Genericasn1Ext Plug-In Module - Netscape MANAGEMENT SYSTEM 4.5 - PLUG-IN Manual

When queried by an application on the status of a certificate, the OCSP responder
sends a digitally signed response. To generate the signature, the responder needs
to use a key. Because the signature needs to be verified by the application that
sought the response, RFC 2560 recommends that the key used for signing an OCSP
response must belong to one of the following:
• The CA that has issued the certificate, the revocation status of which is being
requested.
• A trusted OCSP responder whose public key is trusted by the application that
requested the revocation status of the certificate (as a part of validating the
certificate).
• An OCSP responder that has been authorized by the CA (that has issued the
certificate being validated) to sign OCSP responses for certificates issued by
that CA.
In this type of deployment, the CA authorizes a responder to sign OCSP
responses on its behalf by issuing a specially marked certificate to the
responder. This certificate is called the OCSP responder certificate, and it enables
OCSP-compliant applications to identify the responder as a CA-designated
responder—a responder authorized to sign OCSP responses for all certificates
issued by the CA. The special marking that the CA includes in the certificate is
the extended key usage extension with a unique value,
extension value indicates to OCSP-compliant applications that the key
associated with the certificate can be used for signing OCSP responses.
If you want to deploy a CA-delegated OCSP responder, the
enables you to add the extended key usage extension (with
the OCSP responder certificate. In addition to this extension, the responder's
signing certificate should also include the OCSP no check extension. For details, see
"OCSPNoCheckExt Plug-in Module" on page 218.

GenericASN1Ext Plug-in Module

The
GenericASN1Ext
policy. This policy enables you to configure Certificate Management System to add
custom extensions to certificates. Using this policy, you can add as many ASN.1
type based-extensions as required without having to write any code. Further, it
eliminates the dependency on the command-line tools for generating base-64
encoded standard extensions from the x.509 extension classes.
plug-in module implements the generic ASN.1 extension
Chapter 4
GenericASN1Ext Plug-in Module
OCSPSigning
OCSPSigningExt
OCSPSigning
Certificate Extension Plug-in Modules
. This
rule
value) to
175