Question about Kurts comments discussing the seperation of AIA & CDP - Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy - Kurt L Hudson MSFT

Question about the sentence in bold. What is the meaning behind this comment?
How would you separate the role of the AIA and CDP from a CA subordinate server? I can see where I add a CES and CEP server which has those as well, but I don't completely understand his comment. Because in this second step, (http://technet.microsoft.com/en-us/library/tlg-key-based-renewal.aspx)
he shows how to implement CES and CEP.
This is from the guide located at: http://technet.microsoft.com/library/hh831348.aspx
Step 3: Configure APP1 to distribute certificates and CRLs
In the extensions of the root CA, it was stated that the CRL from the root CA would be available via http://www.contoso.com/pki. Currently, there is not a PKI virtual directory on APP1, so one must be created.
In a production environment, you would typically separate the issuing CA role from the role of hosting the AIA and CDP.
However, this lab combines both in order to reduce the number of resources needed to complete the lab.
Thanks,
James

My concern is, they have a 2-3k base of xp systems, over this year they are migrating them to Windows 7. During this time they will also be upgrading hardware for the existing windows 7 machines. The turnover of certificates are going to be high, which
from what I've read here, it worries me.
http://blogs.technet.com/b/askds/archive/2009/06/24/implementing-an-ocsp-responder-part-i-introducing-ocsp.aspx
The application then can go to those locations to download the CRL. There are, however, some potential issues with this scenario. CRLs over time can get rather large
depending on the number of certificates issued and revoked. If CRLs grow to a large size, and many clients have to download CRLs, this can have a negative impact on network performance. More importantly, by
default Windows clients will timeout after 15 seconds while trying to download a CRL. Additionally,
CRLs have information about every currently valid certificate that has been revoked, which is an excessive amount of data given the fact that an application may only need the revocation status for a few certificates. So,
aside from downloading the CRL, the application or the OS has to parse the CRL and find a match for the serial number of the certificate that has been revoked.
With the above limitations, which mostly revolve around scalability, it is clear that there are some drawbacks to using CRLs. Hence, the introduction of Online Certificate
Status Protocol (OCSP). OCSP reduces the overhead associated with CRLs. There are server/client components to OCSP: The OCSP responder, which is the server component, and the OCSP Client. The OCSP Responder accepts status
requests from OCSP Clients. When the OCSP Responder receives the request from the client it then needs to determine the status of the certificate using the serial number presented by the client. First the OCSP Responder determines if it has any cached responses
for the same request. If it does, it can then send that response to the client. If there is no cached response, the OCSP Responder then checks to see if it has the CRL issued by the CA cached locally on the OCSP. If it does, it can check the revocation status
locally, and send a response to the client stating whether the certificate is valid or revoked. The response is signed by the OCSP Signing Certificate that is selected during installation. If the OCSP does not have the CRL cached locally, the OCSP Responder
can retrieve the CRL from the CDP locations listed in the certificate. The OCSP Responder then can parse the CRL to determine the revocation status, and send the appropriate response to the client.

Similar Messages

Question about Setting Window Title/the use of AVWindowSetTitle()

Hi everyone,
I have a question about setting the title of the window in which the Acrobat viewer normally opens a PDF file. The documentation states that AVWindowSetTitle() cannot be used in this case. However, using it has worked with versions of Acrobat/Reader up until and including version 8.
Everything breaks down starting with Acrobat 9.
According to the documentation I am supposed to do the following: "To set the title of a window in which the Acrobat viewer opens a PDF file, you must replace AVDocOpenFromASFileWithParams() and pass the window title in tempTitle."
Unfortunately, there are 2 problems I have with this approach:
     I do need to be able to change the document title on document Save, not only on document Open
     I do not know what AVDocOpenFromASFileWithParams() implementation has to look like if I have to replace it using HFTReplaceEntry().
Is there a sample customized implementation of AVDocOpenFromASFileWithParams() somewhere that I could take a look at?
Is there a way to change a document Title inside Acrobat/Reader window after a Save operation?
Thanks a million,
Lana2010K

