Netscape Certificate Management System 6.1, Руководство администратора

Страница: 465 / 840

Defaults Reference
Chapter 10 Certificate Profiles 465
• Extension Constraint, see “Extension Constraint,” on page 475.
• No Constraints, see “No Constraint,” on page 477.
Table 10-12 Policy Constraints Extension Default Configuration Parameters
Parameter Description
critical
Select true to mark this extension critical; select false to mark the
extension noncritical.
reqExplicit
Policy
Specifies the total number of certificates permitted in the path
before an explicit policy is required—that is, the number of CA
certificates that can be chained below (subordinate to) the
subordinate CA certificate being issued before an acceptable
policy is required.
•
-1
specifies that the field should not be set in the extension.
•
0
specifies that no subordinate CA certificates are permitted in
the path before an explicit policy is required.
•
n
must be an integer that is greater than zero. It specifies at the
most
n
subordinate CA certificates are allowed in the path
before an explicit policy is required.
Note that the number you specify affects the number of CA
certificates to be used during certificate validation. The chain starts
with the end-entity certificate being validated and moving up the
chain. (The parameter has no effect if the extension is set in
end-entity certificates.)
inhibitPolicy
Mapping
Specifies the total number of certificates permitted in the path
before policy mapping is no longer permitted.
•
-1
specifies that the field should not be set in the extension.
•
0
specifies that no subordinate CA certificates are permitted in
the path before policy mapping is no longer permitted.
•
n
must be an integer that is greater than zero. It specifies at the
most
n
subordinate CA certificates are allowed in the path
before policy mapping is no longer permitted. For example, a
value of one indicates that policy mapping may be processed
in certificates issued by the subject of this certificate, but not in
additional certificates in the path.