Netscape MANAGEMENT SYSTEM 6.2 - ADMINISTRATOR Administrator's Manual page 553

extension may be useful in the context of cross-certification. If supported, the
extension is to be included in CA certificates only. The policy allows you to map
policy statements of one CA to that of another by pairing the OIDs assigned to their
policy statements
Each pair is defined by two parameters,
subjectDomainPolicy
issuerDomainPolicy
The issuing CA's users may accept an
applications. The policy mapping tells these users which policies associated with
the subject CA are equivalent to the policy they accept.
For general information about this extension, see "policyMappings" on page 765.
During installation, CMS automatically creates an instance of the policy mappings
extension policy, named
Table 11-36 PolicyMappingsExt Configuration Parameters
Parameter
enable
predicate
critical
numPolicyMappings
. The pairing indicates that the issuing CA considers the
equivalent to the
PolicyMappingsExt
Description
Specifies whether the rule is enabled or disabled. Select to enable, deselect to
disable.
Specifies the predicate expression for this rule. If you want this rule to be
applied to all certificate requests, leave the field blank (default). To form a
predicate expression, see "Using Predicates in Policy Rules," on page 483.
Select to mark critical, deselect to mark noncritical (default).
Specifies the total number of policy mapping (pairs) to be contained or allowed
in the extension. Note that each policy mapping represents a pair of
policies—specified by policyMap<n>.issuerDomainPolicy and
policyMap<n>.subjectDomainPolicy—and each policy in the pair
belongs to a specific CA.
You can change the total number of policy pairs by changing the value
assigned to this parameter; there's no restriction on the total number of policy
pairs you can include in the extension. Each pair is distinguished by <n>,
which is an integer derived from the value you assign in this field. For
example, if you set the numPolicyMappings parameter to 2, <n> would be 0
and 1.
Permissible values: 0 or n.
• 0 specifies that no policy pairs can be contained in the extension.
• n specifies the total number of policy pairs to be included in the extension;
it must be a integer greater than zero. The default value is 1.
Extension-Specific Policy Module Reference
issuerDomainPolicy
subjectDomainPolicy
issuerDomainPolicy
, that is enabled by default.
and
of the subject CA.
for certain
Chapter 11 Policies 553