Netscape MANAGEMENT SYSTEM 4.5 - PLUG-IN Manual page 214

NSCertTypeExt Plug-in Module
The Netscape certificate type extension policy has been implemented in such a way
that it enables you to set the appropriate certificate-type bits for certificates being
issued by Certificate Management System. This way, you can restrict the purposes
for which a certificate should be used by adding the extension, with the
appropriate bits set, to the certificate at the time of issuance. For example, if you
want to restrict a certificate to be used for SSL client authentication only, when
issuing the certificate you would add the Netscape certificate type extension to the
certificate with
Netscape certificate type extension, see "netscape-cert-type" on page 367.
In the current implementation, you can specify whether to add the extension to
certificates on the server side and which bits in the extension are to be set on the
client side—you specify whether to add the extension by enabling the Netscape
certificate type extension policy and which bits are to be set by adding the
appropriate HTTP variables to the enrollment forms.
Bits set in the Netscape certificate type extension are formed from pre-defined
input variables that you can embed as hidden values in the default enrollment
forms (see "Enrollment Forms" on page 55). Table 4-19 lists the HTTP input
variables that correspond to Netscape certificate type extension bits.
Table 4-19 HTTP input variables for Netscape certificate type extension bits
HTTP input variable
ssl_client
ssl_server
email
object_signing
ssl_ca
email_ca
object_signing_ca
During installation, Certificate Management System automatically creates an
instance of the Netscape certificate type extension policy for the various types of
certificates that you may want the server to issue. See "NSCertTypeExt Rule" on
page 218.
214 Netscape Certificate Management System Plug-ins Guide • October 2001
(bit 0) set. For general guidelines on setting the
ssl_client
Netscape certificate type extension bit
SSL Client (bit 0)
SSL Server (bit 1)
S/MIME (bit 2)
Object Signing (bit 3)
Reserved for future use (bit 4)
SSL CA (bit 5)
S/MIME CA (bit 6)
Object Signing CA (bit 7)