Netscape Certificate Management System 6.1, Руководство администратора

Страница: 464 / 840

Defaults Reference
464 Netscape Certificate Management System Administrator’s Guide • February 2003
No Default Extension
This default can be used to set constraints when no defaults are being used. This
default has not settings and sets no defaults, but does allow you to set all of the
constraints available.
OCSP No Check Extension Default
This default populates an OCSP No Check extension in the certificate request. The
extension, which should be used in OCSP responder certificates only, indicates
how OCSP-compliant applications can verify the revocation status of the certificate
an authorized OCSP responder uses to sign OCSP responses.
For general information about this extension, see “OCSPNocheck” on page 730.
You can define the following constraints with this default:
• Netscape Certificate Type Extension Constraint, see “Netscape Certificate Type
Extension Constraint,” on page 477.
• Extension Constraint, see “Extension Constraint,” on page 475.
• No Constraints, see “No Constraint,” on page 477.
Policy Constraints Extension Default
This default populates a policy constraints extension in the certificate request. The
extension, which can be used in CA certificates only, constrains path validation in
two ways—either to prohibit policy mapping or to require that each certificate in a
path contain an acceptable policy identifier. The default allows you to specify both,
ReqExplicitPolicy
and
InhibitPolicyMapping
fields. PKIX standard requires
that, if present in a CA certificate, the extension must never consist of a null
sequence. At least one of the two specified fields must be present.
For general information about this extension, see “policyConstraints” on page 731.
You can define the following constraints with this default:
Table 10-11 OCSP No Check Extension Default Configuration Parameters
Parameter Description
critical
Select true to mark this extension critical; select false to mark the
extension noncritical.