Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Admin Manual

Page: 479 / 564

Unique Subject Name Constraint
457
ou=engineering,ou=people
or
ou=engineering,o="Example Corp"
, the pattern is
.*ou=engineering,ou=people.* | .*ou=engineering,o="Example Corp".*
.
NOTE
For constructing a pattern which uses a special character, such as a period (
.
), escape
the character with a back slash (
\
). For example, to search for the string
o="Example
Inc."
, set the pattern to
o="Example Inc\."
.
B.2.11. Unique Subject Name Constraint
The Unique Subject Name constraint restricts the server from issuing multiple certificates with the
same subject names. When a certificate request is submitted, the server automatically checks the
nickname against other issued certificate nicknames. This constraint can be applied to certificate
enrollment and renewal through the end-entities' page.
Certificates cannot have the same subject name unless one certificate is expired or revoked (and not
on hold). So, active certificates cannot share a subject name, with one exception: if certificates have
different key usage bits, then they can share the same subject name, because they have different
uses.
Parameter Description
enableKeyUsageExtensionChecking Optional setting which allows certificates to have
the same subject name as long as their key
usage settings are different. This is either true or
false. The default is true, which allows duplicate
subject names.
Table B.27. Unique Subject Name Constraint Configuration Parameters
B.2.12. Validity Constraint
The Validity constraint checks if the validity in the certificate request satisfies the criteria.
Parameter Description
range The range of the validity period. This is an
integer which set the number of days.
Table B.28. Validity Constraint Configuration Parameters
B.3. Standard X.509 v3 Certificate Extension Reference
An X.509 v3 certificate contains an extension field that permits any number of additional fields to be
added to the certificate. Certificate extensions provide a way of adding information such as alternative
subject names and usage restrictions to certificates. Older Netscape servers, such as Red Hat
Directory Server and Red Hat Certificate System, that were developed before PKIX part 1 standards
were defined require Netscape-specific extensions.
The following is an example of the section of a certificate containing X.509 v3 extensions. The
Certificate System can display certificates in readable pretty-print format, as shown here. As in this
example, certificate extensions appear in sequence and only one instance of a particular extension
may appear per certificate; for example, a certificate may contain only one subject key identifier