Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 495 / 840

Extension-Specific Policy Module Reference
Chapter 12 Policies 495
During installation, CS automatically creates an instance of the certificate policies
extension policy, named
CertificatePoliciesExt
, that is disabled by default.
Table 12-18 CertificatePoliciesExt Configuration Parameters
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Select to enable, deselect to disable.
predicate
Specifies the predicate expression for this rule. If you want this rule to be applied to all
certificate requests, leave the field blank (default). To form a predicate expression, see
“Using Predicates in Policy Rules” on page 465.
critical
Specifies whether the extension should be marked critical or noncritical. Select to mark
critical, deselect to mark noncritical (default).
policyId
Specifies the OID assigned to the policy statement you want to include in the extension. If
you specify a valid OID, the server includes the OID in the extension.
The
policyId
, if specified, identifies by number a particular textual statement prepared
by your organization (which is specified by the parameter named
organizationName
,
listed next in this table). For example, it might identify the organization as
Example
Corporation
and notice number
1.2.3.4.5.6.99
. Typically, applications validating
the certificate will have a notice file containing the current set of notices for your company;
these application will interpret the number in the certificate by extracting the notice text that
corresponds to the number from the file and display it to the relying party.
Permissible values: A unique, valid OID specified in dot-separated numeric component
notation (see the example). Although you can invent your own OIDs for the purposes of
evaluating and testing this server, in a production environment, you should comply with the
ISO rules for defining OIDs and for registering subtrees of IDs. See
Appendix H, “Object
Identifiers”
for information on allocating private OIDs.
Example:
2.16.840.1.113730.1.99
organizationName
Specifies the name of the organization that owns the OID or is the owner of the policy
statement referenced by the OID.
Example:
Example Corporation
cpsURI
Specifies the location where the Certification Practice Statement published by the CA (that
has issued the certificate) can be found.
Permissible values: An IA5String value. The PKIX standard recommends that the pointer
should be in the form of a URI.
Example:
http://testCA.example.com/CPS_statement