XEDIA-PKI-MIB
AI MIB Summary
The XEDIA-PKI-MIB enables SNMP-based monitoring and configuration of Xedia hardware and software components within a Public Key Infrastructure, specifically tracking certificate lifecycle states, key pair attributes, and PKI subsystem operational parameters.
This module defines objects for management of Xedia's Public Key Infrastructure subsystem.
Main OID:
xediaPkiMIB.1.3.6.1.4.1.838.3.24
61
Objects
Active
Status
4
Dependencies
Imported Objects
Objects
61 total| Object Name |
|---|
xediaPkiMIBThis module defines objects for management of Xedia's
Public Key Infrastructure subsystem. MODULE-IDENTITY .1.3.6.1.4.1.838.3.24 |
pkiObjects OBJECT IDENTIFIER .1.3.6.1.4.1.838.3.24.1 |
pkiSubsystemGroup OBJECT IDENTIFIER .1.3.6.1.4.1.838.3.24.1.1 |
pkiSubjNameFormatThis object is used to specify the format of the
subject name(s) for this system in PKI certificates
and requests.
There are multiple options for forming the subject's
distinguished name. distNameFromLDAP(0) will use the
system's LDAP directory name. distNameFromRtrAddr(1)
will use the system's router IP address. If both
options are disabled, then the pkiSubjDistName
is set explicitly by the administrator. Default is
distNameFromRtrAddr(1).
The incIpAddrExt(3) option specifies that the system's
router IP address (if configured) should be included
as a subject alternate name extension in certificate
requests. By default, this option is enabled.
The incFQDomainNameExt(4) option specifies that the
system's fully qualified domain name (if configured)
should be included as a subject alternate name extension
in certificate requests. By default, this option is
enabled.rw BIT STRING { distNameFromRtrAddr(0) -- following are not yet supported -- distNameFromLDAP(1), -- incIpAddrExt(2), -- incFQDomainNameExt(3) } .1.3.6.1.4.1.838.3.24.1.1.1 |
pkiSubjDistNameThe X500 distinguished name for this system. This name
corresponds to the subject name in this gateway's
certificates and requests. For example:
'C=US, O=Xedia Corp, CN=198.202.232.217'
This object can be set explicitly or may reflect the
system's LDAP or router address as specified by
pkiSubjNameFormat.rw DisplayString .1.3.6.1.4.1.838.3.24.1.1.2 |
pkiLdapServerThe name of the LDAP Server used as the default Certificate
and CRL repository. This may be in the form of a DNS or
IP address with an optional port number specified after a
colon. For example:
'ldap.xedia.com'
'198.202.232.121'
'ldap.xedia.com:389'
'198.202.232.121:389'
When this object is set to a valid server, LDAP is automatically
enabled as a PKI certificate and CRL retrieval mechanism. If
cleared, LDAP is disabled for PKI purposes.rw DisplayString .1.3.6.1.4.1.838.3.24.1.1.3 |
pkiKeyPairTableThe PKI key pair table is used to administer
public/private key pairs for this system. SEQUENCE OF PkiKeyPairEntry .1.3.6.1.4.1.838.3.24.1.2 |
pkiKeyPairEntryThe attributes of a single PKI Key Pair. Note that a
PkiKeyPairEntry cannot be modified if referenced by a
PkiCertRqstEntry. PkiKeyPairEntry .1.3.6.1.4.1.838.3.24.1.2.1 |
pkiKeyPairNameThe administrative name given to the key pair. PkiKeyPairName .1.3.6.1.4.1.838.3.24.1.2.1.1 |
pkiKeyPairAlgorithmThe algorithm used to generate the key pair.rw PkiAlgorithm .1.3.6.1.4.1.838.3.24.1.2.1.2 |
pkiKeyPairLengthThe length of the public key in bits.
For RSA keys, the valid range is 512 to 2048,
and the default is 1024.
For DSS keys, the valid range is 512 to 1024,
and the default is 1024.rw Integer32 .1.3.6.1.4.1.838.3.24.1.2.1.3 |
pkiKeyPairRowStatusThis object is used to create and delete entries in this
table.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.2.1.4 |
pkiCertRqstTableThe PKI key pair table is used to administer PKCS #10
certificate requests for this system. SEQUENCE OF PkiCertRqstEntry .1.3.6.1.4.1.838.3.24.1.3 |
pkiCertRqstEntryThe attributes of a single PKCS #10 certificate request. PkiCertRqstEntry .1.3.6.1.4.1.838.3.24.1.3.1 |
pkiCertRqstPublicKeyThe system's public key included in this certificate
request. This object references an entry in the
pkiKeyPairTable. PkiKeyPairName .1.3.6.1.4.1.838.3.24.1.3.1.1 |
pkiCertRqstSigAlgorithmThe signature algorithm used to sign the public key
information in this certificate request. For both RSA
and DSA key pairs, the hash will default to SHA-1.rw PkiSigAlgorithm .1.3.6.1.4.1.838.3.24.1.3.1.2 |
pkiCertRqstSignatureThe signature of the certificate request. After the
certificate request is tranported to the CA, many
CAs display the certificate request signature and
suggest that it is checked against the signature
on the generating system.ro OCTET STRING .1.3.6.1.4.1.838.3.24.1.3.1.3 |
pkiCertRqstPemThe full ANS.1 DER encoded PKCS #10 certificate request
in PEM/base64 format. This object may be manually cut and
pasted over to the certificate authority for X.509
certificate generation.ro PemString .1.3.6.1.4.1.838.3.24.1.3.1.4 |
pkiNewCertX.509 Certificate generated by a Certificate Authority
based on the pkiPublicKeyCertRequest information in
base64/PEM format.
