Directory structure

This is an example of an X.500/LDAP directory structure (EE = End Entity) where certificates are stored:

c=SE
	o=Acme, Inc.
		cn=Root CA
			<EE certs issued by Root CA>
			...
		cn=Subordinate CA
			<EE certs issued by Subordinate CA>
			...
		cn=Another Subordinate CA
			<EE certs issued by Another Subordinate CA>
			...
			...

In the example scenario:

• The EE (End Entity) LDAP objects have, at least, the following attributes defined:
  • cn
  • serialNumber
  • userCertificate
• The CA LDAP objects have, at least, the following attributes defined:
  • cn
  • cACertificate

Specify the search

A search is specified relative to a base DN.

1. The base DN regulates the width of the search (for example, search all of c=SE, or search only among the objects below the Root CA).
2. To define the depth of the search (just one level down, or the whole subtree) use the LDAP scope, which you define as part of the LDAP URL (see RFC 2255 The LDAP URL Format).
3. For subject-related certificate queries (that is, CA certificates), use either the full DN or the commonName (cn) portion of the DN in your filter. For example, this filter will return certificates issued by any of the CAs that have a subject DN matching that of the request:

subjectsearch.searchbase = o=Acme, Inc.,c=SE
subjectsearch.filter = (cn={cn})

Filtering

• Initial filtering is done by the server as the filter requires a match on the CN component/attribute. In addition, the lookup will verify that the whole subject DN matches.

• If instead you want to limit the search to CA certificates only, change the filter like this (where "pkiCA" is the assumed LDAP object class for CA objects):

  CA certificates query

  subjectsearch.searchbase = {dn}
  subjectsearch.filter = (objectClass=pkiCA)

• For issuer-related certificate queries (that is, CA certificates), use this query ("cn" is the Common Name of the Issuer in this case):

  Issuer-related certificate query

  issuerserialsearch.searchbase = cn={cn}, o=Acme, Inc.,c=SE
  issuerserialsearch.filter = (serialNumber={serialNumber})

  Alternatively, use the complete issuer DN:

  issuerserialsearch.searchbase = {issuerName} 
  issuerserialsearch.filter = (serialNumber={serialNumber})

Specify LDAP directory

For each LDAP directory, specify as follows:

ocsp.certs.lookup.<#>.type=ldap
ocsp.certs.lookup.<#>.ldapurl=<URL>

See this table for description of constants and values:

Specify as follows to do a search based on

• subject,
• issuer and
• certificate serial number:

ocsp.certs.lookup.<#>.subjectsearch.searchbase=<baseDN>
ocsp.certs.lookup.<#>.subjectsearch.filter=<LDAP search filters>
ocsp.certs.lookup.<#>.issuerserialsearch.searchbase=<baseDN>
ocsp.certs.lookup.<#>.issuerserialsearch.filter=<LDAP search filters>

See this table for description of constants and values:

The LDAP search filters are expressed as a regular expression of the type:

(<attribute name>={<attributevalue>})

The available filters are:

LDAP search filters can also be used in the .searchbase parameter as shown in the example scenario.