Netscape Certificate Management System 6.01, Manual

Page: 171 / 377

ExtendedKeyUsageExt Plug-in Module
Chapter 4 Certificate Extension Plug-in Modules 171
Table 4-10
Description of parameters defined in the ExtendedKeyUsageExt module
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Check the box to enable the rule
(default). Uncheck the box to disable the rule.
• If you enable the rule and set the remaining parameters correctly, the server adds
the extended key usage extension to certificates specified by the
predicate
parameter.
• If you disable the rule, the server does not add the extension to certificates; it
ignores the values in the remaining fields.
predicate
Specifies the predicate expression for this rule. If you want this rule to be applied to
all certificate requests, leave the field blank (default). To form a predicate expression,
see section “Using Predicates in Policy Rules” in Chapter 18, “Setting Up Policies” of
CMS Installation and Setup Guide.
Example:
HTTP_PARAMS.certType==codeSignClient
critical
Specifies whether the extension should be marked critical or noncritical in certificates
specified by the
predicate
parameter. Check the box if you want the server to mark
the extension critical (default). Uncheck the box if you want the server to mark the
extension noncritical.
numIds
Specifies the total number of key-usage purposes to be contained or allowed in the
extension.
By default, this field is set to
10
and the UI shows fields for configuring ten key-usage
purposes. You can change the total number by changing the value assigned to this
parameter; there’s no restriction on the total number of key-usage purposes you can
include in the extension.
Note that for each key-usage purpose, you must specify a valid OID; otherwise the
policy rule will return an error. Configuration parameters for each key-usage
purposes is distinguished by
<n>
, which is an integer derived from the value you
assign in this field. For example, if you set the
numIds
parameter to 2,
<n>
would be
0
and
1
.
Permissible values:
0
or
n
.
•
0
specifies that no key-usage purposes can be contained in the extension.
•
n
specifies the total number of key-usage purposes to be included in the
extension; it must be an integer greater than zero. The default value is
10
.
Example:
1