Holdinstruction - Netscape MANAGEMENT SYSTEM 6.1 - ADMINISTRATOR Administrator's Manual

Table 14-5 FreshestCRL Configuration Parameters (Continued)
Parameter Description
• If pointType is set to directoryName, the value must be a
pointName<n>
• If pointType is set to URI, the name must be a URI; the URI must

HoldInstruction

The
HoldInstruction
the CRL Hold Instruction Extension in CRL entries. The extension is a non-critical
CRL entry extension that is used to specify a registered instruction identifier—the
identifier indicates what action the validating application should take when it
encounters a certificate that has been placed on hold.
For general guidelines on setting the CRL hold instruction code in CRL entries, see
"holdInstructionCode" on page 740.
Table 14-6 HoldInstruction Configuration Parameters
Parameter Description
Specifies whether the rule is enabled or disabled. Select to enable,
enable
deselect to disable (default).
Select if you want the server to mark the extension critical; deselect
critical
if you want the server to mark the extension noncritical (default).
Specifies the action a validating application must take when it
instruction
encounters a certificate that has been put on hold.
Permissible values: none
• none specifies that the validating application need not do
• callissuer specifies that the validating application must call
• reject specifies that the validating application must reject the
string in the form of X.500 name, similar to the subject name in a
certificate. For example, CN=CACentral,OU=Research
Dept,O=Example Corporation,C=US.
be an absolute pathname and must specify the host. For example:
http://testCA.example.com/get/your/crls/here/
rule enables you to configure a Certificate Manager to set
anything; the PKIX standard says that this is semantically
equivalent to the absence of a holdInstructionCode (default).
the CA that has issued the certificate or reject the certificate.
certificate on hold.
, , or
callissuer reject
Chapter 14 Revocation and CRLs
CRL Extension Reference
.
611