<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-GB" link="blue" vlink="purple"> <div class="WordSection1"> Thanks Christina, that helps a lot!<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: pki-users-bounces@redhat.com [mailto:pki-users-bounces@redhat.com] On Behalf Of Christina Fu Sent: 14 February 2014 02:08 To: pki-users@redhat.com Subject: Re: [Pki-users] Deleting revoked certificates<o:p></o:p> </div> </div> <o:p> </o:p> Oleg, Are you talking about removing certificate records from the Dogtag internal directory server? First of all, you are not supposed to remove unexpired revoked certs from the internal db as that's where CRL's are built. However, if "old" means "expired" certificates, then I imagine you could use ldapmodify to do that. You can probably write a script to do that as a cron job. You can "man ldapmodify" to see the documentation. Now, if you are talking about removing expired certs from a publishing directory, there is a job called "UnpublishExpiredJob" that can be turned on to "unpublish"(remove) them from the publishing directory for you periodically: <a href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Setting_up_Specific_Jobs.html#Configuration_Parameters_of_unpublishExpiredCerts">https://access.redhat.com/site/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Setting_up_Specific_Jobs.html#Configuration_Parameters_of_unpublishExpiredCerts</a> Hope that answered your question. Christina<o:p></o:p> <div> On 02/13/2014 03:16 AM, Oleg Antonenko wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Hi!<o:p></o:p> <o:p></o:p> Could anyone point me at documentation regarding physical removal of “old” revoked certificates from the system (db)? <o:p></o:p> I looked at the redhat & dogtag documentation online but didn’t find any relevant info…<o:p></o:p> <o:p></o:p> With thanks,<o:p></o:p> Oleg<o:p></o:p> </pre>**************************************************************************************** This email and any files transmitted with are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error then please delete it and notify the sender. Do not make a copy or forward it to anyone. This footnote also confirms that this email message has been swept for the presence of computer viruses. Adaptive Mobile Security Ltd, Ferry House, 48 Lower Mount Street, Dublin 2, Ireland Directors: B. Collins, G. Maclachlan (UK), N. Grierson (UK), J. Ennis (UK), D. Summers (UK). Registered in Ireland, Company No. 370343, VAT Reg.No.IE6390343O ****************************************************************************************</pre><o:p></o:p> <o:p></o:p> <pre>_______________________________________________<o:p></o:p></pre> <pre>Pki-users mailing list<o:p></o:p></pre> <pre><a href="mailto:Pki-users@redhat.com">Pki-users@redhat.com</a><o:p></o:p></pre> <pre><a href="https://www.redhat.com/mailman/listinfo/pki-users">https://www.redhat.com/mailman/listinfo/pki-users</a><o:p></o:p></pre> </blockquote> <o:p> </o:p> </div> </pre>**************************************************************************************** This email and any files transmitted with are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error then please delete it and notify the sender. Do not make a copy or forward it to anyone. This footnote also confirms that this email message has been swept for the presence of computer viruses. Adaptive Mobile Security Ltd, Ferry House, 48 Lower Mount Street, Dublin 2, Ireland Directors: B. Collins, G. Maclachlan (UK), N. Grierson (UK), J. Ennis (UK), D. Summers (UK). Registered in Ireland, Company No. 370343, VAT Reg.No.IE6390343O ****************************************************************************************</pre></body> </html>