This object provides a manual mechanism for the
administrator to load static certificates into the
pkiCertTable. When this object is written, the system
parses the certificate and loads it into the local
certificate database as a static entry.rw PemString .1.3.6.1.4.1.838.3.24.1.4 |
pkiCertTableThis table contains the certificates in the system's local
database including static certificates loaded via network
management and dynamic certificates retrieved from
certificate operational protocols such as LDAP. SEQUENCE OF PkiCertEntry .1.3.6.1.4.1.838.3.24.1.5 |
pkiCertEntryThe attributes that make up a single certificate. PkiCertEntry .1.3.6.1.4.1.838.3.24.1.5.1 |
pkiCertIndexThe unique index for this certificate.ro Integer32 .1.3.6.1.4.1.838.3.24.1.5.1.1 |
pkiCertSubjNamesThe subject name(s) of the network entity or
user being certified. The certificate's subject name
can consist of multiple names including distinguished name
fields, IP Address, domain name, etc. This object
concatenates all these names into one string.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.5.1.2 |
pkiCertIssuerNamesThe name(s) of the certificate authority which issued
this certificate. The certificate's issuer name can consist
of multiple names including distinguished name fields, IP
Address, domain name, etc. This object concatenates all these
names into one string.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.5.1.3 |
pkiCertKeyPairThis system's public/private keypair associated with
this certificate. If the certificate is not for this
gateway, the object will be a zero length string.ro PkiKeyPairName .1.3.6.1.4.1.838.3.24.1.5.1.4 |
pkiCertTypeThe type of certificate.ro PkiCertType .1.3.6.1.4.1.838.3.24.1.5.1.5 |
pkiCertSerialNumThe serial number for this certificate.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.5.1.6 |
pkiCertValidNotBeforeThe start of the validity period for this certificate.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.5.1.7 |
pkiCertValidNotAfterThe end of the validity period for this certificate.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.5.1.8 |
pkiCertCreationSpecifies how the certificate was obtained. If a
dynamic certificate is modified via network management,
it becomes 'static'.ro Enumeration .1.3.6.1.4.1.838.3.24.1.5.1.9 |
pkiCertCertAuthorityIndicates whether or not this certificate is for a
Certificate Authority.ro TruthValue (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.5.1.10 |
pkiCertCrlIssuerCertificate Authorities periodically issue Certificate Revocation
Lists (CRLs) for certificates which have been revoked. Certificates
issued by a CA need to be checked against a current CRL issued by
the CA, otherwise they cannot be trusted.
By default, all CA's are considered CRL issuers. Disabling this
object disables CRL checking when computing trust for subordinate
certificates.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.5.1.11 |
pkiCertTrustStatusThe certificate's current trust status. If the trust
computation succeeds, it will be 'trusted(0)' otherwise
this object will give the set of errors detected
while computing the trust status for this certificate.
To be trusted(0), all issuer certificates in the chain must be
trusted. Note that when a self signed root certificate is
added, the trustStatus remains 'untrustedRoot(7)' until it is
manually set trusted via pkiCertForceTrusted. This gives the
administrator the opportunity to view and verify a root
certificate before it is used to verify subordinate certificates.ro BIT STRING { trusted(0), -- everything checks out computing(1), -- in process of being computed noIssuer(2), -- no issuer certificate issuerUntrusted(3), -- issuer's certificate -- not trusted noIssuerCRL(4), -- no recent CRL from issuer -- who does issue CRLs revoked(5), -- certificate revoked pathLengthExceeded(6), -- certificate exceeded path -- length of a parent CA validityPeriod(7), -- certificate validity period -- invalid signatureCheck(8), -- issuer signature not valid untrustedRoot(9) -- self signed root must be -- set trusted } .1.3.6.1.4.1.838.3.24.1.5.1.12 |
pkiCertForceTrustedA mechanism whereby the administrator can set any certificate
trusted. Enabling 'forceTrusted' will set the certificate
trusted for it's entire validity period and if it's a CA
certificate may result in subordinate certificates becoming
trusted. Note that 'forceTrusted' must be set enabled for
root certificates.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.5.1.13 |
pkiCertSubjPubKeyAlgorithmThe subject's public key algorithm.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.5.1.14 |
pkiCertSignatureAlgorithmThe algorithm used to sign the certificate.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.5.1.15 |
pkiCertSignatureThe certificate's digital signature. After loading
a CA certificate, it is recommended that this
value be checked against the CA certificate
signature to verify that the certificate was not
compromised in transit.ro OCTET STRING .1.3.6.1.4.1.838.3.24.1.5.1.16 |
pkiCertRemoveThis object is used to delete certificates.rw Enumeration .1.3.6.1.4.1.838.3.24.1.5.1.17 |
pkiNewCrlX.509 Certificate Revocation list generated by a
Certificate Authority in base64/PEM format.
