UniqueSubjectNameConstraints Plug-in Module
Chapter
3
Constraints Policy Plug-in Modules
117
UniqueSubjectNameConstraints Plug-in Module
The
UniqueSubjectNameConstraints
plug-in module implements the unique
subject name constraints policy. This policy restricts the server from issuing
multiple certificates with same subject names. Optionally, you can also configure
the server to allow multiple certificates with the same subject name if the key
usages are different. Note that key usages for certificates are usually specified by
the key usage extension and Certificate Management System allows you to add this
extension to certificates using the key usage extension policy explained in
“KeyUsageExt Plug-in Module” on page 186.
You may apply the unique subject name constraints policy to end-entity certificate
enrollment and renewal requests. For example, if you want to prevent your users
from requesting multiple certificates with same subject names, you can configure
the server accordingly using the policy. Alternatively, if you want to allow your
users to own multiple certificates, each for a different use, all having the same
subject name, you can do so easily using the
enableKeyUsageExtensionChecking
parameter defined in this policy. This parameter makes the server check whether
the key usages specified in the certificate request being processed is different than
those specified in the existing certificates that have the same subject names and
accordingly issue or deny the certificate. Keep in mind that the server can check for
key usages only if the key usage extension bits are set in the certificate request
being processed as well as in the existing certificates that have the same subject
names.
During installation, Certificate Management System automatically creates an
instance of the unique subject name constraints policy. See
“UniqueSubjectNameConstraints Rule” on page 120.
Configuration Parameters of
UniqueSubjectNameConstraints
In the CMS configuration file, the
UniqueSubjectNameConstraints
module is
identified as
ca.Policy.impl.UniqueSubjectNameConstraints.class=
com.netscape.cms.policy.UniqueSubjectNameConstraints
.
In the CMS window, the module is identified as
UniqueSubjectNameConstraints
.
Figure 3-12 shows how configurable parameters for the module are displayed in
the CMS window.
Summary of Contents for Certificate Management System 6.0
Page 1: ...Plug Ins Guide Netscape Certificate Management System Version6 0 March 2002...
Page 10: ...10 Netscape Certificate Management System Plug Ins Guide March 2002...
Page 62: ...Enrollment Forms 62 Netscape Certificate Management System Plug Ins Guide March 2002...
Page 308: ...NTEventLog Plug in Module 308 Netscape Certificate Management System Plug Ins Guide March 2002...
