Issuerrule Rule - Netscape MANAGEMENT SYSTEM 6.01 - PLUG-IN Manual

IssuerConstraints Plug-in Module
Table 3-4 Description of parameters defined in the IssuerConstraints module
Parameter Description
Specifies whether the rule is enabled or disabled. Check the box to enable the rule
enable
(default). Uncheck the box to disable the rule.
• If you enable the rule and set the remaining parameters correctly, the server
• If you disable the rule, the server does not check for certificates issued by a CA; it
Specifies the predicate expression for this rule. If you want the rule to be applied to all
predicate
certificate requests, leave the field blank (default). To form a predicate expression, see
section "Using Predicates in Policy Rules" in Chapter 18, "Setting Up Policies" of
CMS Installation and Setup Guide.
Example: HTTP_PARAMS.certType==client AND
HTTP_PARAMS.certauthEnroll==on
Specifies the name of the CA that has issued certificates that are to be checked. You
issuerDN
should enter the issuer name as it appears in the CA's signing certificate; the same
name also appears as the issuer name in certificates the CA signs.
Permissible values: A valid issuer name.
Example: CN=bulkGenCA,OU=Information Systems,O=Example
Corporation,C=US

IssuerRule Rule

The rule named
Certificate Management System automatically creates this rule during installation.
By default, the rule is configured as follows:
• The rule is disabled; for the rule to be effective, it must be enabled and
configured appropriately.
• The predicate expression is set (
AND certauthEnroll==on
client-certificate requests that have certificate-based authentication turned on.
• The issuer DN field is left blank for you to enter the appropriate information.
96 Netscape Certificate Management System Plug-Ins Guide • May 2002
checks for certificates issued by the specified CA and enforces certificate-based
enrollment.
ignores the values specified in the remaining fields.
IssuerRule
is an instance of the
IssuerConstraints
predicate=HTTP_PARAMS.certType==client
) so that the rule is applied to only those
module.