Netscape MANAGEMENT SYSTEM 6.01 - PLUG-IN Manual page 190

KeyUsageExt Plug-in Module
Table 4-15 Description of parameters defined in the KeyUsageExt module
Parameter
enable
predicate
critical
digitalSignature
190 Netscape Certificate Management System Plug-Ins Guide • May 2002
Description
Specifies whether the rule is enabled or disabled. Check the box to enable the rule
(default). Uncheck the box to disable the rule.
• If you enable the rule, the server checks the key usage extension bits specified
in the remaining fields, and adds the extension with those bits to certificates
specified by the predicate parameter.
• If you disable the rule, the server does not add the extension to certificates; it
ignores the key usage extension-specific bits specified in the policy
configuration and in the enrollment forms.
Specifies the predicate expression for this rule. If you want this rule to be applied to
all certificate requests, leave the field blank (default). To form a predicate
expression, see section "Using Predicates in Policy Rules" in Chapter 18, "Setting
Up Policies" of CMS Installation and Setup Guide.
Example: HTTP_PARAMS.certType==client
Specifies whether the extension should be marked critical or noncritical in
certificates specified by the predicate parameter. Check the box if you want the
server to mark the extension critical (default). Uncheck the box if you want the
server to mark the extension noncritical.
Specifies whether to set the digitalSignature bit (or bit 0) of the key usage
extension in certificates specified by the predicate parameter.
Permissible values: true, false, or HTTP_INPUT.
• Select true if you want the server to set the bit (default).
• Select false if you don't want the server to set the bit.
• Select HTTP_INPUT if you want the server to check the certificate request for
the HTTP input variable corresponding to the digitalSignature bit and set
the bit accordingly. If the variable is set to true, the server sets the bit. If the
variable doesn't exist or if it is set to false (or any other value), the server
doesn't set the bit.