Defaults, Constraints, And Extensions For Certificates And Crls; Defaults Reference; Authority Info Access Extension Default - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

Appendix B. Defaults, Constraints, and
Extensions for Certificates and CRLs
This appendix explains both the standard certificate extensions defined by X.509 v3 and the
extensions defined by Netscape that were used in versions of products released before X.509 v3
was finalized. It provides recommendations for extensions to use with specific kinds of certificates,
including PKIX Part 1 recommendations.
IMPORTANT
This appendix is a reference for defaults, constraints, and certificate and CRL extensions
that are used or are configurable in Red Hat Certificate System. For a complete reference
and explanation of certificate and CRL extensions, see
This appendix contains the following sections:
Section B.1, "Defaults Reference"
•
Section B.2, "Constraints Reference"
•
Section B.3, "Standard X.509 v3 Certificate Extension Reference"
•
Section B.4, "CRL Extensions"
•
B.1. Defaults Reference
Defaults are used to define the contents of a certificate. This section lists and defines the predefined
defaults.
B.1.1. Authority Info Access Extension Default
This default attaches the Authority Info Access extension. This extension specifies how an application
validating a certificate can access information, such as online validation services and CA policy data,
about the CA that has issued the certificate. This extension should not be used to point directly to
the CRL location maintained by a CA; the CRL Distribution Points extension,
Distribution Points Extension
For general information about this extension, see
The following constraints can be defined with this default:
• Extension Constraint; see
• No Constraints; see
This default can define up to five locations, with parameters for each location. The parameters are
marked with an n in the table to show with which location the parameter is associated.
Parameter
Critical
Default", provides references to CRL locations.
Section B.2.3, "Extension
Section B.2.6, "No Constraint".
RFC 3280
Section B.3.1, "authorityInfoAccess".
Constraint".
Description
Select true to mark this extension critical; select
false to mark the extension noncritical.
1
.
Section B.1.4, "CRL
423