Netscape Certificate Management System 6.01, Manual

Page: 183 / 377

IssuerAltNameExt Plug-in Module
Chapter 4 Certificate Extension Plug-in Modules 183
The configuration shown in Figure 4-11 creates a policy rule named
IssuerAltNameExtForCACert
, which enforces a rule that the server should set the
issuer alternative name extension in CA certificates only.
Table 4-12 gives details about each of these parameters.
Table 4-12
Description of parameters defined in the IssuerAltNameExt module
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Check the box to enable
the rule (default). Uncheck the box to disable the rule.
• If you enable the rule and set the remaining parameters correctly, the
server adds the issuer alternative name extension to all certificates
specified by the
predicate
parameter.
• If you disable the rule, the server doesn’t add the extension to
certificates; it ignores the values in the remaining fields.
predicate
Specifies the predicate expression for this rule. If you want this rule to be
applied to all certificate requests, leave the field blank (default). To form a
predicate expression, see section “Using Predicates in Policy Rules” in
Chapter 18, “Setting Up Policies” of CMS Installation and Setup Guide.
Example:
HTTP_PARAMS.certType==ca
critical
Specifies whether the extension should be marked critical or noncritical in
certificates specified by the
predicate
parameter. Check the box if you
want the server to mark the extension critical (default). Uncheck the box if
you want the server to mark the extension noncritical.
numGeneralNames
Specifies the total number of alternative names or identities permitted in
the extension. Note that each name has a set of configuration
parameters—
generalName<n>.generalNameChoice
and
generalName<n>.generalNameValue
—and you must specify
appropriate values for each of those parameters; otherwise the policy rule
will return an error. You can change the total number of identities by
changing the value specified in this field; there’s no restriction on the total
number of identities you can include in the extension. Each set of
configuration parameters is distinguished by
<n>
, which is an integer
derived from the value you assign in this field. For example, if you set the
numGeneralNames
parameter to 2,
<n>
would be
0
and
1
.
Permissible values:
0
or
n
.
•
0
specifies that no identities can be contained in the extension (default).
•
n
specifies the total number of identities to be included in the extension;
it must be an integer greater than zero. The default value is 8.
Example:
2