Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 325 / 554

Name Constraints Extension Default
303
Parameter Description
PermittedSubtreesmax_
n
Specifies the maximum number of permitted subtrees.
•
-1
specifies that the field should not be set in the extension.
•
0
specifies that the maximum number of subtrees is zero.
•
n
must be an integer that is greater than zero. It sets the
maximum number of subtrees allowed.
PermittedSubtreeNameChoice_
n
Specifies the general name type for the permitted subtree to
include in the extension. The permissible values are as follows:
• RFC822Name
• DirectoryName
• DNSName
• EDIPartyName
• URIName
• IPAddress
• OIDName
• OtherName
PermittedSubtreeNameValue_
n
Specifies the general name value for the permitted subtree to
include in the extension.
• For
RFC822Name
, the value must be a valid Internet mail
address. For example,
testCA@example.com
.
• For
DirectoryName
, the value must be a string form of
X.500 name, similar to the subject name in a certificate.
For example,
cn=SubCA, ou=Research Dept, o=Example
Corporation, c=US
.
• For
DNSName
, the value must be a valid fully-qualified
domain name. For example,
testCA.example.com
.
• For
EDIPartyName
, the value must be an IA5String. For
example,
Example Corporation
.
• For
URIName
, the value must be a non-relative URI following
the URL syntax and encoding rules. The name must
include both a scheme, such as
http
, and a fully qualified
domain name or IP address of the host. For example,
http://
testCA.example.com
.
• For
IPAddress
, the value must be a valid IP address.
An IPv4 address must be in the format
n.n.n.n
or
n.n.n.n,m.m.m.m
. For example,
128.21.39.40
or
128.21.39.40,255.255.255.00
. An IPv 6
address with netmask is separated by a comma.