     I am sorry. I don't know how you tested this and came to conclusion that this works correctly in Acrobat X.
     I just tested our Acrobat plug-in with a trial version of Acrobat X and this did not work.
     When we open a file in Acrobat (doing it ourselves in the plug-in by adding another specialized open) we set the window title to something different from the default file name. Then if a file gets edited and saved (File->Save), the window title gets reset to the file name. In the PDDocDidSave callback we call AVWindowSetTitle() to set it back to a more descriptive window title we need. This has worked up until and including Acrobat 8, but does not work in either version 9.0 or 10.0.
     Also, I just modified the plug-in code to always change the Window Title of every document (even if opened through native File->Open) on document Save. It does not work.
     Please help,
          Lana2010K

Question about Removing Permissions from the System Folder with chmod

Hi
I have a question about the removal of permissions from the System folder (and sub directories and files).
Background
Since installing a new HD, clean install of 10.6, application of updates and moving over backed up user directories I have had several issues with permissions.
I have read several threads on this and using disk warrior and other tools I have been able to fix most of the issues.
The Problem
The issue that remains is a permissions check using Disk Utility keeps reporting
ACL found but not expected on "System".
followed by an extensive list of sub directories and all.
Attempts to repair take hours and the same errors are reported.
Found Solutions
I have read about changing and/or completely removing the ACL from the permissions from the System using two different commands:
sudo chmod -R -N ./System/* ( to remove all ACLs)
or
sudo chmod -R -E ./System/* ( to replace all ACLs )
My Question is ( to the UNIX gurus):
What is the difference between the usage with -E and -R and which is the best approach for a Systems directory and (subordinates)?
Many thanks!!

OK
So I misread on the your instructions about the PW reset, did it, no harm in that. I did also select the options to reset all the permissions for all the accounts and the ACL issues were not resolved. My bad, I forgot to note that.
You do suggest getting and expert opinion but alas these are rather elusive. In most cases the Apple solutions is to do a complete reinstall... I have found that unless you completely wipe a drive and rebuild everything there are often artifacts left behind. Since I have full and redundant back-ups I would rather explore and hack a little instead of a dull old system reinstall. The irony is the system issue I had was it was the result a reinstall and combo update on a new drive. I recognize the risks of entering the realms of the System folders but I am willing to explore knowing full well that I have a path to recovery.
Thanks again for your insights. I come to the forums looking for insights and ideas but not a lecture...

Question about xml schemas and the use of unqualified nested elements

Hello,
I have the following schema:
<?xml version="1.0" encoding="UTF-8"?>
<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns="http://xml.netbeans.org/examples/targetNS"
    targetNamespace="http://xml.netbeans.org/examples/targetNS"
    elementFormDefault="unqualified">
    <xsd:element name="name" type="xsd:string"/>
    <xsd:element name="age" type="xsd:int"/>
    <xsd:element name="person">
        <xsd:complexType>
            <xsd:sequence>
                <xsd:element ref="name"/>
                <xsd:element ref="age"/>
               <xsd:element name="height" type="xsd:int"/>
            </xsd:sequence>
        </xsd:complexType>
    </xsd:element>
</xsd:schema>I am just wondering why would someone have a nested element that is unqualified? here the "height" element.
Can anyone explain this to me please?
Thanks in advance,
Julien.
here is an instance xml document
<?xml version="1.0" encoding="UTF-8"?>
<person xmlns='http://xml.netbeans.org/examples/targetNS'
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
xsi:schemaLocation='http://xml.netbeans.org/examples/targetNS file:/E:/dev/java/XML/WebApplicationXML/web/newXMLSchemaThree.xsd'>
<name>toto</name>
<age>40</age>
<height>180</height>
</person>

