Table of Contents
Advertisement
Standard X.509 v3 Certificate Extensions
Netscape Recommendation
Netscape recommends this extension for all certificates if their intended purpose or
purposes are known. Netscape requires this extension for all dual-key signing
certificates.
Microsoft Recommendation
Microsoft recommends this extension for all certificates if their intended purpose
or purposes are known. If the extension is absent, Microsoft products will assume
the certificate is valid for all usages. If the extension is present, Microsoft products
will interpret the extension in the same way whether marked critical or not. If the
extension is present, the actual usage must conform to the specified usage.
The only Microsoft application that currently enforces this extension is Microsoft
Outlook.
nameConstraints
OID
2.5.29.30
Reference
http://www.ietf.org/rfc/rfc2459.txt
Criticality
PKIX Part 1 requires that this extension be marked critical.
Discussion
This extension, which can used in CA certificates only, defines a name space within
which all subject names in subsequent certificates in a certification path must be
located.
CMS Version Support
Refer to "NameConstraintsExt Plug-in Module" on page 199.
•
CMS 4.1: Not supported
•
CMS 4.2: Supported
•
CMS 4.2-SP2: Supported
•
CMS 4.5: Supported
•
CMS 6.0: Supported
350
Netscape Certificate Management System Plug-Ins Guide • May 2002
4.2.1.11
Advertisement
Table of Contents
