Netscape Certificate Management System 6.1, Administrator'S Manual

Page: 730 / 840

Standard X.509 v3 Certificate Extensions
730 Netscape Certificate Management System Administrator’s Guide • February 2003
If the
keyUsage
extension is present and is marked critical, then it will be used to
enforce the usage of the certificate and key. The extension is used to limit the usage
of a key; if the extension is not present or not critical, all types of usage are allowed.
If the
keyUsage
extension is present (critical or not), it is used to select from
multiple certificates for a given operation. For example, it is used to distinguish
separate signing and encryption certificates for users who have separate certificates
and key pairs for these operations.
CMS Version Support
Supported since CMS 4.1. Refer to “KeyUsageExt” on page 535.
nameConstraints
OID
2.5.29.30
Criticality
PKIX Part 1 requires that this extension be marked critical.
Discussion
This extension, which can used in CA certificates only, defines a name space within
which all subject names in subsequent certificates in a certification path must be
located.
CMS Version Support
Supported since CMS 4.2. Refer to “NameConstraintsExt” on page 541.
OCSPNocheck
OID
1.3.6.1.5.5.7.48.4
S/MIME Encryption
keyEncipherment
Certificate Signing
keyCertSign
Object Signing
digitalSignature
Table G-3 Certificate uses and corresponding Key Usage bits (Continued)
Purpose of certificate Required Key Usage bit