Don't worry about it.
There are two different styles of schemas. In one style, you define the elements, attributes, etc. at the top, and then use the "ref" form to refer to them. (I call this the "global" style.) The other style is to define elements inline where they are used. ("local" style)
Within some bounds, they work the same and which you use is a choice of you and the tools that generate the schemas.
A warning about the local style. It is possible to define an element in two different locations in the schema that are different. It will get past all schema validation, but it seems wrong to my sense of esthetics. With the global style, this will not happen.
So, how did this happen? Probably one person did the schema when it only had a name and age. Then, someone else added the height element. They either used a different tool, or preferred the other style. I'm aware of no difference in the document you have described between the two styles.
Dave Patterson

Question about what comes in the box

In the Apple store on apple.com, for an iPod 60GB, it says that earbuds, usb cable, dock adapter, a quickstart guide, itunes software, and a case come in the box. However, on circuitcity.com and bestbuy.com, it says that only the earbuds, usb cable, and quick start guide come in the box. What's going on?
iPod Windows XP

Sometimes they like to leave details out. Don't know why. If you want to know what is actually in the box just use the information the apple store gave you. It is accurate.
BestBuy and CircuitCity can't take things out of the iPod box as it comes shrink-wrapped from Apple.

TEST LAB Guide: Demonstrating Certificate Key-based Renewal from Kurt Hudson updated 24 june 2013

Hi all,
We have been working since a full week building and rebuilding on different platforms this test lab and we have encountered a lot of different errors. (3 platforms are running)
One of our test lab went nearly up to the last point but we have been unable to get rid of the error : access denied by the remote end point when we test the certificate web enrolment. This error seems well known but not the solution and the reason why.
On two other similar Test labs we had errors with certificate invalid while asking the certificate Internet Server while it was the same as the one which was working above! This was strange as we used the clone of the certificate working on the previous
lab.
the other third error was below.....
We are sure that some of you have been able to get rid of these kind of errors so as to have a final lab running properly to be able to build POC on client's premises.
Kind regards
Gerard Dumazet
[email protected]
gd

Hi all
We have rebuilt a fourth TLG without using PowerShell and with only the GUI. Everything is working now.....
If anyone as an idea why, he will be welcome! It's not encouraging for using the scripts!
Gerard Dumazet
gd

Question about versioning (history) in the latest release

Hallo,
Some questions:
1. Will versioning ever be integrated with locked pages, locked scene, colored pages, revision marks functionality etc, so that at a particular moment you can optionally augment the current versioning with the more traditional way of production revision cycles?
2. If above will not be the case (or is never activated): what currently happens with scene numbers & manual breakdown info that is already added, but than the scene gets deleted. Is all this info gone (& scenes renumbered). Can we save a version to keep this info? Please clarify.
3. Regarding breakdown of elements: will there be a way that we can visualize breakdown sheets on screen. It's much easier for me to look at it that way, e.g. the Scenechronize way (I guess I'm old).
4. Regarding breakdown and making the script 'production ready', will there be a way to combine scenes that belong together and part scenes (that are not in the same shooting location but where the writer chose to combine the action in one scene, eg like telephone conversation etc).
I guess all my questions boil down to this: will Story also aim to offer serious production breakdown features that could be used by production managers & assistant directors to prep for physical production, or will it mainly be a collaborative writing tool (even if it does allow you to transfer text into On Location shotlists and then eventually into your clips).
I guess there's a conceptual difference (at least when talking about narrative film with a lot of cast, locations, props etc): do you support mainly the writing effort and than transfer into a tool like Scenechronize once production starts - or do you go further? For (corporate) interview type shoots this matters less.
I would be interested to hear your views on the matter.
Regards,
Bavo

Yes. Versioning will be integrated with locked pages, colored pages but we are not planning to lock scenes yet. We will also show asterix against changed lines in future updates.
You can always explicitly save a version (file->save as) to mark a checkpoint draft. You can add your own comments while saving this draft so that you can find it later.
We'd like to support production related features because we want to leverage script metadata for all it can be leveraged for. That said, "full fledged" is a loaded term. We will take small steps and enable workflows related to production as we go along. Dynamic breakdown reports, that can be viewed and edited in Story are on our roadmap.
--Anubhav

