Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 437 / 840

Defaults Reference
Chapter 11 Certificate Profiles 437
Key Usage Extension Default
This default populates the Key Usage extension in the certificate request. The extension
specifies the purposes for which the key contained in a certificate should be used—for
example, it specifies whether the key should be used for data signing, key encipherment, or
data encipherment—and thus enables you to restrict the usage of a key pair to
predetermined purposes.
For general information about this extension, see “keyUsage” on page 736.
You can define the following constraints with this default:
• Key Usage Constraint, see “Key Usage Extension Constraint,” on page 455.
• Extension Constraint, see “Extension Constraint,” on page 454.
• No Constraints, see “No Constraint,” on page 456.
PointType_<n>
Specifies the general-name type of the CRL issuer that signed the CRL
maintained at distribution point.
Permissible values:
DirectoryName
or
URIName
. The value you
specify for this parameter must correspond to the value in the
issuerName
field.
Table 11-7 Key Usage Extension Default Configuration Parameters
Parameter Description
critical
Select true to mark this extension critical; select false to mark the
extension noncritical.
digitalSignature
Specifies whether to allow for signing of SSL client certificates,
S/MIME signing certificates, and object-signing certificates.
Select
true
to set, select
false
to not set.
nonRepudiation
Specifies whether to some S/MIME signing certificates and
object-signing certificates. Note, however, that the use of this bit is
controversial. You should carefully consider the legal consequences of
its use before setting it for any certificate. Select
true
to set, select
false
to not set.
Table 11-6 Freshest CRL Extension Default Configuration Parameters (Continued)
Parameter Description