Netscape Certificate Management System 6.0, Manual

Page: 212 / 377

NSCertTypeExt Plug-in Module
212 Netscape Certificate Management System Plug-Ins Guide • March 2002
NSCertTypeExt Plug-in Module
The
NSCertTypeExt
plug-in module implements the Netscape certificate type
extension policy. This policy enables you to configure Certificate Management
System to add the Netscape Certificate Type extension to certificates. The extension
identifies the certificate type—for example, it identifies whether the certificate is a
CA certificate, server SSL certificate, client SSL certificate, object signing certificate,
or S/MIME certificate—and thus enables you to restrict the usage of a certificate to
predetermined purposes.
• If the extension exists in a certificate, it limits the uses of the certificate to those
specified (it limits the applications for a certificate).
• If the extension is not present, the certificate can be used for all applications
except object signing.
The Netscape certificate type extension is a string of boolean bit-flags, each bit
identifying the purpose for which a certificate to be used. Table 4-18 lists the bits
and their designated purposes. The extension has no default value.
Table 4-18 Netscape certificate type extension bits and designated purposes
Bit Purpose Description
0 SSL Client Specifies that the certificate can be used by clients for authentication
during SSL connections.
1 SSL Server Specifies that the certificate can be used by servers for authentication
during SSL connections.
2 S/MIME Specifies that the certificate can be used to send secure email
messages.
3 Object Signing Specifies that the certificate can be used for signing objects such as
Java applets and plug-ins.
4 Reserved This bit is reserved for future use.
5 SSL CA Specifies that the certificate can be used by a CA to issue certificates
for SSL connections.
6 S/MIME CA Specifies that the certificate can be used by a CA to issue certificates
for secure email.
7 Object Signing CA Specifies that the certificate can be used by a CA to issue certificates
for object signing.