Netscape Certificate Management System 6.01, Manual

Page: 97 / 377

KeyAlgorithmConstraints Plug-in Module
Chapter 3 Constraints Policy Plug-in Modules 97
For details on individual parameters defined in the rule, see Table 3-4 on page 96.
You need to review this rule and make the changes appropriate for your PKI setup.
For instructions, see section “Step 2. Modify Existing Policy Rules” in Chapter 18,
“Setting Up Policies” of CMS Installation and Setup Guide. For instructions on
adding additional instances, see section “Step 4. Add New Policy Rules” in the
same chapter.
KeyAlgorithmConstraints Plug-in Module
The
KeyAlgorithmConstraints
plug-in module implements the key algorithm
constraints policy. This policy restricts the key algorithm requested in certificates to
the algorithms, such as RSA and DSA, supported by Certificate Management
System. In other words, this policy allows you to set restrictions on the types of
public keys certified by Certificate Management System.
You may apply this policy to end-entity certificate enrollment and renewal
requests. For example, if you want your CA to certify only those public keys that
comply with the PKCS-1 RSA Encryption Standard, you can configure the server
for that using the policy.
During installation, Certificate Management System automatically creates an
instance of the key algorithm constraints policy. See “KeyAlgRule Rule” on
page 99.
Configuration Parameters of
KeyAlgorithmConstraints
In the CMS configuration file, the
KeyAlgorithmConstraints
module is identified
as
<subsystem>.Policy.impl.KeyAlgorithmConstraints.class=
com. netscape.cms.policy.KeyAlgorithmConstraints
, where
<subsystem>
is
ca
or
ra
(prefix identifying the subsystem).
In the CMS window, the module is identified as
KeyAlgorithmConstraints
.
Figure 3-5 shows how the configurable parameters for the module are displayed in
the CMS window.