Netscape Certificate Management System 6.1, Руководство администратора

Страница: 551 / 840

Extension-Specific Policy Module Reference
Chapter 11 Policies 551
During installation, CMS automatically creates an instance of the Netscape
certificate type extension policy for the various types of certificates that you may
want the server to issue, named
NSCertTypeExt
, that is enabled by default.
Additionally, the default enrollment forms—the directory-based, directory- and
PIN-based, manual, Kerberos server-based, and NIS server-based enrollment
forms—for various types of certificates also include the appropriate HTTP input
variables corresponding to Netscape certificate type extension bits. For details
about these forms.
Note that the default enrollment forms embed variables that are considered
appropriate for the type of certificate, such as client, server, or CA, that can be
requested using the form. For example, the server enrollment form embeds the
ssl_server
variable, whereas the subordinate CA (Certificate Manager)
enrollment form embeds the
ssl_client
,
email_ca
,
ssl_ca
and
object_signing_ca
variables.
In general, the forms are set up so that you don’t have to make any modifications.
However, if there is a need to modify the bit settings, be sure to add or remove the
corresponding variable. Also, when adding a new variable, make sure that the
HTML input format is as follows:
<input type="HIDDEN" value="true" name="variable_name">
where
variable_name
can be any of the variables listed in Table 11-32.
Table 11-32 HTTP input variables for Netscape certificate type extension bits
HTTP input variable Netscape certificate type extension bit
ssl_client
SSL Client (bit 0)
ssl_server
SSL Server (bit 1)
email
S/MIME (bit 2)
object_signing
Object Signing (bit 3)
Reserved for future use (bit 4)
ssl_ca
SSL CA (bit 5)
email_ca
S/MIME CA (bit 6)
object_signing_ca
Object Signing CA (bit 7)