Netscape MANAGEMENT SYSTEM 6.0 - PLUG-IN Manual page 146

BasicConstraintsExt Plug-in Module
The configuration shown in Figure 4-4 creates a policy rule named
BasicConsExtForCACert
constraints extension in all CA certificates.
Table 4-4 gives details about each of these parameters.
Description of parameters defined in the BasicConstraintsExt module
Table 4-4
Parameter Description
Specifies whether the rule is enabled or disabled. Check the box to enable the rule
enable
(default). Uncheck the box to disable the rule.
• If you enable the rule and set the remaining parameters correctly, the server adds
• If you disable the rule, the server does not add the extension to certificates; it
Specifies the predicate expression for this rule. If you want this rule to be applied to
predicate
all certificate requests, leave the field blank (default). To form a predicate expression,
see section "Using Predicates in Policy Rules" in Chapter 18, "Setting Up Policies" of
CMS Installation and Setup Guide.
Example: HTTP_PARAMS.certType==ca
Specifies whether the extension should be marked critical or noncritical in certificates
critical
specified by the predicate parameter. Check the box if you want the server to mark
the extension critical (default). Uncheck the box if you want the server to mark the
extension noncritical.
Specifies whether the certificate subject is a CA. If you select the option, the server
isCA
checks the maxPathLen parameter and sets the specified path length in the
certificate. If you deselect the option, the server treats the certificate subject as a
non-CA and ignores the value specified for the maxPathLen parameter.
146 Netscape Certificate Management System Plug-Ins Guide • March 2002
, which enforces a rule that the server should set the basic
the basic constraints extension to certificates specified by the predicate
parameter.
ignores the values in the remaining fields.