Signing Algorithm Constraint; Subject Name Constraint - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

Appendix B. Defaults, Constraints, and Extensions for Certificates and CRLs
B.2.9. Signing Algorithm Constraint
The Signing Algorithm constraint checks if the signing algorithm in the certificate request satisfies the
criteria set in this constraint.
Parameter
signingAlgsAllowed
Table B.25. Signing Algorithms Constraint Configuration Parameters
B.2.10. Subject Name Constraint
The Subject Name constraint checks if the subject name in the certificate request satisfies the criteria.
Parameter
Pattern
Table B.26. Subject Name Constraint Configuration Parameters
The Subject Name constraint supports all regular-expression constructs listed in
j2se/1.4.1/docs/api/java/util/regex/Pattern.html. This allows wildcards such as asterisks (*) to search
for any number of the characters and periods (.) to search for any type character.
For example, if the pattern of the subject name constraint is set to uid=.*, the certificate profile
framework checks if the subject name in the certificate request matches the pattern. A subject name
like uid=user, o=Example, c=US satisfies the pattern uid=.*. The subject name cn=user,
o=example,c=US does not satisfy the pattern. uid=.* means the subject name must begin with the
uid attribute; the period-asterisk (.*) wildcards allow any type and number of characters to follow
uid.
It is possible to require internal patterns, such as .*ou=Engineering.*, which requires
the ou=Engineering attribute with any kind of string before and after it. This matches
cn=jdoe,ou=internal,ou=west coast,ou=engineering,o="Example Corp",st=NC as
well as uid=bjensen,ou=engineering,dc=example,dc=com.
Lastly, it is also possible to allow requests that are either one string or another by setting a
pipe sign (|) between the options. For example, to permit subject names that contain either
456
Description
Sets the signing algorithms that can be specified
to sign the certificate. The algorithms can be any
or all of the following:
• MD2withRSA
• MD5withRSA
• SHA1withRSA
• SHA256withRSA
• SHA512withRSA
• SHA1withEC (if ECC is enabled)
The algorithm can also be set to -, which means
the server picks the best available signing
algorithm that is compatible with the key type
(RSA).
Description
Specifies a regular expression as a string.
http://java.sun.com/