Status Responder Certificate: Certificate used to identify
an online status responder that uses the Online Certificate Status Protocol
(OCSP) to check the validity of certificates. For more information about
- OCSP, see Validation Settings.
SSL Certificate Authority: Certificate used to identify
a certificate authority—that is, a service that issues certificates for
use as identification over computer networks.
diff --git a/suite/locales/en-US/chrome/common/help/help-index1.rdf b/suite/locales/en-US/chrome/common/help/help-index1.rdf
index ec6a45c8953..d3baa2704ba 100644
--- a/suite/locales/en-US/chrome/common/help/help-index1.rdf
+++ b/suite/locales/en-US/chrome/common/help/help-index1.rdf
@@ -489,12 +489,12 @@
+ nc:link="validation_help.xhtml#automatic_crl_update_preferences"/>
+ nc:link="validation_help.xhtml#manage_crls"/>
+ nc:link="validation_help.xhtml#privacy_and_security_preferences_validation"/>
@@ -1674,7 +1674,7 @@
+ nc:link="validation_help.xhtml#privacy_and_security_preferences_validation"/>
@@ -2005,7 +2005,7 @@
+ nc:link="validation_help.xhtml#validation_settings"/>
@@ -2194,27 +2194,27 @@
+ nc:link="validation_help.xhtml#automatic_crl_update_preferences"/>
+ nc:link="validation_help.xhtml#privacy_and_security_preferences_validation"/>
+ nc:link="validation_help.xhtml#manage_crls"/>
+ nc:link="validation_help.xhtml#privacy_and_security_preferences_validation"/>
+ nc:link="validation_help.xhtml#validation_settings"/>
diff --git a/suite/locales/en-US/chrome/common/help/mail_sec_help.xhtml b/suite/locales/en-US/chrome/common/help/mail_sec_help.xhtml
index e0572d205ad..729b1d9ca67 100644
--- a/suite/locales/en-US/chrome/common/help/mail_sec_help.xhtml
+++ b/suite/locales/en-US/chrome/common/help/mail_sec_help.xhtml
@@ -408,11 +408,12 @@
message is digitally signed and if so, whether the signature is valid.
If validation failed while OCSP was enabled, check the OCSP settings in
- Privacy & Security
- Preferences - Validation. If you are not familiar with OCSP, confirm the
- settings with your system administrator. If your settings are correct, there
- may be a problem with the OCSP service or the certificate used to create the
- signature is no longer valid.
+ Privacy
+ & Security Preferences - Validation. If you are not familiar with
+ OCSP, confirm the settings with your system administrator. If your settings
+ are correct, there may be a problem with the OCSP service or the certificate
+ used to create the signature is no longer valid.
If the signature is invalid because of a problem with a certificate's trust
settings, you can use the Certificate Manager
diff --git a/suite/locales/en-US/chrome/common/help/privsec_help.xhtml b/suite/locales/en-US/chrome/common/help/privsec_help.xhtml
index 71618d586da..ea90b0f8947 100644
--- a/suite/locales/en-US/chrome/common/help/privsec_help.xhtml
+++ b/suite/locales/en-US/chrome/common/help/privsec_help.xhtml
@@ -38,7 +38,7 @@
One way to combat this threat is for Certificate Manager to check a certificate revocation list (CRL) as part of the verification process (see Managing CRLs, below). Typically, you download a CRL to your browser by clicking a link. If a CRL is present, Certificate Manager checks any certificate issued by the same CA against the list as part of the verification process.
-
The reliability of CRLs depends on the frequency with which they are both updated by a server and checked by a client. You can configure your Automatic CRL Update Preferences so that a CRL will be updated automatically at regular intervals with the version currently on the server.
+
The reliability of CRLs depends on the frequency with which they are both updated by a server and checked by a client. You can configure your Automatic CRL Update Preferences so that a CRL will be updated automatically at regular intervals with the version currently on the server.
Another way to combat the threat of compromised certificates is to use a special server that supports the Online Certificate Status Protocol (OCSP). Such a server can answer client queries about individual certificates (see Configuring OCSP, below).
@@ -440,7 +440,7 @@
This section describes how to import and manage CRLs.
A certificate revocation list (CRL) is a list of revoked certificates that is generated and signed by a certificate authority (CA). It's possible to download a CRL to your browser, which can check it to ensure that certificates are still valid before permitting their use for authentication.
