Netscape MANAGEMENT SYSTEM 6.0 Installation And Setup Manual page 578

Configuring Policy Rules for a Subsystem
Enter the appropriate information.
4.
Policy Rule ID. Type a unique name that will help you identify the rule; be
sure to use an alphanumeric string without spaces.
enable. Check the box to enable the rule (default). If you enable the rule and set
the remaining parameters correctly, the server sets the configured validity
period in certificates specified by the
to disable the rule. If you disable the rule, the server does not set the
configured validity period in certificates; it sets the validity period to the one
specified in the request.
predicate. Type the predicate expression for this rule. If you want this rule to
be applied to all certificate requests, leave the field blank (default). To form a
predicate expression, see "Using Predicates in Policy Rules" on page 562.
minValidity. Type the minimum validity period, in days, for certificates. The
value must be an integer greater than zero and less than the value you will type
for the
maxValidity. Type the maximum validity period, in days, for certificates. The
value must be an integer greater than zero and also greater than the value you
typed for the
leadTime. Type the lead time, in minutes, for certificates. For a certificate
renewal request to pass the renewal validity constraints policy, the value of the
notBefore
the
is run. The default value is 10 minutes.
The
validity begins.
lagTime. Type the lag time, in minutes, for certificates. For a certificate renewal
request to pass the renewal validity constraints policy, the value of the
notBefore
of the
default value is 10 minutes.
The
validity ends.
notBeforeSkew. Type the number of minutes to subtract from the current time
when creating the value for the certificate's
some clients with incorrectly set clocks use the new certificate after
downloading. For example, if the certificate is issued at 11:30 a.m. and the clock
settings of the client into which the certificate is downloaded is 11:20 a.m., the
578 Netscape Certificate Management System Installation and Setup Guide • March 2002
parameter next. The default value is 180 days.
maxValidity
minValidity
attribute in the certificate request must not be more than value of
parameter in the future, relative to the time when the policy rule
leadTime
attribute value specifies the date on which the certificate
notBefore
attribute in the certificate request must not be more than the value
in the past, relative to the time when the policy is run. The
lagTime
attribute value specifies the date on which the certificate
notBefore
predicate
parameter. The default value is 730 days.
notBefore
parameter. Uncheck the box
attribute. It can help