RenewalValidityConstraints Plug-in Module
Chapter
3
Constraints Policy Plug-in Modules
103
Note that you may apply this policy to certificate renewal requests only, and the
renewal process to which this policy is applied can be manual (a request needs to
be approved by an agent) or automated. In both cases, the currently issued
certificate must be either presented during SSL client authentication by the end
entity or selected by the agent approving the renewal request.
By default, any validity requested in a certificate-renewal request cannot exceed
beyond that of the expiration time specified in the CA’s signing certificate (see
section “CA Signing Key Pair Certificate” in Chapter 14, “Managing CMS Keys and
Certificates” of CMS Installation and Setup Guide). If the Certificate Manager (CA)
finds a request with validity period extending beyond that of its CA signing
certificate, it automatically truncates the validity period to end on the day the CA
signing certificate expires. For example, if the CA signing certificate expires on June
10, 2004, any renewal request with validity period beyond June 10, 2004 will have
validity period truncated to end on June 10, 2004.
However, you can configure the Certificate Manager to renew certificates with
validity periods beyond that of its CA signing certificate by selecting the “Override
validity nesting requirement” option; see section “Step 6. Enable End-Entity
Interaction” in Chapter 15, “Setting Up End-User Authentication” of CMS
Installation and Setup Guide.
During installation, Certificate Management System automatically creates an
instance of the renewal validity constraints policy. See
“DefaultRenewalValidityRule Rule” on page 105.
Configuration Parameters of
RenewalValidityConstraints
In the CMS configuration file, the
RenewalValidityConstraints
module is
identified as
<subsystem>.Policy.impl.RenewalValidityConstraints.class=
com.netscape.cms.policy.RenewalValidityConstraints
, where
<subsystem>
is
ca
or
ra
(prefix identifying the subsystem).
In the CMS window, the module is identified as
RenewalValidityConstraints
.
Figure 3-7 shows how the configurable parameters for the module are displayed in
the CMS window.
Summary of Contents for Certificate Management System 6.01
Page 1: ...Plug Ins Guide Netscape Certificate Management System Version6 01 May 2002...
Page 10: ...10 Netscape Certificate Management System Plug Ins Guide May 2002...
Page 62: ...Enrollment Forms 62 Netscape Certificate Management System Plug Ins Guide May 2002...
Page 308: ...NTEventLog Plug in Module 308 Netscape Certificate Management System Plug Ins Guide May 2002...
