Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Руководство администратора

Страница: 341 / 554

No Constraint
319
13.8.6. No Constraint
This constraint implements no constraint. When chosen along with a default, there are not constraints
placed on that default.
13.8.7. Netscape Certificate Type Extension Constraint
WARNING
This constraint is obsolete. Instead of using the Netscape Certificate Type extension
constraint, use the Key Usage extension or Extended Key Usage extension.
The Netscape Certificate Type extension constraint checks if the Netscape Certificate Type extension
in the certificate request satisfies the criteria set in this constraint.
13.8.8. Signing Algorithm Constraint
The Signing Algorithm constraint checks if the signing algorithm in the certificate request satisfies the
criteria set in this constraint.
Parameter Description
signingAlgsAllowed Sets the signing algorithms that can be specified to sign the
certificate. The algorithms can be any or all of the following:
• MD2withRSA
• MD5withRSA
• SHA1withRSA
• SHA256withRSA
• SHA512withRSA
The algorithm can also be set to
-
, which means the server
picks the best available signing algorithm that is compatible
with the key type (RSA).
Table 13.25. Signing Algorithms Constraint Configuration Parameters
13.8.9. Subject Name Constraint
The Subject Name constraint checks if the subject name in the certificate request satisfies the criteria.
Parameter Description
Pattern Specifies a regular expression as a string.
Table 13.26. Subject Name Constraint Configuration Parameters
The Subject Name constraint supports all regular-expression constructs listed in
http://java.sun.com/
j2se/1.4.1/docs/api/java/util/regex/Pattern.html
. This allows wildcards such as asterisks (
*
) to search
for any number of the characters and periods (
.
)to search for any type character.
For example, if the pattern of the subject name constraint is set to
uid=.*
, the certificate profile
framework checks if the subject name in the certificate request matches the pattern. A subject name