Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Admin Manual

Page: 487 / 564

policyConstraints
465
of the signing certificate). This extension is null-valued; its meaning is determined by its presence or
absence.
Since the presence of this extension in a certificate will cause OCSP clients to trust responses signed
with that certificate, use of this extension should be managed carefully. If the OCSP signing key is
compromised, the entire process of validating certificates in the PKI will be compromised for the
duration of the validity period of the certificate. Therefore, certificates using
OCSPNocheck
should be
issued with short lifetimes and be renewed frequently.
OID
1.3.6.1.5.5.7.48.4
Criticality
This extension should be noncritical.
B.3.11. policyConstraints
This extension, which is for CA certificates only, constrains path validation in two ways. It can be used
to prohibit policy mapping or to require that each certificate in a path contain an acceptable policy
identifier.
PKIX requires that, if present, this extension must never consist of a null sequence. At least one of the
two available fields must be present.
OID
2.5.29.36
Criticality
This extension may be critical or noncritical.
B.3.12. policyMappings
The Policy Mappings extension is used in CA certificates only. It lists one or more pairs of OIDs used
to indicate that the corresponding policies of one CA are equivalent to policies of another CA. It may
be useful in the context of cross-pair certificates.
This extension may be supported by CAs and applications.
OID
2.5.29.33
Criticality
This extension must be noncritical.