D.5. Online Certificate Status Manager-Specific ACLs This section covers the default access control configuration attributes which are set specifically for the Online Certificate Status Manager. The OCSP responder's ACL configuration also includes all of the common ACLs listed in Section D.2, "Common ACLs" . There are access control rules set for each of the OCSP's interfaces (administrative console and agents and end-entities services pages) and for common operations like listing and downloading CRLs. D.5.1. certServer.ee.crl Controls access to CRLs through the end-entities page. Table D.57. certServer.ee.crl ACL Summary Operations Description Allow/Deny Access Targeted Users/Groups read Retrieve and view the certificate revocation list. Allow Anyone D.5.2. certServer.ee.request.ocsp Controls access, based on IP address, on which clients submit OCSP requests. Table D.58. certServer.ee.request.ocsp ACL Summary Operations Description Allow/Deny Access Targeted Users/Groups submit Submit OCSP requests. Allow All IP addresses D.5.3. certServer.ocsp.ca Controls who can instruct the OCSP responder. The default setting is: Table D.59. certServer.ocsp.ca ACL Summary Operations Description Allow/Deny Access Targeted Users/Groups Add Instruct the OCSP responder to respond to OCSP requests for a new CA. Allow OCSP Manager Agents D.5.4. certServer.ocsp.cas Controls who can list, in the agent services interface, all of the Certificate Managers which publish CRLs to the Online Certificate Status Manager. The default setting is: Table D.60. certServer.ocsp.cas ACL Summary Operations Description Allow/Deny Access Targeted Users/Groups list Lists all of the Certificate Managers which publish CRLs to the OCSP responder. Allow Agents D.5.5. certServer.ocsp.certificate Controls who can validate the status of a certificate. The default setting is: Table D.61. certServer.ocsp.certificate ACL Summary Operations Description Allow/Deny Access Targeted Users/Groups validate Verifies the status of a specified certificate. Allow OCSP Agents D.5.6. certServer.ocsp.configuration Controls who can access, view, or modify the configuration for the Certificate Manager's OCSP services. The default configuration is: Table D.62. certServer.ocsp.configuration ACL Summary Operations Description Allow/Deny Access Targeted Users/Groups read View OCSP plug-in information, OCSP configuration, and OCSP stores configuration. List OCSP stores configuration. Allow Administrators Online Certificate Status Manager Agents Auditors modify Modify the OCSP configuration, OCSP stores configuration, and default OCSP store. Allow Administrators D.5.7. certServer.ocsp.crl Controls access to read or update CRLs through the agent services interface. The default setting is: Table D.63. certServer.ocsp.crl ACL Summary Operations Description Allow/Deny Access Targeted Users/Groups add Add new CRLs to those managed by the OCSP responder. Allow OCSP Agents Trusted Managers D.5.8. certServer.ocsp.group Controls access to the internal database for adding users and groups for the Online Certificate Status Manager instance. Table D.64. certServer.ocsp.group ACL Summary Operations Description Allow/Deny Access Targeted Users/Groups modify Create, edit or delete user and group entries for the instance. Allow Administrators read View user and group entries for the instance. Allow Administrators D.5.9. certServer.ocsp.info Controls who can read information about the OCSP responder. Table D.65. certServer.ocsp.info ACL Summary Operations Description Allow/Deny Access Targeted Users/Groups read View OCSP responder information. Allow OCSP Agents

Commands:
allow (read) user="anybody"
allow (submit) ipaddress=".*"
allow (add) group="Online Certificate Status Manager Agents"
allow (list) group="Online Certificate Status Manager Agents"
allow (validate) group="Online Certificate Status Manager Agents"
allow (read) group="Administrators" || group="Online Certificate Status Manager Agents" || group="Auditors";allow (modify) group="Administrators"
allow (add) group="Online Certificate Status Manager Agents" || group="Trusted Managers"
allow (modify,read) group="Administrators"
allow (read) group="Online Certificate Status Manager Agents"