Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 492 / 554

Appendix A. Certificate and CRL Extensions
470
A.3.11.2. Criticality
This extension may be critical or noncritical.
A.3.11.3. Discussion
This extension, which is for CA certificates only, constrains path validation in two ways. It can be used
to prohibit policy mapping or to require that each certificate in a path contain an acceptable policy
identifier.
PKIX requires that, if present, this extension must never consist of a null sequence. At least one of the
two available fields must be present.
A.3.12. policyMappings
A.3.12.1. OID
2.5.29.33
A.3.12.2. Criticality
This extension must be noncritical.
A.3.12.3. Discussion
The Policy Mappings extension is used in CA certificates only. It lists one or more pairs of OIDs used
to indicate that the corresponding policies of one CA are equivalent to policies of another CA. It may
be useful in the context of cross-pair certificates.
This extension may be supported by CAs and applications.
A.3.13. privateKeyUsagePeriod
A.3.13.1. OID
2.5.29.16
A.3.13.2. Discussion
The Private Key Usage Period extension allows the certificate issuer to specify a different validity
period for the private key than for the certificate itself. This extension is intended for use with digital
signature keys.
NOTE
PKIX Part 1 recommends against the use of this extension. CAs conforming to PKIX Part
1
must not
generate certificates with this extension.