Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Руководство администратора

Страница: 334 / 554

Chapter 13. Certificate Profiles
312
Parameter Description
Enable Sets whether that attribute is able to be added to the
certificate. Select
true
to enable the attribute.
Table 13.18. Subject Directory Attributes Extension Default Configuration Parameters
13.7.19. Subject Key Identifier Extension Default
This default attaches a Subject Key Identifier extension to the certificate. The extension identifies
certificates that contain a particular public key, which identifies a certificate from among several that
have the same subject name.
For general information about this extension, see
Section A.3.16, “subjectKeyIdentifier”
.
If enabled, the profile adds a Subject Key Identifier Extension to an enrollment request if the extension
does not already exist. If the extension exists in the request, such as a CRMF request, the default
replaces the extension. After an agent approves the manual enrollment request, the profile accepts
any Subject Key Identifier Extension that is already there.
This default has no parameters. If used, this extension is included in the certificate with the public key
information.
The following constraints can be defined with this default:
• Extension Constraint; see
Section 13.8.3, “Extension Constraint”
.
• No Constraints; see
Section 13.8.6, “No Constraint”
.
13.7.20. Subject Name Default
This default attaches a server-side configurable subject name to the certificate request. A static
subject name is used as the subject name in the certificate.
The following constraints can be defined with this default:
• Subject Name Constraint; see
Section 13.8.9, “Subject Name Constraint”
.
• Unique Subject Name Constraint; see
Section 13.8.10, “Unique Subject Name Constraint”
.
• No Constraints; see
Section 13.8.6, “No Constraint”
.
Parameter Description
Name Specify the subject name for this certificate.
Table 13.19. Subject Name Default Configuration Parameters
If you need to get a certificate subject name that uses the DNPATTERN value from the UidPwdDirAuth
plugin, then configure the profile to use the Subject Name Default plugin and substitute the
Name
parameter with the "Subject Name" from the
AuthToken
as shown below.
policyset.userCertSet.1.default.class_id=subjectNameDefaultImpl
policyset.userCertSet.1.default.name=Subject Name Default
policyset.userCertSet.1.default.params.name=$request.auth_token.tokenCertSubject$