Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual page 439

Table 11-8 Name Constraints Extension Default Configuration Parameters
Parameter
critical
permittedSubtrees
<n>.
min
permittedSubtrees
max_<n>
PermittedSubtree
NameChoice_<n>
PermittedSubtree
NameValue_<n>
Description
Select true to mark this extension critical; select false to mark the
extension noncritical.
Specifies the minimum number of permitted subtrees.
• -1 specifies that the field should not be set in the extension.
• 0 specifies that the minimum number of subtrees is zero.
• n must be an integer that is greater than zero. It specifies at the
most n subtrees are allowed.
Specifies the maximum number of permitted subtrees.
• -1 specifies that the field should not be set in the extension.
• 0 specifies that the maximum number of subtrees is zero.
• n must be an integer that is greater than zero. It specifies at the
most n subtrees are allowed.
Specifies the general-name type for the permitted subtree you want to
include in the extension.
Permissible values: RFC822Name, DirectoryName, DNSName,
EDIPartyName, URIName, IPAddress, OIDName, or
OtherName.
Specifies the general-name value for the permitted subtree you want to
include in the extension.
• If you selected RFC822Name, the value must be a valid Internet
mail address in fully-qualified DNS format. For example,
testCA@example.com.
• If you selected DirectoryName, the value must be a string form
of X.500 name, similar to the subject name in a certificate. For
example, CN=SubCA, OU=Research Dept, O=Example
Corporation, C=US.
• If you selected DNSName, the value must be a valid domain name
in the fully-qualified DNS format. For example,
testCA.example.com.
• If you selected EDIPartyName, the value must be a IA5String.
For example, Example Corporation.
Defaults Reference
Chapter 11 Certificate Profiles 439