Subjectaltnameext Rule - Netscape MANAGEMENT SYSTEM 4.5 - PLUG-IN Manual

SubjectAltNameExt Plug-in Module

SubjectAltNameExt Rule

The policy rule named
SubjectAltNameExt
creates this rule during installation. By default, the rule is configured as follows:
• The rule is enabled.
• The predicate expression is left blank so that the extension gets added to all
certificates the server issues. (PKIX and Federal PKI standards recommend that
CA certificates must have this extension and end-entity certificates should
have this extension.)
• The extension is marked noncritical (to comply with the PKIX
recommendation).
• The rule is configured to include at the most three alternative names in the
extension (
• The first alternative name is the value of the
subject's directory entry (
and the name is in the
(
• The second alternative name is the value of the
attribute in the certificate subject's directory entry
(
name is in the
(
• The third alternative name is the value of an HTTP input parameter
csrRequestorEmail
(
name is in
(
For details on individual parameters defined in the rule, see Table 4-26 on
page 236. You need to review this rule and make the changes appropriate for your
PKI setup. For instructions, see section "Step 2. Modify Existing Policy Rules" in
Chapter 18, "Setting Up Policies" of CMS Installation and Setup Guide. For
instructions on adding additional instances, see section "Step 4. Add New Policy
Rules" in the same chapter.
Before you edit the default rule, you should read the additional details about the
attributes that are set in the default policy rule.
238 Netscape Certificate Management System Plug-ins Guide • October 2001
SubjectAltNameExt
module. Certificate Management System automatically
numGeneralNames=3
generalName0.generalNameChoice=rfc822Name
generalName1.requestAttr=AUTH_TOKEN.mailalternateaddress
rfc822Name
generalName1.generalNameChoice=rfc822Name
included in the certificate request
generalName2.requestAttr=HTTP_PARAMS.csrRequestorEmail
rfc822Name
generalName2.generalNameChoice=rfc822Name
is an instance of the
).
generalName0.requestAttr=AUTH_TOKEN.mail
format
rfc822Name
format
format
attribute in the certificate
mail
).
mailalternateaddress
).
).
)
) and the
) and the