-
-
Click Manage CRLs to see a list of the CRLs available to Certificate Manager.
-
-
For more information about managing CRLs, see Managing CRLs.
+
The Online Certificate Status Protocol (OCSP) makes it possible for Certificate Manager to perform an online check of a certificate's validity each time the certificate is viewed or used. This process involves checking the certificate against a certificate revocation list (CRL) maintained at a specified web site. Your computer must be online for OCSP to work.
+
A certificate revocation list (CRL) is a list of revoked certificates that
+ is generated and signed by a
+ certificate authority
+ (CA). It's possible to download a CRL to your browser, which can
+ check it to ensure that certificates are still valid before permitting their
+ use for authentication.
-
To specify how Certificate Manager uses OCSP, choose one of these settings in the OCSP section of Validation Settings:
+
Click Manage CRLs to see a list of the CRLs available to Certificate
+ Manager.
+
+
For more information about managing CRLs, see
+ Managing CRLs.
+
+
OCSP
+
+
The Online Certificate Status Protocol (OCSP) makes it possible for
+ Certificate Manager to perform an online check of a certificate's
+ validity each time the certificate is viewed or used. This process involves
+ checking the certificate against a certificate revocation list (CRL)
+ maintained at a specified website. Your computer must be online for OCSP to
+ work.
+
+
To specify how Certificate Manager uses OCSP, choose one of these settings
+ in the OCSP section of Validation Settings:
-
Do not use OCSP for certificate verification. Select this setting if you don't want Certificate Manager to perform an online status check each time it verifies a certificate. Instead, whenever Certificate Manager performs certificate verification, it only confirms the certificate's validity period and that it is correctly signed by a CA whose own CA certificate is both listed under the CA Certificates tab (in the main Certificate Manager window) and marked as trusted for issuing that kind of certificate.
-
Use OCSP to verify only certificates that specify an OCSP service URL. Select this setting if you want Certificate Manager perform an online status check each time it verifies a certificate that specifies a URL for the purpose of performing such a check. If a URL is specified by the certificate, Certificate Manager makes sure that the certificate is listed there as valid and checks the validity period and trust settings.
-
Use OCSP to verify all certificates, using the URL and signer specified here. Select this setting if you want Certificate Manager to perform an online status check each time it verifies any certificate. If you select this setting, you should also choose the certificate from the Response Signer pop-up menu that identifies the signer of the OCSP responses. With this setting, the only certificates Certificate Manager recognizes are those that can be verified by an OCSP response signed with the Response Signer certificate (or signed using a certificate that chains to it).
+
Do not use OCSP for certificate verification. Select
+ this setting if you don't want Certificate Manager to perform an
+ online status check each time it verifies a certificate. Instead, whenever
+ Certificate Manager performs
+ certificate
+ verification, it only confirms the certificate's validity period
+ and that it is correctly signed by a CA whose own CA certificate is both
+ listed under the CA Certificates tab (in the main Certificate Manager
+ window) and marked as trusted for issuing that kind of certificate.
+
Use OCSP to verify only certificates that specify an OCSP service
+ URL. Select this setting if you want Certificate Manager perform
+ an online status check each time it verifies a certificate that specifies a
+ URL for the purpose of performing such a check. If a URL is specified by
+ the certificate, Certificate Manager makes sure that the certificate is
+ listed there as valid and checks the validity period and trust
+ settings.
+
Use OCSP to verify all certificates, using the URL and signer
+ specified here. Select this setting if you want Certificate
+ Manager to perform an online status check each time it verifies any
+ certificate. If you select this setting, you should also choose the
+ certificate from the Response Signer pop-up menu that identifies the signer
+ of the OCSP responses. With this setting, the only certificates Certificate
+ Manager recognizes are those that can be verified by an OCSP response
+ signed with the Response Signer certificate (or signed using a certificate
+ that chains to it).
-
When you choose a Response Signer certificate from the pop-up menu, Certificate Manager fills in the Service URL (if available) for that signer automatically. If the Service URL is not filled in automatically, you must provide it yourself; ask your system administrator for details.
+
When you choose a Response Signer certificate from the pop-up menu,
+ Certificate Manager fills in the Service URL (if available) for that
+ signer automatically. If the Service URL is not filled in automatically,
+ you must provide it yourself; ask your system administrator for
+ details.
