at least one auto update has occurred, this field shows "failed" if the most recent auto update failed, or "OK" if the most recent auto update was successful.

<< back to top

The sections in this document that discuss security, encryption, and privacy are provided by AOL for your information only. They may help you take certain steps to protect the privacy and security of your personal information on the Internet. This document does not, however, address all online privacy and security issues, nor does it represent a recommendation by AOL about what constitutes adequate privacy and security protection on the Internet.

© 2002-2003 America Online, Inc. All rights reserved. Trademark Information

Last Updated September 16, 2003