Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора

Страница: 300 / 512

Chapter 12. Certificate Profiles
280
• If this extension is set on a profile with a corresponding OID (Extension Constraint), then any
certificate request processed through that profile
must
carry the specified extension or the request is
rejected.
A certificate
request
that contains the user-defined extensions must be submitted to the profile. The
certificate enrollment forms, however, do not have any input fields for users to add user-supplied
extensions. Submitting a certificate request without supplying the extension fails. An input for adding
the extension can be created for the profile using the CS SDK.
The following constraints can be defined with this default:
• Basic Constraints Extension Constraint; see
Section 12.8.1, “Basic Constraints Extension
Constraint”
.
• Extended Key Usage Constraint; see
Section 12.8.2, “Extended Key Usage Extension Constraint”
.
• Extension Constraint; see
Section 12.8.3, “Extension Constraint”
.
• Key Constraints; see
Section 12.8.4, “Key Constraint”
.
• Netscape Certificate Type Extension Constraint; see
Section 12.8.7, “Netscape Certificate Type
Extension Constraint”
.
• No Constraints; see
Section 12.8.6, “No Constraint”
.
This example adds the User Supplied Extension Default to a profile with the Basic Constraints
Extension Constraint. The OID specified in the
userExtOID
parameter is for the Basic Constraints
Extension Constraint.
policyset.set1.p5.default.params.keyUsageNonRepudiation=true
policyset.set1.p6.constraint.class_id=basicConstraintsExtConstraintImpl
policyset.set1.p6.constraint.name=Basic Constraint Extension Constraint
policyset.set1.p6.constraint.params.basicConstraintsCritical=true
policyset.set1.p6.constraint.params.basicConstraintsIsCA=false
policyset.set1.p6.constraint.params.basicConstraintsMinPathLen=-1
policyset.set1.p6.constraint.params.basicConstraintsMaxPathLen=-1
policyset.set1.p6.default.class_id=userExtensionDefaultImpl
policyset.set1.p6.default.name=User Supplied Extension Default
policyset.set1.p6.default.userExtOID=2.5.29.19
Editing profiles is described in
Section 12.3.2, “Modifying Certificate Profiles through the Command
Line”
.
12.7.23. User Supplied Key Default
This default attaches a user-supplied key into the certificate request. This is a required default. Keys
are part of the enrollment request.
The following constraints can be defined with this default:
• Key Constraint; see
Section 12.8.4, “Key Constraint”
.
• No Constraints; see
Section 12.8.6, “No Constraint”
.