+
+
+
Manage CRLs
-
-
-
-
-
Manage CRLs
+
This section describes how to use the Manage CRLs dialog box. To view it,
+ follow these steps:
-
This section describes how to use the Manage CRLs dialog box. To view it, follow these steps:
-
Open the Edit menu (Mozilla menu on Mac OS X) and choose Preferences.
-
Under the Privacy & Security category, click Validation. (If no subcategories are visible, double-click Privacy & Security to expand the list.)
-
Click Manage CRLs.
+
Open the Edit menu (&brandShortName; menu on Mac OS X) and choose
+ Preferences.
+
Under the Privacy & Security category, click Validation. (If no
+ subcategories are visible, double-click Privacy & Security to expand
+ the list.)
+
Click Manage CRLs.
-
This dialog box displays a list of the CRLs that you have downloaded for use by your browser. Typically, you download a CRL by clicking a URL. FOr information about how CRLs work, see Managing CRLs.
+
This dialog box displays a list of the
+ CRLs that you have
+ downloaded for use by your browser. Typically, you download a CRL by
+ clicking a URL. For information about how CRLs work, see
+ Managing CRLs.
-
To select a CRL, click it. You can then perform any of these actions:
+
To select a CRL, click it. You can then perform any of these actions:
-
Delete: Deletes the CRL permanently from your hard disk. Don't do this unless you're sure you no longer need the CRL for validating certificates. If in doubt, consult your system administrator.
-
Settings: Opens the Automatic CRL Update Preferences dialog box, which allows you to activate automatic CRL updates for the selected CRL and specify how frequently they should be performed.
-
Update: Immediately updates the selected CRL (if possible).
-
-
The Manage CRLs dialog box provides the following information about each CRL:
-
-
-
Organization (O): The name of the organization that issued the CRL.
-
Organizational Unit (OU): The name of the organizational unit that issued the CRL (such as the root CA for a particular kind of certificate).
-
Last Update: The date on which the browser's copy of this CRL was last updated.
-
Next Update: The next date on which an updated version of this CRL will be published by the CRL issuer.
-
Auto Update: Indicates whether Auto Update has been enabled for this CRL. To view the settings that control auto updating, select the CRL and click Settings.
-
Auto Update Status:
-
-
If Auto Update has not been enabled, or if it has been enabled but the next scheduled update has not yet occurrred, this field will be blank.
-
After at least one auto update has occurred, this field shows "failed" if the most recent auto update failed, or "OK" if the most recent auto update was successful.
-
-
-
-
-
-
-
CRL Import Status
-
-
This section describes how to use the CRL Import Status dialog box, which appears when you first attempt to import a CRL or when you successfully update it manually.
-
-
This dialog box informs you
-
-
whether your attempt to import or update the CRL was successful
-
what organization issued the CRL
-
when the next update of this CRL will be published
-
whether Automatic Update is enabled for this CRL
+
Delete: Deletes the CRL permanently from your hard disk.
+ Don't do this unless you're sure you no longer need the CRL for
+ validating certificates. If in doubt, consult your system
+ administrator.
+
Settings: Opens the
+ Automatic CRL Update
+ Preferences dialog box, which allows you to activate automatic CRL
+ updates for the selected CRL and specify how frequently they should be
+ performed.
+
Update: Immediately updates the selected CRL
+ (if possible).
-
If Automatic Update is not enabled, you can turn it on from here:
-
+
The Manage CRLs dialog box provides the following information about each
+ CRL:
+
-
Yes: Click Yes to enable automatic updating of this CRL. If you click this button, the Automatic CRL Update Preferences dialog box appears next. The next section describes how to set these preferences.
-
No: Click No if you wish to leave Automatic Update disabled.
+
Organization (O): The name of the organization that
+ issued the CRL.
+
Organizational Unit (OU): The name of the organizational
+ unit that issued the CRL (such as the root CA for a particular kind of
+ certificate).
+
Last Update: The date on which the browser's copy
+ of this CRL was last updated.
+
Next Update: The next date on which an updated version
+ of this CRL will be published by the CRL issuer.
+
Auto Update: Indicates whether Auto Update has been
+ enabled for this CRL. To view the settings that control auto updating,
+ select the CRL and click Settings.