Questions about Objects, pointers, and the memory that loves them

Hey,
This is all just a theoretical discussion so do understand that the code itself is not germane to the topic.
I have been mulling over the whole object release/retain/copy thing and need to understand a bit more the real inner workings of the beast. The catalyst for this is the repetitional fervor that most books on the subject of Objective C have employed. Yet they all seem to fail in a complete explanation of the whys and wherefores so that one can determine on her own the correct implementation of this.
Let's say I have an Object. For the fun of it it is an instance of NSObject and we'll call it myObject.
When I "create" this object thusly:
NSObject *myObject = [[NSObject alloc] init];
What I, in fact get back is a pointer to the object in question, yes?
So when I "seemingly" add this object to an array like:
NSArray *myArray = [[NSArray alloc] initWithObject:myObject];
What is actually placed in the array? is it another pointer to the original object created by myObject or is it a pointer to the pointer of myObject?
The reason I ask this is because I have run into a situation where some previous instructions on the subject have caused errors. I was told that if I did something like this and then passed the array to a calling method that I could release this array and it would then be the responsibility of the calling method to handle the memory. Further more if I place an object into an array and then copy it into another object of the same type as the original then I could release the array and still have the reference to the first object in the second object. When I have done this I get unpredictable results, sometimes the original object is there and sometimes it isn't
At what point should I release the array, after it is passed to the calling method (with the use of an autorelease) or when the class that it is encapsulated in is done?
Sorry about the length of this but I can't believe that I would be the only one that would be helped by such a discussion.
MM

etresoft,
Thanks for the detailed reply. I wish I could say that I wasn't still a bit confused by this. I thought I had this down after going through the lessons. It seems to not be working in practice the way that it works in theory.
My current project is an example
In a class I have declared a couple of ivars thusly:
NSMutableString *source;
NSMutableString *destination;
@property (nonatomic, retain) NSMutableString *source;
@property (nonatomic, retain) NSMutableString *destination;
This is followed by the appropriate @synthesize directives.
in the init method for my class I have the following:
source = [[NSMutableString alloc] initWithString:@"customer"];
destination = [[NSMutableString alloc] initWithString:@"home"];
in a method triggered by a button click I have the following:
if (sender == sourcePop){
source = [sourcePop titleOfSelectedItem];
}else{
destination = [destinationPop titleOfSelectedItem];
NSLog(@"SOURCE-%@", source);
NSLog(@"DESTINATION-%@", destination);
When I run the code and change the source selection the console reads the correct value for what is in the source popupbutton and "home" for the destination. If I then change the destination popupbutton I get a crash and nothing written to the console.
Placing a breakpoint at the beginning of the "if" and running shows me that just before the crash the source ivar is reported as "out of scope." There are no release or autorelease statements for this ivar anywhere in the class. Yet if I change the line that sets the ivar to the value of the popupbutton to this:
[source = [sourcePop titleOfSelectedItem] retain];
The debugger will have the correct value for the ivar and when run normally there is no crash.
I would assume that the problem is that the ivar is being released but I am not the one releasing it. Why does this behavior happen? Shouldn't the retain count still be 1 since the @property directive has it and there is no release in the code? Or is it that the statement that sets the ivar to the value of the popup really just setting it to the pointer and it is the popup that is somehow being released?
Is there something else that I should be doing?
MM

A question about backend of creating the app with Xcode

Hi,
I'm a new iphone developer who just started to learn how to create iphone apps.
I just started to learn about view-based applications.
When I select view-based applications, XCode will automatically generate some files for me.
For example, if a create a new project called "A", XCode will generate files like "AViewController.m", "AAppDelegate.m", and "main.m".
but I don't see anywhere in those files where it's actually creating the instance of "AViewController" or "AAppDelegate".
So at where and at which file are the instances of "AViewController" and "AAppDelegate" created?
Also where is the instance of the main application created?(not A.app if you know what I mean)

