Netscape Certificate Management System 6.01, Manual

Page: 109 / 377

RSAKeyConstraints Plug-in Module
Chapter 3 Constraints Policy Plug-in Modules 109
Figure 3-9
Parameters of the RSAKeyConstraints module
The configuration shown in Figure 3-9 creates a policy rule named
RSAKeySizeForClientCert
, which enforces a rule that the server should restrict
the minimum and maximum key sizes for all RSA key-based client certificates to
512 and 2048, respectively.
Table 3-9 describes each parameter.
Table 3-9 Description of parameters defined in the RSAKeyConstraints module
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Check the box to enable the rule
(default). Uncheck the box to disable the rule.
• If you enable the rule and set the remaining parameters correctly, the server uses
the configured RSA key rules when issuing certificates specified by the
predicate
parameter.
• If you disable the rule, the server certifies the requested key size.
predicate
Specifies the predicate expression for this rule. If you want the rule to be applied to all
certificate requests, leave the field blank (default). To form a predicate expression, see
section “Using Predicates in Policy Rules” in Chapter 18, “Setting Up Policies” of
CMS Installation and Setup Guide.
Example:
HTTP_PARAMS.certType==client