Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора

Страница: 466 / 512

Appendix A. Certificate and CRL Extensions
446
Parameter Description
onlyContainsCACerts
Specifies that the distribution point contains user certificates
only if set. By default, this is not set, which means the
distribution point contains all types of certificates.
indirectCRL
Specifies that the distribution point contains an indirect CRL;
by default, this is not selected.
Table A.9. IssuingDistributionPoint Configuration Parameters
A.5.2. CRL Entry Extensions
The sections that follow lists the CRL entry extension types that are defined as part of the Internet
X.509 v3 Public Key Infrastructure proposed standard. All of these extensions are noncritical.
A.5.2.1. certificateIssuer
A.5.2.1.1. OID
2.5.29.29
A.5.2.1.2. Discussion
The Certificate Issuer extension identifies the certificate issuer associated with an entry in an indirect
CRL.
This extension is used only with indirect CRLs, which are not supported by the Certificate System.
A.5.2.2. holdInstructionCode
A.5.2.2.1. OID
2.5.29.23
A.5.2.2.2. Discussion
The Hold Instruction Code extension indicates the action to be taken after encountering a certificate
that has been placed on hold.
A.5.2.2.3. Parameters
Parameter Description
enable
Sets whether the rule is enabled; by default, this is disabled.
critical
Marks the extension as critical; by default, this is marked
noncritical.
instruction
Sets the action a validating application must take when it
encounters a certificate that has been put on hold; these can
be
none
,
callissuer
, or
reject
.
none
specifies that the validating application should not do
anything; the PKIX standard says that this is semantically
equivalent to disabling
holdInstructionCode
.