Table of Contents
Advertisement
AttributePresentConstraints Plug-in Module
Default constraints-specific policy plug-in modules (Continued)
Table 3-1
Plug-in module name
RenewalValidityConstraints
RevocationConstraints
RSAKeyConstraints
SigningAlgorithmConstraints
SubCANameConstraints
UniqueSubjectNameConstraints
ValidityConstraints
AttributePresentConstraints Plug-in Module
The
AttributePresentConstraints
present constraints policy. The module enables you to configure the Certificate
Manager and Registration Manager to reject a request if an LDAP attribute (for
example,
does not have a specified value. An example usage is in "Step 3. Enable the
AttributePresentConstraints Policy" in Chapter 15, "Setting Up End-User
Authentication" of CMS Installation and Setup Guide.
Note that many of the parameters defined in the module (see Table 3-2 on page 90)
are specified in the same way as the modules provided for authenticating users
during directory-based enrollment.
88
Netscape Certificate Management System Plug-ins Guide • October 2001
Function
Enforces the number of days before which a currently active
certificate can be renewed and sets a new validity period for the
renewed certificate. For details, see "RenewalValidityConstraints
Plug-in Module" on page 104.
Allows or rejects requests for revocation of expired certificates. For
details, see "RevocationConstraints Plug-in Module" on page 108.
Certifies only those RSA keys that have specific key lengths. For
details, see "RSAKeyConstraints Plug-in Module" on page 110.
Specifies the signature algorithm to be used by the CA (a
Certificate Manager) to sign certificates. For details, see
"SigningAlgorithmConstraints Plug-in Module" on page 113.
Checks for issuer name uniqueness and prevents a CA from
issuing a subordinate CA certificate with issuer name same as its
own. For details, see "SubCANameConstraints Plug-in Module"
on page 116.
Checks for certificate subject name uniqueness and prevents
issuance of multiple certificates with same subject names. For
details, see "UniqueSubjectNameConstraints Plug-in Module" on
page 119.
Checks whether the validity period of a certificate falls within a
specific validity period. For details, see "ValidityConstraints
Plug-in Module" on page 122.
) is not present in the enrolling user's directory entry or if the attribute
pin
plug-in module implements the attribute
Advertisement
Table of Contents
