To create a distribution rule:

1. In AWB, select New > Distribution rule.

2. In the Create Distribution Rule Request dialog, enter the Rule name that should appear in the Distribution rules sub-group in the explorer bar.

3. Set the procedure State to Active or Closed as required.
4. Select Domain and check Visible in subdomain if applicable.
5. Select Protocol.
   
   1. If LDAP is selected, the rest of this procedure applies.

   2. If HTTP is selected, the appearance of the dialog changes and other parameters have to be specified, see section "Create distribution rule, HTTP protocol" below.

   3. For information regarding Unpublish, see below.

6. Enter the address of the target server in the Host:Port field or select a host from the drop-down list of hosts used in other distribution rules. The address should consist of the IP address or host name and the port number.

7. Set the LDAP over TLS parameter using the Yes and No option buttons.

   1. Select Yes if communication with the LDAP server is through TLS (LDAPS).

   2. The default is No.

8. Enter the Directory user ID that will be used by the CA to log in to the target server.

9. Enter the Password associated with the User ID entered in step 8.

10. Click the + button associated with Distinguished Name to open the Select Distinguished Name window. The distinguished name points to the storage location in the directory.

11. Enter a distinguished name attribute or select an attribute from the drop-down list in the window and click OK. A search filter can be specified as the last element in the list, note that the filter must be preceded with the string "??sub?". Repeat steps 10 and 11 until all the relevant attributes required to create the distinguished name have been entered.

12. Enter the Object class of the certificate or CRL data that will be stored, or select an object class from the drop-down list of object classes used in other distribution rules.

    Note
    Warning The attributes selected in the following steps must be valid attributes of the selected Object class. Invalid attributes will result in a rejection from the directory server and a CM event log error.

    
    

13. In Attributes, click + to open the Select object attributes window. The object class attributes and their values are the data that will be written in the target directory at the destination specified by the distinguished name.

14. Enter an object attribute or select the required object attribute from the drop-down list in the window and click OK. Repeat steps 13 and 14 until all the relevant object attributes have been entered.

15. Select the required Update policy using the check boxes. At least one check box must be selected.

    1. Create object - a new object, with all its attributes will be created in the target directory.

    2. Add attribute to object - a new attribute will be added to an existing object.

    3. Edit existing value - the existing value of an attribute will be modified.

16. Click OK and sign the request. See Sign tasks in Certificate Manager for more information.

When the Unpublish option in the LDAP protocol section is selected, the Create Distribution Rule Request dialog box will update, by removing irrelevant options. An unpublished distribution rule only requires the path to the certificate attribute to remove, specified in the Distinguished Name field.

Optionally, you can add or edit attributes during an 'unpublish' by specifying the Object class, Attribute and Update Policy sections.

1. Do steps 10 and 11 from section "Create distribution rule, LDAP protocol" to build the path to the certificate directory attribute that should be removed.

2. Specify the attribute name, which contains the certificate to be removed, by adding the following: ?<attribute_name> to the Distinguished Name. Example: ?userCertificate.

3. Optional: Do steps 12 to 15 from section "Create distribution rule, LDAP protocol" if it is required to add or edit attributes in the LDAP entry.
4. Click OK and sign the request. See Sign tasks in Certificate Manager for more information.

A distribution rule request contains a varying number of fields depending on which protocol is selected.

• The LDAP protocol is default and the corresponding dialog box is shown initially. The LDAP protocol section includes the Unpublish option. This option, when enabled, will try to remove the provided certificate from a specified attribute from the LDAP directory. The certificate attribute name must be specified in the Distinguished Name field to define its location in the AD, for example, ?userCertificate.
• If HTTP is selected, another version of the dialog box appears, see section "Create distribution rule, HTTP protocol".