This object provides a manual mechanism for the
administrator to load static CRLS into the pkiCrlTable.
When this object is written, the system parses the CRL
and loads it into the local CRL database as a static entry.rw PemString .1.3.6.1.4.1.838.3.24.1.6 |
pkiCrlTableThis table contains the CRLs in the system's local
database including static CRLs loaded via network
management and dynamic CRLs retrieved from
operational protocols such as LDAP. SEQUENCE OF PkiCrlEntry .1.3.6.1.4.1.838.3.24.1.7 |
pkiCrlEntryThe attributes that make up a single CRL. PkiCrlEntry .1.3.6.1.4.1.838.3.24.1.7.1 |
pkiCrlIndexThe unique index for this CRL.ro Integer32 .1.3.6.1.4.1.838.3.24.1.7.1.1 |
pkiCrlIssuerNamesThe name(s) of the certificate authority which issued
this CRL. The CRL's issuer name can consist of multiple names
including distinguished name fields, IP Address, domain name,
etc. This object concatenates all these names into one string.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.7.1.2 |
pkiCrlNumberThe CRL number which is unique for all CRLs issued by a
particular CA.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.7.1.3 |
pkiCrlTypeThe type of certificates in the CRL.ro PkiCertType .1.3.6.1.4.1.838.3.24.1.7.1.4 |
pkiCrlUpdateTimeThe time when this CRL was updated.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.7.1.5 |
pkiCrlNextUpdateTimeThe time when this CRL will be updated next.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.7.1.6 |
pkiCrlTrustStatusThe CRL's current trust status. If the trust computation
succeeds, it will be 'trusted(0)' otherwise this object will
give the set of errors detected while computing the trust
status for this CRL. To be trusted, all issuer certificates
in the chain must be trusted.ro BIT STRING { trusted(0), -- everything checks out noIssuer(1), -- no issuer certificate issuerUntrusted(2), -- issuer's certificate -- not trusted validityPeriod(3), -- validity period invalid updateDue(4), -- next crl update due signatureCheck(5) -- issuer signature not valid } .1.3.6.1.4.1.838.3.24.1.7.1.7 |
pkiCrlCreationSpecifies how the CRL was obtained. If a dynamic
CRL is modified via network management, it becomes
'static'.ro Enumeration .1.3.6.1.4.1.838.3.24.1.7.1.8 |
pkiCrlRevokedCertsThe number of revoked certificates in this CRL.ro Gauge32 .1.3.6.1.4.1.838.3.24.1.7.1.9 |
pkiCrlRemoveThis object is used to delete CRLs.rw Enumeration .1.3.6.1.4.1.838.3.24.1.7.1.10 |
pkiCrlCertTableThis table contains the list of revoked certificates from
CRLs in the pkiCrlTable. SEQUENCE OF PkiCrlCertEntry .1.3.6.1.4.1.838.3.24.1.8 |
pkiCrlCertEntryA revoked certificate entry from a CRL. PkiCrlCertEntry .1.3.6.1.4.1.838.3.24.1.8.1 |
pkiCrlCertIndexThe unique index for this CRL certificate.ro Integer32 .1.3.6.1.4.1.838.3.24.1.8.1.1 |
pkiCrlCertSerialNumberThe serial number for the revoked certificate.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.8.1.2 |
pkiCrlCertRevokedDateThe date and time at which the certificate was revoked.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.8.1.3 |
pkiCrlCertInvalidDateThe date and time at which the certificate becomes invalid.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.8.1.4 |
pkiCrlCertIssuerNamesThe name(s) of the certificate authority which revoked
the certificate. The certificate's issuer name can consist
of multiple names including distinguished name fields, IP
Address, domain name, etc. This object concatenates all these
names into one string.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.838.3.24.1.8.1.5 |
pkiConformance OBJECT IDENTIFIER .1.3.6.1.4.1.838.3.24.2 |
pkiCompliances OBJECT IDENTIFIER .1.3.6.1.4.1.838.3.24.2.1 |
pkiGroups OBJECT IDENTIFIER .1.3.6.1.4.1.838.3.24.2.2 |