Netscape Certificate Management System 6.2, Руководство администратора

Страница: 526 / 874

Extension-Specific Policy Module Reference
526 Netscape Certificate Management System Administrator’s Guide • June 2003
application validating the certificate must be able to interpret the extension, or else
it must reject the certificate. Since it’s unlikely that all applications will be able to
interpret your custom extensions, you should consider marking these extensions
noncritical.
Note that each instance of the policy can be configured to add one custom
extension only. To configure the server to add multiple custom extensions, create
multiple instances of the module, each with a distinct name and appropriate
configuration values. Also note that the policy allows you to encode simple
(possibly nested) SEQUENCEs. There is no support for CHOICE, SET, or ASN.1
tagging.
During installation, CMS automatically creates an instance of the generic ASN.1
extension policy, named
GenericASN1Ext
, that is disabled by default.
Configuration Parameters of GenericASN1Ext
The configuration defines a custom extension named
testGenASN1Ext
with OID
2.4.5.99. The extension is non-critical, and it will be added to all certificates issued
by the server. The expected
dumpasn1
output (see “dumpasn1 Tool” in CMS
Command-Line Tools Guide) of the resulting extension, would look like this:
337 30 148: . . . . SEQUENCE {
340 06 3: . . . . . OBJECT IDENTIFIER ’2 4 5 99’
345 04 140: . . . . . OCTET STRING, encapsulates {
348 30 137: . . . . . . . SEQUENCE {
351 13 24: . . . . . . . . PrintableString ’1st data in 1st sequence’
377 16 24: . . . . . . . . IA5String ’2nd data in 1st sequence’
403 13 32: . . . . . . . . PrintableString ’This is 3rd data in 1st
sequence’
437 04 10: . . . . . . . . OCTET STRING
: . . . . . . . . . 11 22 33 44 A0 B0 C0 D0 E0 F0
449 30 37: . . . . . . . . SEQUENCE {
451 17 13: . . . . . . . . . UTCTime ’000406070000Z’
466 30 8: . . . . . . . . . SEQUENCE {
468 01 1: . . . . . . . . . . BOOLEAN TRUE
471 06 3: . . . . . . . . . . OBJECT IDENTIFIER ’2 4 5 100’
: . . . . . . . . . . }
476 04 10: . . . . . . . . . OCTET STRING
: . . . . . . . . . 11 22 33 44 A0 B0 C0 D0 E0 F0
: . . . . . . . . . }
: . . . . . . . . }
: . . . . . . . }
: . . . . . }