Managing Policy Plug-In Modules - Netscape MANAGEMENT SYSTEM 6.1 - ADMINISTRATOR Administrator's Manual

For general information about this extension, see "authorityKeyIdentifier" on
page 737.
You can also customize the method for deriving the Key Identifier using the CMS
SDK by subclassing the policy and overriding the following method:
formKeyIdentifier(X509CertInfo certInfo, IRequest req)
If enabled, the policy adds a Subject Key Identifier Extension to an enrollment
request if the extension does not already exist. If the extension exists in the request,
for example from a CRMF request, the policy replaces the extension. In case of
agent-approved enrollments, after an agent approves the enrollment request, the
policy accepts any Subject Key Identifier Extension that is already there.
During installation, CMS automatically creates an instance of the subject key
identifier extension policy, named
default.
Table 11-41 SubjectKeyIdentifierExt Configuration Parameters
Parameter
enable
predicate
critical
KeyIdentifierType

Managing Policy Plug-in Modules

This section explains how to use the CMS window to perform the following
operations:
Description
Specifies whether the rule is enabled or disabled. Select to enable, deselect to
disable.
Specifies the predicate expression for this rule. If you want this rule to be applied
to all certificate requests, leave the field blank (default). To form a predicate
expression, see "Using Predicates in Policy Rules," on page 485.
Select if you want the server to mark the extension critical; deselect if you want
the server to mark the extension noncritical (default).
Specifies the method for deriving Key Identifier.
• SHA1 specifies that the key identifier must be derived as a 20 byte (160 bit)
SHA-1 hash of the BIT STRING of Subject Public Key (default).
• TypeField specifies that the key identifier must be derived as a type field
value of 0100 followed by 60 least significant bits of the SHA-1 hash of the
Subject Public Key.
• SpkiSHA1 specifies that the key identifier must be derived as a 20 byte (160
bit) SHA-1 hash of the Subject Public Key Info.
SubjectKeyIdentifierExt
Managing Policy Plug-in Modules
that is enabled by
Chapter 11 Policies 563