Netscape Certificate Management System 6.0, Manual

Page: 98 / 377

KeyAlgorithmConstraints Plug-in Module
98 Netscape Certificate Management System Plug-Ins Guide • March 2002
Figure 3-5
Parameters of the KeyAlgorithmConstraints module
The configuration shown in Figure 3-5 creates a policy rule named
KeyAlgForClientServerCert
, which enforces a rule that the server should restrict
the key algorithm of all client and server certificates to RSA.
Table 3-5 gives details about each of the parameters.
Table 3-5 Description of parameters defined in the KeyAlgorithmConstraints module
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Check the box to enable the rule
(default). Uncheck the box to disable the rule.
• If you enable the rule and set the remaining parameters correctly, the server sets
the configured algorithm in certificates specified by the
predicate
parameter.
• If you disable the rule, the server sets the algorithm specified in the certificate
request.
predicate
Specifies the predicate expression for this rule. If you want the rule to be applied to all
certificate requests, leave the field blank (default). To form a predicate expression, see
section “Using Predicates in Policy Rules” in Chapter 18, “Setting Up Policies” of
CMS Installation and Setup Guide.
Example:
HTTP_PARAMS.certType==client AND
HTTP_PARAMS.certType==server