IssuerConstraints Plug-in Module
94
Netscape Certificate Management System Plug-Ins Guide • May 2002
DSAKeyRule Rule
The rule named
DSAKeyRule
is an instance of the
DSAKeyConstraints
module.
Certificate Management System automatically creates this rule during installation.
By default, the rule is configured as follows:
•
The rule is enabled.
•
The predicate expression is left blank so that the rule is applied to all certificate
enrollment and renewal requests processed by the server.
•
The minimum key size permitted for certificates is 512 bits (
minSize=512
).
•
The maximum key size permitted for certificates is 1024 bits (
maxSize=1024
).
•
The exponents allowed are 3, 7, 17, and 65537 (
exponents=3,7,17,65537
).
For details on individual parameters defined in the rule, see Table 3-3 on page 93.
You need to review this rule and make the changes appropriate for your PKI setup.
For instructions, see section “Step 2. Modify Existing Policy Rules” in Chapter 18,
“Setting Up Policies” of CMS Installation and Setup Guide. For instructions on
adding additional instances, see section “Step 4. Add New Policy Rules” in the
same chapter.
IssuerConstraints Plug-in Module
The
IssuerConstraints
plug-in module implements the issuer constraints policy.
The policy enables you to effectively deploy certificate-based enrollment explained
in “Certificate-Based Enrollment” on page 50.
The policy enables the Certificate Manager to authenticate an end user by checking
the issuer DN of the CA that has issued the certificate the user presents as an
enrollment token during enrollment. Note that in the current implementation, the
CA that issues the new certificates must be the same as the one that has issued the
certificates used for SSL client authentication; that is, the issuer DN in the
authentication certificate must match the issuer DN specified in the policy
configuration.
During installation, Certificate Management System automatically creates an
instance of the issuer constraints policy. See “IssuerRule Rule” on page 96. The
server also provides appropriate enrollment forms for the three certificate-based
enrollment scenarios explained above; see “Enrollment Forms” on page 53.
Summary of Contents for Certificate Management System 6.01
Page 1: ...Plug Ins Guide Netscape Certificate Management System Version6 01 May 2002...
Page 10: ...10 Netscape Certificate Management System Plug Ins Guide May 2002...
Page 62: ...Enrollment Forms 62 Netscape Certificate Management System Plug Ins Guide May 2002...
Page 308: ...NTEventLog Plug in Module 308 Netscape Certificate Management System Plug Ins Guide May 2002...
