diff -r 51a74ef9ed63 -r ae94777fff8f Symbian3/SDK/Source/GUID-C893C9E6-47B8-5149-9808-0274C61CF3D7.dita --- a/Symbian3/SDK/Source/GUID-C893C9E6-47B8-5149-9808-0274C61CF3D7.dita Wed Mar 31 11:11:55 2010 +0100 +++ b/Symbian3/SDK/Source/GUID-C893C9E6-47B8-5149-9808-0274C61CF3D7.dita Fri Jun 11 12:39:03 2010 +0100 @@ -1,56 +1,55 @@ - - - - - -OCSP-SWI -Integration

The Symbian platform provides the ability to validate and manage X.509 certificates. -This ability is integrated into the software installation process to provide -Secure Software Install (SWI) with the functionality of performing certificate -checking at installation time. During installation, SWI checks whether the -certificates associated with the application to be installed have been revoked. -It performs this check by using Online Certificate Status Protocol (OCSP).

You -can configure SWI to enable or disable the revocation status check of certificates. -In addition, SWI can also be configured to supply the OCSP client with a default -Uniform Resource Identifier (URI) for the OCSP server.

-

You can configure SWI to enable or disable the revocation status check -of certificates. In addition, SWI can also be configured to supply the OCSP -client with a default Uniform Resource Identifier (URI) for the OCSP server.

-
Installing software based on OCSP check

SWI validates -the certificate in the install file. As part of validation, it carries out -revocation check, depending on the setting of the OcspEnabled parameter -in the swipolicy.ini file. If the revocation check option -is not enabled, a warning is displayed giving options to carry out revocation -check, to continue without revocation check or to cancel the installation. -If the option is enabled, all certificates in the chain except the root are -checked.

Note: For details on how certificates are validated, -see Certificate Validation -in PKIX.

The results of revocation check decide whether the -application can be installed. The following are the scenarios associated with -the certificate revocation check:

    -
  • If the OCSP client indicates -that no certificates are revoked and the operation completes successfully -with no errors or warnings, the software can be installed.

  • -
  • If OCSP indicates that -any of the certificates is revoked or if the signature on the OCSP response -is invalid, a security error is issued and the software cannot be installed.

  • -
  • If the revocation status -of a certificate cannot be determined (because of reasons like lack of network -access or OCSP responder error), SWI behaves as if the software were unsigned. -The setting of the AllowUnsigned parameter in the swipolicy.ini file -determines whether the unsigned software can be installed or not. If the parameter -value is true, SWI issues a warning before installing but allows installation -of the software. Otherwise it issues an error and does not allow installation.

  • -

Note: For details of the various parameters in swipolicy.ini, -see Secure Software -Install Reference.

-
-Online Certificate -Status Protocol + + + + + +OCSP-SWI Integration

The Symbian platform provides the ability to validate +and manage X.509 certificates. This ability is integrated into the software +installation process to provide Secure Software Install (SWI) with +the functionality of performing certificate checking at installation +time. During installation, SWI checks whether the certificates associated +with the application to be installed have been revoked. It performs +this check by using Online Certificate Status Protocol (OCSP).

You can configure SWI to enable or disable the revocation status +check of certificates. In addition, SWI can also be configured to +supply the OCSP client with a default Uniform Resource Identifier +(URI) for the OCSP server.

+

You can configure SWI to enable or disable the revocation status +check of certificates. In addition, SWI can also be configured to +supply the OCSP client with a default Uniform Resource Identifier +(URI) for the OCSP server.

+
Installing software based on OCSP check

SWI validates the certificate in the install file. As part of validation, +it carries out revocation check, depending on the setting of the OcspEnabled parameter in the swipolicy.ini file. If the revocation check option is enabled, a +warning is displayed giving options to carry out revocation check, +to continue without revocation check or to cancel the installation. +If the option is enabled, all certificates in the chain except the root are checked.

Note: For details on how certificates are validated, +see Certificate +Validation in PKIX.

The results of revocation check +decide whether the application can be installed. The following are +the scenarios associated with the certificate revocation check:

    +
  • If the OCSP +client indicates that no certificates are revoked and the operation +completes successfully with no errors or warnings, the software can +be installed.

  • +
  • If OCSP indicates +that any of the certificates is revoked or if the signature on the +OCSP response is invalid, a security error is issued and the software +cannot be installed.

  • +
  • If the revocation +status of a certificate cannot be determined (because of reasons like +lack of network access or OCSP responder error), SWI behaves as if +the software were unsigned. The setting of the AllowUnsigned parameter in the swipolicy.ini file determines +whether the unsigned software can be installed or not. If the parameter +value is true, SWI issues a warning before installing but allows installation +of the software. Otherwise it issues an error and does not allow installation.

  • +

Note: For details of the various parameters in swipolicy.ini, see Secure Software Install +Reference.

+
+Online +Certificate Status Protocol
\ No newline at end of file