Netscape Certificate Management System 6.1, Руководство администратора

Страница: 553 / 840

Extension-Specific Policy Module Reference
Chapter 11 Policies 553
PolicyConstraintsExt
The
PolicyConstraintsExt
plug-in module enables you to add the Policy
Constraints Extension to certificates. The extension, which can be used in CA
certificates only, constrains path validation in two ways—either to prohibit policy
mapping or to require that each certificate in a path contain an acceptable policy
identifier. The policy allows you to specify both,
requireExplicitPolicy
and
inhibitPolicyMapping
fields. PKIX standard requires that, if present in a CA
certificate, the extension must never consist of a null sequence. At least one of the
two specified fields must be present.
For general information about this extension, see “policyConstraints” on page 731.
During installation, CMS automatically creates an instance of the policy constraints
extension policy, named
PolicyConstraintsExt
, that is disabled by default.
critical
Select to mark critical, deselect to mark noncritical (default).
Table 11-35 PolicyConstraintsExt Configuration Parameters
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Select to enable, deselect to disable.
predicate
Specifies the predicate expression for this rule. If you want this rule to be applied to
all certificate requests, leave the field blank (default). To form a predicate expression,
see“Using Predicates in Policy Rules,” on page 485.
critical
Select to mark critical, deselect to mark noncritical (default).
Table 11-34 OCSPNoCheckExt Configuration Parameters (Continued)
Parameter Description