Netscape Certificate Management System 6.01, Manual

Page: 193 / 377

KeyUsageExt Plug-in Module
Chapter 4 Certificate Extension Plug-in Modules 193
CMCertKeyUsageExt Rule
The policy rule named
CMCertKeyUsageExt
is an instance of the
KeyUsageExt
module. This rule is for setting the appropriate key-usage bits in Certificate
Manager CA signing certificates; see section “CA Signing Key Pair and Certificate”
in Chapter 14, “Managing CMS Keys and Certificates” of CMS Installation and
Setup Guide. By default, the rule is configured as follows:
• The rule is enabled.
• The predicate expression (
predicate=HTTP_PARAMS.certType==ca
) ensures
that the rule is applied only to CA signing certificate requests.
• The extension is marked noncritical (to comply with the PKIX
recommendation).
encipherOnly
Specifies whether to set the
encipherOnly
bit (or bit 7) of the key usage extension
in certificates specified by the
predicate
parameter.
Permissible values:
true
,
false
, or
HTTP_INPUT
.
• Select
true
if you want the server to set the bit (default).
• Select
false
if you don’t want the server to set the bit.
• Select
HTTP_INPUT
if you want the server to check the certificate request for
the HTTP input variable corresponding to the
encipherOnly
bit and set the
bit accordingly. If the variable is set to
true
, the server sets the bit. If the
variable doesn’t exist or if it is set to
false
(or any other value), the server
doesn’t set the bit.
decipherOnly
Specifies whether to set the
decipherOnly
bit (or bit 8) of the key usage extension
in certificates specified by the
predicate
parameter.
Permissible values:
true
,
false
, or
HTTP_INPUT
.
• Select
true
if you want the server to set the bit (default).
• Select
false
if you don’t want the server to set the bit.
• Select
HTTP_INPUT
if you want the server to check the certificate request for
the HTTP input variable corresponding to the
decipherOnly
bit and set the
bit accordingly. If the variable is set to
true
, the server sets the bit. If the
variable doesn’t exist or if it is set to
false
(or any other value), the server
doesn’t set the bit.
Table 4-15
Description of parameters defined in the KeyUsageExt module (Continued)
Parameter Description