Netscape Certificate Management System 6.0, Manual

Page: 287 / 377

InvalidityDate Rule
Chapter 7 CRL Extension Plug-in Modules 287
InvalidityDate Rule
The
InvalidityDate
rule enables you to configure a Certificate Manager to set the
Invalidity Date Extension defined in X.509 and PKIX standard RFC 2459 (see
http://www.ietf.org/rfc/rfc2459.txt
) in CRLs. The extension is a non-critical
CRL entry extension that is used to specify the date on which it is known or
suspected that the private key was compromised or that the certificate otherwise
became invalid.
For general guidelines on setting the invalidity date extension in CRL entries, see
“invalidityDate” on page 365.
Table 7-6
Description of parameters defined in the HoldInstruction rule
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Check the box to enable the rule.
Uncheck the box to disable the rule (default).
• If you enable the rule and set the remaining parameters correctly, the server sets
the Hold Instruction extension in CRLs.
• If you disable the rule, the server does not add the extension to CRLs; it ignores
the values in the remaining fields.
critical
Specifies whether the extension should be marked critical or noncritical in CRLs
issued by the server. Check the box if you want the server to mark the extension
critical. Uncheck the box if you want the server to mark the extension noncritical
(default).
instruction
Specifies the action a validating application must take when it encounters a certificate
that has been put on hold.
Permissible values:
none
,
callissuer
, or
reject
.
•
none
specifies that the validating application need not do anything; the PKIX
standard says that this is semantically equivalent to the absence of a
holdInstructionCode (default).
•
callissuer
specifies that the validating application must call the CA that has
issued the certificate or reject the certificate.
•
reject
specifies that the validating application must reject the certificate on
hold.
Example:
none