I hope I can add to the correct answer posted by J D McIninch since the solution to this thread might provide a good example of how xib objects work--i.e. what I tried to explain in your [previous thread|http://discussions.apple.com/message.jspa?messageID=11479911#11479911].
Daviiidddd wrote:
So at where and at which file are the instances of "AViewController" and "AAppDelegate" created?
Open MainWindow.xib and make sure the xib window is visible by selecting Document from the Windows menu. You should see a solid orange cube labeled "A App Delegate", and a circular icon labeled "A View Controller". These icons represent IB objects. The objects are described by xml elements in the xib file, and that xml will direct the system to create the real objects in memory when the xib is loaded. While it's not technically correct to say the real objects are "created by IB", we can say that the specification for the real objects is built in IB. In other words, the xib file which results from an IB editing session contains a tree of specifications which will be used to create real objects at runtime.
Btw, to graphically see the tree of xib objects (the "view hierarchy", find the +View Mode+ switch in the upper-left corner of the xib window. Select the Center position of that switch so the window displays a two column table with a tree of small icons to the left. This is the xib view I recommend for all your work.
Also where is the instance of the main application created?(not A.app if you know what I mean)
The Application object is created by the [UIApplicationMain()|http://developer.apple.com/iPhone/library/documentation/UI Kit/Reference/UIKitFunctionReference/Reference/reference.html#//apple_ref/doc/ui d/TP40006894-CH3-SW7] function called by main() in main.m. The MainWindow.xib is then loaded, and the Application object is given ownership of that xib. This means that the File's Owner proxy object represents the real Application object, so all connections to File's Owner become connections to the real Application object.
Note that the File's Owner cube is transparent. This is IB's way of denoting a proxy object. The First Responder is actually a proxy of a different kind, but let's not go there now.
\- Ray

Question about Software Updates in the Netherlands

Hello all,
! am new to the Netherlands and plan to buy the Lumia 1020. I have a question regarding FW updates over here:
Which network delivers the fastest updates generally or does the un-locked (country specific) phone get it first?
Also, if i choose to buy the phone on contract here, after the expiry of the contract, do i have to unlock the phone or will the provider do it for me? (Assuming that the phones are locked to the network in the first place, if not, please let me know!)
PS: I come from India, where we don't have phones on contracts and also receive updates very quickly!

hi mate,
generally if you want to free yourself from the constraints of networks, your best bet is to purchase an unlocked, unbranded handset from in-store or online. bear in mind that if you buy a handset from origin of another country in the EU, the warranty will still apply, but buy a 1020 that has a product code from outside the EU, then the warranty won't apply. something to be careful about.
as for operators delivering updates faster than others, this varies between updates, and really noone is able to predict this. as for the unlocking, that is between you and your network carrier, Nokia has nothing to do with this.

Question about filter-mappings in the web.xml

I'm a bit new this so apologies if this is a stupid question but want to write a filter mapping that captures /image/<identifier here> and /image/<identifier here>/size/<size here>
I would have assumed <url-pattern>/image/*</url-pattern> would do this but it doesn't. When I try a URL with /size/ in it, I get a File not found error.
So I tried adding a second mapping that uses <url-pattern>/image/*/size/*</url-pattern> and that doesn't work either.
What would be the best way to write a filter mapping that captures both /image/<identifier here> and /image/<identifier here>/size/<size here> ?

Thanks for the reply.
I did end up doing something like that in the end. I think I just couldn't get my mind into gear as usual on Monday.
What's happening is taking a nice neat human readable URL and converting it to the horrible URL used by the system. The reason it's a filter is because someone had written a tiny filter would might only execute 20 lines of code and I think someone felt it was easier to just lump about 240 more lines to execute on each request, which, even if it isn't a huge strain on the system it's nasty and most of the code is unnecessary the vast majority of the time. I'm splitting it up the whole lot based on the various tasks.
This particular functionality could be a servlet. I probably would have done it that if given the task from scratch but I think sometimes I put too much faith in the fact those with more experience should know better. I think I'll try it as a servlet and if someone has concerns about it then I'll ask them to explain to me why it can't be one.

