GenericASN1Ext Plug-in Module
174
Netscape Certificate Management System Plug-Ins Guide • March 2002
When queried by an application on the status of a certificate, the OCSP responder
sends a digitally signed response. To generate the signature, the responder needs
to use a key. Because the signature needs to be verified by the application that
sought the response, RFC 2560 recommends that the key used for signing an OCSP
response must belong to one of the following:
•
The CA that has issued the certificate, the revocation status of which is being
requested.
•
A trusted OCSP responder whose public key is trusted by the application that
requested the revocation status of the certificate (as a part of validating the
certificate).
•
An OCSP responder that has been authorized by the CA (that has issued the
certificate being validated) to sign OCSP responses for certificates issued by
that CA.
In this type of deployment, the CA authorizes a responder to sign OCSP
responses on its behalf by issuing a specially marked certificate to the
responder. This certificate is called the OCSP responder certificate, and it enables
OCSP-compliant applications to identify the responder as a CA-designated
responder—a responder authorized to sign OCSP responses for all certificates
issued by the CA. The special marking that the CA includes in the certificate is
the extended key usage extension with a unique value,
OCSPSigning
. This
extension value indicates to OCSP-compliant applications that the key
associated with the certificate can be used for signing OCSP responses.
If you want to deploy a CA-delegated OCSP responder, the
OCSPSigningExt
rule
enables you to add the extended key usage extension (with
OCSPSigning
value) to
the OCSP responder certificate. In addition to this extension, the responder’s
signing certificate should also include the OCSP no check extension. For details, see
“OCSPNoCheckExt Plug-in Module” on page 217.
GenericASN1Ext Plug-in Module
The
GenericASN1Ext
plug-in module implements the generic ASN.1 extension
policy. This policy enables you to configure Certificate Management System to add
custom extensions to certificates. Using this policy, you can add as many ASN.1
type based-extensions as required without having to write any code. Further, it
eliminates the dependency on the command-line tools for generating base-64
encoded standard extensions from the x.509 extension classes.
Summary of Contents for Certificate Management System 6.0
Page 1: ...Plug Ins Guide Netscape Certificate Management System Version6 0 March 2002...
Page 10: ...10 Netscape Certificate Management System Plug Ins Guide March 2002...
Page 62: ...Enrollment Forms 62 Netscape Certificate Management System Plug Ins Guide March 2002...
Page 308: ...NTEventLog Plug in Module 308 Netscape Certificate Management System Plug Ins Guide March 2002...
