Netscape Certificate Management System 6.0, Manual

Page: 243 / 377

SubjectKeyIdentifierExt Plug-in Module
Chapter 4 Certificate Extension Plug-in Modules 243
The subject key identifier extension policy in Certificate Management System
allows setting of the subject key identifier extension as defined in its X.509
definition. It enables you to specify the method for forming the Key Identifier.
By default, the policy supports three types of methods for deriving the Key
Identifier; the default methods for forming the Key Identifier are based on PKIX
recommendations as defined in section 4.2.1.2. They are as follows:
• 20 byte (160 bit) SHA-1 hash of the BIT STRING of Subject Public Key.
• A type field value of 0100 followed by 60 least significant bits of the SHA-1
hash of the Subject Public Key.
• 20 byte (160 bit) SHA-1 hash of the Subject Public Key Info. This is how
Netscape Communicator generates a Key Identifier (but is not necessary to be
compatible with the Communicator).
You can also customize the method for deriving the Key Identifier by subclassing
the policy and overriding the following method:
formKeyIdentifier(X509CertInfo certInfo, IRequest req)
For details, check the CMS SDK installed at this location:
<server_root>/cms_sdk/cms_jdk/javadocs
You may also want to check the CMS samples installed here:
<server_root>/cms_sdk/cms_jdk/samples/policies
If enabled, the policy adds a Subject Key Identifier Extension to an enrollment
request if the extension does not already exist. If the extension exists in the request,
for example from a CRMF request, the policy replaces the extension. In case of
manual enrollments, after an agent approves the enrollment request, the policy
accepts any Subject Key Identifier Extension that is already there.
During installation, Certificate Management System automatically creates an
instance of the subject key identifier extension policy. See “SubjectKeyIdentifierExt
Rule” on page 245.
Configuration Parameters of
SubjectKeyIdentifierExt
In the CMS configuration file, the
SubjectKeyIdentifierExt
module is
identified as
<subsystem>.Policy.impl.SubjectKeyIdentifierExt.class=
com.netscape.cms.policy.SubjectKeyIdentifierExt
, where
<subsystem>
is
ca
or
ra
(prefix identifying the subsystem).