Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual page 461

Parameter
ExcludedSubtreeEnable_n
Table B.9. Name Constraints Extension Default Configuration Parameters
Name Constraints Extension Default
Description
• For URIName, the value must be a non-relative
URI following the URL syntax and encoding
rules. The name must include both a scheme,
such as http, and a fully qualified domain
name or IP address of the host. For example,
http://testCA.example.com. Certificate System
supports both IPv4 and IPv6 addresses.
• For IPAddress, the value must be a
valid IP address. An IPv4 address must
be in n.n.n.n format, with netmask in
n.n.n.n,m.m.m.m format. For example,
128.21.39.40, 128.21.39.40,255.255.255.00.
An IPv6 address uses a 128-bit namespace,
with the IPv6 address separated by colons
and the netmask separated by periods. For
example, 0:0:0:0:0:0:13.1.68.3, FF01::43,
0:0:0:0:0:0:13.1.68.3,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:25
and
FF01::43,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FF00:0000.
• For OIDName, the value must be a unique,
valid OID specified in dot-separated
numeric component notation. For example,
1.2.3.4.55.6.5.99.
• For OtherName, the values are names
with any other format. This supports
PrintableString, IA5String,
UTF8String, BMPString, Any, and
KerberosName. PrintableString,
IA5String, UTF8String, BMPString, and
Any set a string which specifies the path to
a file containing the base-64 encoded string
of the subtree, such as /var/lib/pki-ca/
othername.txt. KerberosName has the
format Realm|NameType|NameStrings, such
as realm1|0|userID1,userID2.
OtherName must have the format
(type)oid,string. For example,
(IA5String)1.2.3.4,MyExample.
Select true to enable this excluded subtree
entry.
439