Table of Contents
Advertisement
RenewalValidityConstraints Plug-in Module
Note that you may apply this policy to certificate renewal requests only, and the
renewal process to which this policy is applied can be manual (a request needs to
be approved by an agent) or automated. In both cases, the currently issued
certificate must be either presented during SSL client authentication by the end
entity or selected by the agent approving the renewal request.
By default, any validity requested in a certificate-renewal request cannot exceed
beyond that of the expiration time specified in the CA's signing certificate (see
section "CA Signing Key Pair Certificate" in Chapter 14, "Managing CMS Keys and
Certificates" of CMS Installation and Setup Guide). If the Certificate Manager (CA)
finds a request with validity period extending beyond that of its CA signing
certificate, it automatically truncates the validity period to end on the day the CA
signing certificate expires. For example, if the CA signing certificate expires on June
10, 2004, any renewal request with validity period beyond June 10, 2004 will have
validity period truncated to end on June 10, 2004.
However, you can configure the Certificate Manager to renew certificates with
validity periods beyond that of its CA signing certificate by selecting the "Override
validity nesting requirement" option; see section "Step 6. Enable End-Entity
Interaction" in Chapter 15, "Setting Up End-User Authentication" of CMS
Installation and Setup Guide.
During installation, Certificate Management System automatically creates an
instance of the renewal validity constraints policy. See
"DefaultRenewalValidityRule Rule" on page 105.
Configuration Parameters of
RenewalValidityConstraints
In the CMS configuration file, the
module is
RenewalValidityConstraints
identified as
<subsystem>.Policy.impl.RenewalValidityConstraints.class=
, where
com.netscape.cms.policy.RenewalValidityConstraints
<subsystem>
is
or
(prefix identifying the subsystem).
ca
ra
In the CMS window, the module is identified as
.
RenewalValidityConstraints
Figure 3-7 shows how the configurable parameters for the module are displayed in
the CMS window.
Chapter 3
Constraints Policy Plug-in Modules
103
Advertisement
Table of Contents
