Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Руководство администратора

Страница: 506 / 840

Extension-Specific Policy Module Reference
506 Red Hat Certificate System Administrator’s Guide • September 2005
The generic extension policy in CS accepts custom extensions in the form of object
identifiers (OIDs) and values as DER-encoded extension values. That is, for the server to
add a custom extension to certificates it issues, you need to first define the extension and
then configure the server with extension details.
Similar to a standard extension, you define a custom extension by defining an OID and a
ASN.1 structure.
• The OID must be specified in the dot-separated numeric component notation (for
example, 2.5.29.35). Although you can invent your own OIDs for the purposes of
evaluating and testing the server, in a production environment, you should comply with
the ISO rules for defining OIDs and for registering subtrees of IDs. See Appendix H,
“Object Identifiers” for information on allocating private OIDs.
• The ASN.1 structure must be constructed from a sequence of DER-encoded extension
values.
The resulting extension would look similar to the way a standard extension appears in
certificates (as defined in RFC 2459):
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
In the policy configuration, the
extnID
field is defined by the
oid
parameter, the
critical
field is defined by the
critical
parameter, and the
extnValue
field is defined
by evaluating the expression in the
pattern
parameter, which in turn is defined by the
attribute
parameters. See Table 12-24 on page 507 for details on individual parameters.
Typically, the application receiving the certificate checks the extension ID to determine if it
can recognize the ID. If it can, it uses the extension ID to determine the type of value used.
When adding your custom extension to certificates, keep in mind that if the extension exists
in a certificate and if it is marked critical, the application validating the certificate must be
able to interpret the extension, or else it must reject the certificate. Since it’s unlikely that all
applications will be able to interpret your custom extensions, you should consider marking
these extensions noncritical.
Note that each instance of the policy can be configured to add one custom extension only.
To configure the server to add multiple custom extensions, create multiple instances of the
module, each with a distinct name and appropriate configuration values. Also note that the
policy allows you to encode simple (possibly nested) SEQUENCEs. There is no support for
CHOICE, SET, or ASN.1 tagging.
During installation, CS automatically creates an instance of the generic ASN.1 extension
policy, named
GenericASN1Ext
, that is disabled by default.