Netscape Certificate Management System 6.01, Manual

Page: 133 / 377

AuthInfoAccessExt Plug-in Module
Chapter 4 Certificate Extension Plug-in Modules 133
By default, the policy supports three access methods:
•
caIssuers
(this method is also identified by its OID, 1.3.6.1.5.5.7.48.2).
As specified in the PKIX standard, you should use the
caIssuers
method
when the additional information is a list of parent CAs or CAs that have issued
certificates superior to the CA that issued the certificate containing the
extension. The certificate-using application may use the list of parent CAs
referenced by the extension to determine the certification path and to check
whether the path terminates at a point trusted by the certificate user.
When you use the
caIssuers
method, the access location referenced in the
extension must take any of the following general-name forms:
❍
Uniform resource identifier (URI) if the information is available via HTTP,
FTP, or LDAP.
❍
An X.500 directory name if the information is available via the directory
access protocol (DAP).
❍
An rfc822Name if the information is available via electronic mail.
•
ocsp
(this method is also identified by its OID, 1.3.6.1.5.5.7.48.1).
The
ocsp
method indicates to the certificate-using client that it must use the
OCSP protocol to access the location that contains additional information
about the CA that has issued the certificate. You should use the
ocsp
method
when you want to reference to the online validation authority that maintains
the revocation status of certificates issued by the CA.
When you use the
ocsp
method, the access location referenced in the extension
must be a uniform resource indicator (URI); this means, the location type must
be
URL
and the location value must be the complete URL (including the port
number) at which the online validation authority for the CA is listening for
OCSP requests from OCSP-compliant clients.
•
renewal
(this method is also identified by its OID, 2.16.840.1.113730.16.1)
The
renewal
method works with the automated-certificate-renewal feature
built into Netscape Personal Security Manager. When you use this method, the
access location referenced in the extension must be a URI. For details, check the
Netscape Personal Security Manager Deployment Guide.
The built-in support for the
ocsp
access method and a URI value for the access
location in the extension conform to the profile defined in RFC 2560 (see
http://www.ietf.org/rfc/rfc2560.txt
) for CAs that support the OCSP service.
For details about OCSP support in Certificate Management System, see Chapter 21,
“Setting Up an OCSP Responder” of CMS Installation and Setup Guide.