Basicconstraintsext Rule - Netscape MANAGEMENT SYSTEM 4.5 - PLUG-IN Manual

BasicConstraintsExt Plug-in Module
Description of parameters defined in the BasicConstraintsExt module (Continued)
Table 4-4
Parameter Description
Specifies the path length, the maximum number of CA certificates that may be
maxPathLen
chained below (subordinate to) the subordinate CA certificate being issued. Note that
the path length you specify affects the number of CA certificates to be used during
certificate validation. The chain starts with the end-entity certificate being validated
and moving up the chain.
The maxPathLen parameter has no effect if the extension is set in end-entity
certificates.
Permissible values: 0 or n. Make sure that the value you choose is less than the path
length specified in the Basic Constraints extension of the CA signing certificate
(owned by the CA that will issue these certificates).
• 0 specifies that no subordinate CA certificates are allowed below the subordinate
• n must be an integer greater than zero. It specifies at the most n subordinate CA
• If you leave the field blank, the path length defaults to a value that is determined
Example: 2

BasicConstraintsExt Rule

The rule named
BasicConstraintsExt
creates this rule during installation. By default, the rule is configured as follows:
• The rule is enabled.
• The predicate expression is set (
that the extension gets added to CA certificates only.
• The extension is marked critical to comply with the PKIX recommendation.
148 Netscape Certificate Management System Plug-ins Guide • October 2001
CA certificate being issued—that is, only an end-entity certificate may follow in
the path.
certificates are allowed below the subordinate CA certificate being used.
by the path length set on the Basic Constraints extension in the issuer's certificate.
If the issuer's path length is unlimited, the path length in the subordinate CA
certificate will also be unlimited. If the issuer's path length is an integer greater
than zero, the path length in the subordinate CA certificate will be set to a value
that's one less than the issuer's path length; for example, if the issuer's path length
is 4, the path length in the subordinate CA certificate will be set to 3.
BasicConstraintsExt
module. Certificate Management System automatically
is an instance of the
predicate=HTTP_PARAMS.certType==ca
) so