Netscape Certificate Management System 6.0, Manual

Page: 113 / 377

SigningAlgorithmConstraints Plug-in Module
Chapter 3 Constraints Policy Plug-in Modules 113
Table 3-10
Description of parameters defined in the SigningAlgorithmConstraints module
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Check the box to enable the rule
(default). Uncheck the box to disable the rule.
• If you enable the rule and set the remaining parameters correctly, the server uses
the configured algorithms to sign certificates specified by the
predicate
parameter.
• If you disable the rule, the server uses the default algorithm specified for the
Certificate Manager; see Certificate Manager’s “General Settings” tab in the CMS
window.
predicate
Specifies the predicate expression for this rule. If you want the rule to be applied to all
certificate requests, leave the field blank (default). To form a predicate expression, see
section “Using Predicates in Policy Rules” in Chapter 18, “Setting Up Policies” of
CMS Installation and Setup Guide.
Example:
HTTP_PARAMS.certType==client
algorithms
Specifies the signature algorithm the server should use to sign certificates.
Permissible values: Depends on the CA’s signing key type (the key type you chose for
the Certificate Manager’s CA signing certificate).
• If the key type is RSA, select one of the following:
-
MD2withRSA,MD5withRSA,SHA1withRSA
- MD2withRSA,MD5withRSA
-
MD2withRSA,SHA1withRSA
-
MD5withRSA,SHA1withRSA
-
MD2withRSA
- MD5withRSA
-
SHA1withRSA
The default value is
MD2withRSA,MD5withRSA,SHA1withRSA
.
• If the key type is DSA, select
SHA1withDSA
.
Example:
MD5withRSA