+
Auto Update Status:
+
+
If Auto Update has not been enabled, or if it has been enabled but
+ the next scheduled update has not yet occurrred, this field will be
+ blank.
+
After at least one auto update has occurred, this field shows
+ "failed" if the most recent auto update failed, or
+ "OK" if the most recent auto update was successful.
+
+
-
-
-
-
-
Automatic CRL Update Preferences
+
CRL Import Status
+
+
This section describes how to use the CRL Import Status dialog box, which
+ appears when you first attempt to import a CRL or when you successfully
+ update it manually.
+
+
This dialog box informs you
+
+
+
whether your attempt to import or update the CRL was successful
+
what organization issued the CRL
+
when the next update of this CRL will be published
+
whether Automatic Update is enabled for this CRL
+
+
+
If Automatic Update is not enabled, you can turn it on from here:
+
+
+
Yes: Click Yes to enable automatic updating of this CRL.
+ If you click this button, the Automatic CRL Update Preferences dialog box
+ appears next. The next section describes how to set these preferences.
+
No: Click No if you wish to leave Automatic Update
+ disabled.
+
+
+
Automatic CRL Update Preferences
+
+
This section describes how to use the Automatic CRL Update Preferences
+ dialog box. If you are not already viewing it, follow these steps:
-
This section describes how to use the Automatic CRL Update Preferences dialog box. If you are not already viewing it, follow these steps:
-
Open the Edit menu (Mozilla menu on Mac OS X) and choose Preferences.
-
Under the Privacy & Security category, click Validation. (If no subcategories are visible, double-click Privacy & Security to expand the list.)
-
Click Manage CRLs, then select the CRL whose auto update preferences you want to view or change.
-
Click Settings.
+
Open the Edit menu (&brandShortName; menu on Mac OS X) and choose
+ Preferences.
+
Under the Privacy & Security category, click Validation. (If no
+ subcategories are visible, double-click Privacy & Security to expand
+ the list.)
+
Click Manage CRLs, then select the CRL whose auto update preferences you
+ want to view or change.
+
Click Settings.
-
This dialog box displays the following options and information:
+
This dialog box displays the following options and information:
-
Enable Automatic Update for this CRL: Select this option if you want the CRL you selected to be updated automatically according to the schedule you set here. (Note that you can't select this option if the CRL doesn't specify a Next Update date.)
-
If you enable Automatic Update, you must select one of these radio buttons:
-
-
Update X days before Next Update date. Select this option if you want to base the update frequency on the frequency with which the CRL publisher publishes a new version of the CRL.
-
Update every X days. Select this option if you want to specify an update interval unrelated to the CRL's Next Update date.
-
-
CRL would be imported from: Indicates the URL from which the browser originally imported the CRL. This setting cannot be changed. To specify a different location, delete the CRL and re-import it from the new location.
-
Previous Consecutive Update Failures: Indicates how many times update attempts for this CRL have failed consecutively, including the most recent failure:
-
-
If the most recent attempt was successful, this reads "None" even if there were previous unsuccessful attempts.
-
If the most recent attempt failed, this indicates the number of consecutive failures and the error message for the most recent failure.
-
+
Enable Automatic Update for this CRL: Select this option
+ if you want the CRL you selected to be updated automatically according to
+ the schedule you set here. (Note that you can't select this option if
+ the CRL doesn't specify a Next Update date.)
-
Click OK to confirm your choices.
+
If you enable Automatic Update, you must select one of these radio
+ buttons:
+
+
Update X days before Next Update date. Select this
+ option if you want to base the update frequency on the frequency with
+ which the CRL publisher publishes a new version of the CRL.
+
Update every X days. Select this option if you want
+ to specify an update interval unrelated to the CRL's Next Update
+ date.
+
+
+
CRL would be imported from: Indicates the URL from which
+ the browser originally imported the CRL. This setting cannot be changed. To
+ specify a different location, delete the CRL and re-import it from the new
+ location.
+
Previous Consecutive Update Failures: Indicates how
+ many times update attempts for this CRL have failed consecutively,
+ including the most recent failure:
+
+
If the most recent attempt was successful, this reads
+ "None" even if there were previous unsuccessful
+ attempts.
+
If the most recent attempt failed, this indicates the number of
+ consecutive failures and the error message for the most recent
+ failure.