Netscape Certificate Management System 6.1, Руководство администратора

Страница: 729 / 840

Standard X.509 v3 Certificate Extensions
Appendix G Certificate and CRL Extensions 729
Discussion
The Key Usage extension defines the purpose of the key contained in the certificate.
The Key Usage, Extended Key Usage, Basic Constraints, and Netscape Certificate
Type extensions act together to specify the purposes for which a certificate can be
used. For more information on interactions between these extensions in CA
certificates, see “CA Certificates and Extension Interactions” on page 742.
If this extension is included at all, set the bits as follows:
•
digitalSignature
(
0
) for SSL client certificates, S/MIME signing certificates,
and object-signing certificates.
•
nonRepudiation
(
1
) for some S/MIME signing certificates and object-signing
certificates. Note, however, that the use of this bit is controversial. You should
carefully consider the legal consequences of its use before setting it for any
certificate.
•
keyEncipherment
(
2
) for SSL server certificates and S/MIME encryption
certificates.
•
dataEncipherment
(
3
) when the subjects’s public key is used to encipher user
data (as opposed to key material).
•
keyAgreement
(
4
) whenever the subject’s public key is used for key agreement.
•
keyCertSign
(
5
) for all CA signing certificates
•
cRLSign
(
6
) for CA signing certificates that are used to sign CRLs
•
encipherOnly
(
7
) if the public key is to be used only for enciphering data. If
this bit is set,
keyAgreement
should also be set.
•
decipherOnly
(
8
) if the public key is to be used only for deciphering data. If
this bit is set,
keyAgreement
should also be set.
Table G-3 summarizes the above guidelines for typical certificate uses.
Table G-3 Certificate uses and corresponding Key Usage bits
Purpose of certificate Required Key Usage bit
CA Signing
keyCertSign
cRLSign
SSL Client
digitalSignature
SSL Server
keyEncipherment
S/MIME Signing
digitalSignature