Netscape Certificate Management System 6.0, Manual

Page: 93 / 377

DSAKeyConstraints Plug-in Module
Chapter 3 Constraints Policy Plug-in Modules 93
Table 3-3
Description of parameters defined in the DSAKeyConstraints module
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Check the box to enable the rule
(default). Uncheck the box to disable the rule.
• If you enable the rule and set the remaining parameters correctly, the server
applies the rule to certificates specified by the predicate expression.
• If you disable the rule, the server does not apply the rule to certificates.
predicate
Specifies the predicate expression for this rule. If you want the rule to be applied to all
certificate requests, leave the field blank (default). To form a predicate expression, see
section “Using Predicates in Policy Rules” in Chapter 18, “Setting Up Policies” of
CMS Installation and Setup Guide.
Example:
HTTP_PARAMS.certType==client
minSize
Specifies the minimum length, in bits, for the key (the length of the modulus in bits).
The value must be smaller than or equal to the one specified by the
maxSize
parameter.
In general, a longer key size results in a key pair that is more difficult to crack. You
may want to enforce a minimum length to ensure a minimum level of security.
Permissible values:
512
or
1024
. You may also enter a custom key size that is
between 512 and 1024, in increments of 64 bits. The default value is 512.
Example:
512
maxSize
Specifies the maximum length, in bits, for the key.
Permissible values:
512
or
1024
. You may also enter a custom key size that is
between 512 and 1024, in increments of 64 bits. The default value is
1024
.
Example:
1024
exponents
Limits the possible public exponent values. Use commas to separate different values.
Some exponents are more widely used than others. The following exponent values
are recommended for arithmetic and security reasons:
17
and
65537
. Of these two
values,
65537
is preferred. (This setting is mainly an issue if you are using your own
software for generating key pairs. Key-generation programs in Netscape clients and
servers use
3
or
65537
.)
Permissible values: A combination of
3
,
7
,
17
, and
65537
, separated by commas. The
default value is
3,7,17,65537
.
Example:
17,65537