Netscape MANAGEMENT SYSTEM 6.01 - PLUG-IN Manual page 336

Recommendations for Certificate Extension Use
Recommendations for Use of Certificate Extensions with CMS (Continued)
Table C-1
Certificate type CA root
SSL server authorityKeyIdentifier
certificate
extKeyUsage:
Auth (recommended),
Microsoft SGC and
Netscape SGC (required
for step-up)
keyUsage:
keyCertSign, cRLSign
netscape-cert-type:
SSL CA (if extension exists,
bit must be set)
subjectKeyIdentifier
336 Netscape Certificate Management System Plug-Ins Guide • May 2002
Intermediate CA
authorityKeyIdentifier
cRLDistributionPoints
extKeyUsage:
Server
Auth (recommended),
Microsoft SGC and
Netscape SGC (required
for step-up)
keyUsage:
keyCertSign, cRLSign
netscape-cert-type:
SSL CA (if extension exists,
bit must be set)
subjectKeyIdentifier
Issued certificate
authorityKeyIdentifier
cRLDistributionPoints
extKeyUsage:
Server
(recommended), Microsoft
SGC and Netscape SGC
(required for step-up)
keyUsage:
keyEncipherment
netscape-cert-type:
SSL Client, SSL Server
(required for some Netscape
servers)
subjectAltName
subjectKeyIdentifier
Server Auth