Netscape Certificate Management System 6.0, Manual

Page: 223 / 377

PolicyConstraintsExt Plug-in Module
Chapter 4 Certificate Extension Plug-in Modules 223
critical
Specifies whether the extension should be marked critical or noncritical in certificates
specified by the
predicate
parameter. Check the box if you want the server to mark
the extension critical. Uncheck the box if you want the server to mark the extension
noncritical (default).
reqExplicit
Policy
Specifies the total number of certificates permitted in the path before an explicit
policy is required—that is, the number of CA certificates that can be chained below
(subordinate to) the subordinate CA certificate being issued before an acceptable
policy is required.
Note that the number you specify affects the number of CA certificates to be used
during certificate validation. The chain starts with the end-entity certificate being
validated and moving up the chain. (The parameter has no effect if the extension is set
in end-entity certificates.)
Permissible values:
-1
,
0
, or
n
.
•
-1
specifies that the field should not be set in the extension (default).
•
0
specifies that no subordinate CA certificates are permitted in the path before an
explicit policy is required.
•
n
must be an integer that is greater than zero. It specifies at the most
n
subordinate CA certificates are allowed in the path before an explicit policy is
required.
Example:
1
inhibitPolicy
Mapping
Specifies the total number of certificates permitted in the path before policy mapping
is no longer permitted.
Permissible values:
-1
,
0
, or
n
.
•
-1
specifies that the field should not be set in the extension (default).
•
0
specifies that no subordinate CA certificates are permitted in the path before
policy mapping is no longer permitted.
•
n
must be an integer that is greater than zero. It specifies at the most
n
subordinate CA certificates are allowed in the path before policy mapping is no
longer permitted. For example, a value of one indicates that policy mapping may
be processed in certificates issued by the subject of this certificate, but not in
additional certificates in the path.
Example:
-1
Table 4-22
Description of parameters defined in the PolicyConstraintsExt module (Continued)
Parameter Description