Table of Contents
Advertisement
•
ClientCertKeyUsageExt (For details, see "ClientCertKeyUsageExt Rule" on
page 197.)
•
ObjSignCertKeyUsageExt (For details, see "ObjSignCertKeyUsageExt Rule" on
page 199.)
•
CRLSignCertKeyUsageExt (For details, see "CRLSignCertKeyUsageExt" on
page 200.)
It is important that you review each policy instance and make the appropriate
changes required by your PKI setup. For instructions, see section "Step 2. Modify
Existing Policy Rules" in Chapter 18, "Setting Up Policies" of CMS Installation and
Setup Guide. For instructions on adding additional instances, see section "Step 4.
Add New Policy Rules" in the same chapter.
Additionally, as you'll notice in Figure 4-13 through Figure 4-17, the default
enrollment forms provided for requesting various types of certificates (see
"Enrollment Forms" on page 55) include the appropriate HTTP input variables that
correspond to the key-usage bits. By default only variables that correspond to
key-usage bits that need to be set are included in the form.
Typically, you won't have to change the key-usage bit setting by editing the
enrollment forms as you can do this easily by making the appropriate changes to
the policy instance (bits set on the server side override the ones set on the client
side). However, if you want to add new variables on the client side, you can do that
too. Be sure to add the new variable in the following format:
<input type="HIDDEN" name="variable_name" value=true>
where,
variable_name
The value of an HTTP input variable corresponding to a key-usage bit must be
either
or
; any other value is considered equivalent to
true
false
example, a value
tree
values
and
true
false
Configuration Parameters of KeyUsageExt
In the CMS configuration file, the
<subsystem>.Policy.impl.KeyUsageExt.class=com.netscape.certsrv.
policy.KeyUsageExt
subsystem).
In the CMS window, the module is identified as
how the configurable parameters for the module are displayed in the CMS
window.
can be any of the HTTP input variables listed in Table 4-14.
would be interpreted as
are case insensitive.
KeyUsageExt
, where
<subsystem>
Chapter 4
KeyUsageExt Plug-in Module
by the server. Note that
false
module is identified as
is
or
(prefix identifying the
ca
ra
. Figure 4-12 shows
KeyUsageExt
Certificate Extension Plug-in Modules
. For
false
189
Advertisement
Table of Contents
