Subcanameconstraints Rule - Netscape MANAGEMENT SYSTEM 4.5 - PLUG-IN Manual

SubCANameConstraints Plug-in Module
Table 3-11 Description of parameters defined in the SubCANameConstraints module
Parameter Description
Specifies whether the rule is enabled or disabled. Check the box to enable the rule.
enable
Uncheck the box to disable the rule (default).
• If you enable the rule and set the remaining parameters correctly, the server
• If you disable the rule, the server does not check the CA certificate requests for
Specifies the predicate expression for this rule. If you want this rule to be applied to
predicate
all certificate requests, leave the field blank (default). To form a predicate expression,
see section "Using Predicates in Policy Rules" in Chapter 18, "Setting Up Policies" of
CMS Installation and Setup Guide.
Example: HTTP_PARAMS.certType==ca

SubCANameConstraints Rule

The rule named
SubCANameConstraints
creates this rule during installation. By default, the rule is configured as follows:
• The rule is enabled.
• The predicate expression is left blank so that the rule is applied to all certificate
enrollment and renewal requests processed by the server.
For details on individual parameters defined in the rule, see Table 3-12 on
page 120. You need to review this rule and make the changes appropriate for your
PKI setup. For instructions, see section "Step 2. Modify Existing Policy Rules" in
Chapter 18, "Setting Up Policies" of CMS Installation and Setup Guide. For
instructions on adding additional instances, see section "Step 4. Add New Policy
Rules" in the same chapter.
118 Netscape Certificate Management System Plug-ins Guide • October 2001
checks the certificate requests for issuer name uniqueness. If a certificate with the
requested issuer name already exists in the internal database, the server rejects the
request.
issuer name uniqueness.
SubCANameConstraints
module. Certificate Management System automatically
is an instance of the