Netscape Certificate Management System 6.01, Manual

Page: 147 / 377

BasicConstraintsExt Plug-in Module
Chapter 4 Certificate Extension Plug-in Modules 147
BasicConstraintsExt Rule
The rule named
BasicConstraintsExt
is an instance of the
BasicConstraintsExt
module. Certificate Management System automatically
creates this rule during installation. By default, the rule is configured as follows:
• The rule is enabled.
• The predicate expression is set (
predicate=HTTP_PARAMS.certType==ca
) so
that the extension gets added to CA certificates only.
• The extension is marked critical to comply with the PKIX recommendation.
maxPathLen
Specifies the path length, the maximum number of CA certificates that may be
chained below (subordinate to) the subordinate CA certificate being issued. Note that
the path length you specify affects the number of CA certificates to be used during
certificate validation. The chain starts with the end-entity certificate being validated
and moving up the chain.
The
maxPathLen
parameter has no effect if the extension is set in end-entity
certificates.
Permissible values:
0
or
n
. Make sure that the value you choose is less than the path
length specified in the Basic Constraints extension of the CA signing certificate
(owned by the CA that will issue these certificates).
•
0
specifies that no subordinate CA certificates are allowed below the subordinate
CA certificate being issued—that is, only an end-entity certificate may follow in
the path.
•
n
must be an integer greater than zero. It specifies at the most n subordinate CA
certificates are allowed below the subordinate CA certificate being used.
• If you leave the field blank, the path length defaults to a value that is determined
by the path length set on the Basic Constraints extension in the issuer’s certificate.
If the issuer’s path length is unlimited, the path length in the subordinate CA
certificate will also be unlimited. If the issuer’s path length is an integer greater
than zero, the path length in the subordinate CA certificate will be set to a value
that’s one less than the issuer’s path length; for example, if the issuer’s path length
is 4, the path length in the subordinate CA certificate will be set to 3.
Example:
2
Table 4-4
Description of parameters defined in the BasicConstraintsExt module (Continued)
Parameter Description