Authinfoaccessext Plug-In Module - Netscape MANAGEMENT SYSTEM 4.5 - PLUG-IN Manual

AuthInfoAccessExt Plug-in Module

For general guidelines on developing custom policy modules and adding them to
the CMS policy framework, take a look at the samples installed at these locations:
<server_root>/cms_sdk/cms_jdk/samples/policies
For instructions to configure a Certificate Manager and Registration Manager to
use one or more of the policy modules, see section "Configuring Policy Rules for a
Subsystem" in Chapter 18, "Setting Up Policies" of CMS Installation and Setup
Guide.
AuthInfoAccessExt Plug-in Module
The
AuthInfoAccessExt
access extension policy. This policy enables you to configure Certificate
Management System to add the Authority Information Access Extension defined in
X.509 and PKIX standard RFC 2459 (see
http://www.ietf.org/rfc/rfc2459.txt
how an application validating a certificate can access information, such as on-line
validation services and CA policy statements, about the CA that has issued the
certificate in which the extension appears. Note that this extension should not be
used to point directly to the CRL location maintained by a CA; the CRL
Distribution Points extension explained in "CRLDistributionPointsExt Plug-in
Module" on page 164 allows you to reference to CRL locations.
The PKIX standard recommends that you may include the authority information
access extension in end-entity and CA certificates and that the extension be marked
noncritical. For general guidelines on setting the authority information access
extension, see "authorityInfoAccess" on page 341.
The authority information access extension policy in Certificate Management
System allows you to set the authority information access extension as defined in
its X.509 definition. The policy enables you to specify any number of access points
for CA information. For each access point, you can specify the access method,
actual location that contains the additional information about the CA, and the
mechanism for retrieving the information. The location can be specified in any of
the following general-name forms: an rfc822name, a directory name, a DNS name,
an EDI party name, a uniform resource indicator (URI), an IP address, an object
identifier (OID), and any other name.
134 Netscape Certificate Management System Plug-ins Guide • October 2001
plug-in module implements the authority information
) to certificates. The extension specifies