Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Руководство администратора

Страница: 336 / 554

Chapter 13. Certificate Profiles
314
• If this extension is set on a profile with a corresponding OID (Extension Constraint), then any
certificate request processed through that profile
must
carry the specified extension or the request is
rejected.
A certificate
request
that contains the user-defined extensions must be submitted to the profile. The
certificate enrollment forms, however, do not have any input fields for users to add user-supplied
extensions. Submitting a certificate request without supplying the extension fails.
The following constraints can be defined with this default:
• Basic Constraints Extension Constraint; see
Section 13.8.1, “Basic Constraints Extension
Constraint”
.
• Extended Key Usage Constraint; see
Section 13.8.2, “Extended Key Usage Extension Constraint”
.
• Extension Constraint; see
Section 13.8.3, “Extension Constraint”
.
• Key Constraints; see
Section 13.8.4, “Key Constraint”
.
• Netscape Certificate Type Extension Constraint; see
Section 13.8.7, “Netscape Certificate Type
Extension Constraint”
.
• No Constraints; see
Section 13.8.6, “No Constraint”
.
This example adds the User Supplied Extension Default to a profile with the Basic Constraints
Extension Constraint. The OID specified in the
userExtOID
parameter is for the Basic Constraints
Extension Constraint.
policyset.set1.p5.default.params.keyUsageNonRepudiation=true
policyset.set1.p6.constraint.class_id=basicConstraintsExtConstraintImpl
policyset.set1.p6.constraint.name=Basic Constraint Extension Constraint
policyset.set1.p6.constraint.params.basicConstraintsCritical=true
policyset.set1.p6.constraint.params.basicConstraintsIsCA=false
policyset.set1.p6.constraint.params.basicConstraintsMinPathLen=-1
policyset.set1.p6.constraint.params.basicConstraintsMaxPathLen=-1
policyset.set1.p6.default.class_id=userExtensionDefaultImpl
policyset.set1.p6.default.name=User Supplied Extension Default
policyset.set1.p6.default.params.userExtOID=2.5.29.19
Editing profiles is described in
Section 13.3.2, “Modifying Certificate Profiles through the Command
Line”
.
13.7.23. User Supplied Key Default
This default attaches a user-supplied key into the certificate request. This is a required default. Keys
are part of the enrollment request.
The following constraints can be defined with this default:
• Key Constraint; see
Section 13.8.4, “Key Constraint”
.
• No Constraints; see
Section 13.8.6, “No Constraint”
.