Table of Contents
Advertisement
•
The maximum key size permitted for certificates is 2048 bits (
•
The exponents allowed are 3, 7, 17, and 65537 (
For details on individual parameters defined in the rule, see Table 3-9 on page 111.
You need to review this rule and make the changes appropriate for your PKI setup.
For instructions, see section "Step 2. Modify Existing Policy Rules" in Chapter 18,
"Setting Up Policies" of CMS Installation and Setup Guide. For instructions on
adding additional instances, see section "Step 4. Add New Policy Rules" in the
same chapter.
SigningAlgorithmConstraints Plug-in Module
The
SigningAlgorithmConstraints
algorithm constraints policy. This policy restricts the requested signing algorithm
to be one of the algorithms supported by Certificate Management System: MD2
with RSA, MD5 with RSA, and SHA-1 with RSA, if the Certificate Manager's
signing key is RSA and SHA-1 with DSA, if the Certificate Manager's signing key is
DSA.
When a Certificate Manager digitally signs a message, it generates a compressed
version of the message called a message digest. Some of the algorithms used to
produce this digest include MD5 and SHA-1 (Secure Hash Algorithm).
•
MD5 generates a 128-bit message digest. Most existing software applications
that handle certificates only support MD5.
•
SHA-1 generates a 160-bit message digest. Some software applications do not
yet support the SHA-1 algorithm. For example, Netscape Navigator 3.0 (or
higher) and Enterprise Server 2.01 (or higher) support SHA-1; previous
versions of these applications do not support SHA-1.
You may apply this policy to end-entity certificate enrollment and renewal
requests.
During installation, Certificate Management System automatically creates an
instance of the signing algorithm constraints policy. See "SigningAlgRule Rule" on
page 116.
SigningAlgorithmConstraints Plug-in Module
exponents=3,7,17,65537
plug-in module implements the signing
Chapter 3
Constraints Policy Plug-in Modules
).
maxSize=2048
).
113
Advertisement
Table of Contents