Question about 74GB Raptor and the ubiquitous "F6"

Hey All,
I just installed my raptor and Windows XP, then SP2, etc. without any problems. I didn't press F6 before the Windows install. I'm rather disappointed with the speed of the Raptor given all the good reviews I've heard about its speed. Everything works pretty well and Windows identifies the HD. I've installed it on SATA3 in case I want to overclock. Anyway, my question is: Would reinstalling Windows but doing the whole "F6" SATA Driver install help to improve performance?
Here's my speed test results from Device Manager:
Theoretical Limit: 150
Burst Speed: 113.4
Sustained Speed: 71.3
HD is listed as WDC WD740GD-00FLA2
I have the nVidia nForce3 250 Parallel and Serial ATA Controller (v2.6) listed. I have installed newest nForce Drivers. Should I enable Command Queing? Any BIOS options that would help? Thanks!
AMD Athlon 64 3500+ 90nm Micron
MSI K8N Neo2 Platinum
WD Raptor 74GB
ATI Radeon 9800 XT
512 MB PC3200 Corsair at 2.5-3-3-6

Anyone notice performance increase or decrease of their HD when using the nVidia IDE SW drivers? particularly with a 74GB Raptor? I've also heard of burner issues when installing the IDE SW but have not used my burner yet.

A question about thread safety and the Acrobat SDK

Hi All,
On page 12 of this FAQ: http://www.adobe.com/devnet/acrobat/pdfs/Acrobat_SDK_developer_faq.pdf
It says that Use of any Acrobat product in a multithreaded way is technically impossible.
I'm currently writing a command line application to perform some basic data gathering on a PDF file. The Application only makes use of a PDDoc object, and never calls on any other kind of object (i.e. AVDoc).
The application itself is not multithreaded. All of the logic runs in a single thread.
However, the application will be called (via the command line) from another application that /is/ multithreaded. I think that this might be fine, but I wasn't sure. In this case, would this count as a single thread, but spread across multiple processes? And if that is the case, would that be OK with the SDK?
Or would having multiple invocations/calls into the Acrobat DLLs cause the same issue as a multi-threaded application?
Unfortunately, I haven't done a lot of work with threads before. This might be a very silly question.

The application would be called from a perl script that is used to automate several tasks. The app is a console application, written in C# w/ the Acrobat COM components, and Visual Studio 2005.
The console application uses the Acrobat SDK to instantiate a PDDoc object, open a PDF, and get information about the document. It then returns results back to the console.
So, the perl script just calls: "C:\pdfinfo.exe -f=myPdf.pdf" and pipes the result to a log file.
In this case, it never creates a new instance of the Acrobat application, but it does use the SDK.
The reason that I was concerned was that the perl script is multi-threaded. I wasn't sure if acrobat was just sensitive to multiple threads inside a single process, or if it was unable to handle multiple processes as well.
PDL's answer suggests that I should be fine as long as a new process is started each time. This is good to hear.

Quick Question about Cisco 3560 and the Web Device Manager

Alright, I have a quick question that I am curious about but I haven't found any information
about it.
When I log into my Cisco 3560 using the web portal to get to the Device Manager. Below the
diagram of the switch, then under the Dashboard there is section called Switch
Health, Port Utilization.
Under the Switch Health there is Bandwidth Used, Packet Error. Those two options just sit
at zero and do not move. The Port tilization graph is also sitting at zero.
Is there a way to make them functional?

Anyone notice performance increase or decrease of their HD when using the nVidia IDE SW drivers? particularly with a 74GB Raptor? I've also heard of burner issues when installing the IDE SW but have not used my burner yet.

Dumb question about searching these discussion boards

I used to be able to search these boards, but now I can't find where to do this. I tried using the top right corner search box, but that searches the Apple site for everything except discussions.
Am I blind, mad or has something changed?
Judging by my wife's comments, the first seems most likely.
Grateful for anyone that can point me in the right direction, and give me a white stick.

In the mean time you can use google with "site:discussions.apple.com" as part of the search query.

Question about Kurts comments discussing the seperation of AIA & CDP - Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy - Kurt L Hudson MSFT

Similar Messages

Maybe you are looking for