[Pki-devel] Review of Standalone DRM/OCSP design

This is a review of the design at http://pki.fedoraproject.org/wiki/Stand-alone_PKI_Subsystems 1. We should emphasize that standalone KRA is not expected to communicate with any other CS subsystems (excepti for its clone). 2. Cloned subsystems (OCSP and DRM) do not generate new admin certs. They use the one from the master. 3. Standalone DRM slated for 10.1 which is F20+. Standalone OCSP is undetermined. 4. Changes to default.cfg: a) you need variables to specify the location of the admin cert CSR/cert. b) You are also going to need variables for the external CA cert and chain, so that you can import and trust it. pki_external_ca_cert_chain_path= pki_external_ca_cert_path= 5. As mentioned before, its very likely that not all the servlets listed in web.xml will be needed. You'll have to look at the access log and see what is actually called. In general, you want to choose REST interfaces if available, followed by admin interfaces. Keep in mind that as standalone systems are brand new, we can expect them to have the latest interfaces. Other than that, looks fine. Ade