Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 507 / 874

Constraints-Specific Policy Module Reference
Chapter 11 Policies 507
During installation, CMS automatically creates an instance of the validity
constraints policy, named
DefaultValidityRule
, that is enabled by default.
Table 11-14 describes the configuration parameters of the
ValidityConstraints
policy.
Table 11-14 ValidityConstraints Configuration Parameters
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Select to enable (default), deselect to
disable.
predicate
Specifies the predicate expression for this rule. If you want this rule to be applied to
all certificate requests, leave the field blank (default). To form a predicate expression,
see “Using Predicates in Policy Rules” on page 483.
minValidity
Specifies the minimum validity period, in days, for certificates.
maxValidity
Specifies the maximum validity period, in days, for certificates.
leadTime
Specifies the lead time, in minutes, for certificates. For a certificate renewal request to
pass the renewal validity constraints policy, the value of the
notBefore
attribute in
the certificate request must not be more than value of the
leadTime
parameter in the
future, relative to the time when the policy rule is run.
The
notBefore
attribute value specifies the date on which the certificate validity
begins; validity dates through the year 2049 are encoded as
UTCTime
, dates in 2050 or
later are encoded as
GeneralizedTime
.
lagTime
Specifies the lag time, in minutes, for certificates. For a certificate renewal request to
pass the renewal validity constraints policy, the value of the
notBefore
attribute in
the certificate request must not be more than the value of the
lagTime
in the past,
relative to the time when the policy is run.
The
notBefore
attribute value specifies the date on which the certificate validity
ends; validity dates through the year 2049 are encoded as
UTCTime
, dates in 2050 or
later are encoded as
GeneralizedTime
.
notBeforeSkew
Specifies the number of minutes to subtract from the current time when creating the
value for the certificate’s
notBefore
attribute. It can help some clients with
incorrectly set clocks use the new certificate after downloading. For example, if the
certificate is issued at 11:30 a.m. and the clock settings of the client into which the
certificate is downloaded is 11:20 a.m., the certificate cannot be used for 10 minutes.
Setting the value of the
beforeFix
parameter to 10 minutes would adjust the value
of the
notBefore
parameter to 11:20 a.m.—thus making the certificate usable
following the download.