Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Руководство администратора

Страница: 456 / 564

Appendix B. Defaults, Constraints, and Extensions for Certificates and CRLs
434
Parameter Description
the issuerAlternativeName, then literal string
can be used without any token expression. For
example,
Certificate Authority
.
Table B.7. Issuer Alternative Name Extension Default Configuration Parameters
B.1.8. Key Usage Extension Default
This default attaches the Key Usage extension to the certificate. The extension specifies the purposes
for which the key contained in a certificate should be used, such as data signing, key encryption, or
data encryption, which restricts the usage of a key pair to predetermined purposes.
For general information about this extension, see
Section B.3.8, “keyUsage”
.
The following constraints can be defined with this default:
• Key Usage Constraint; see
Section B.2.5, “Key Usage Extension Constraint”
.
• Extension Constraint; see
Section B.2.3, “Extension Constraint”
.
• No Constraints; see
Section B.2.6, “No Constraint”
.
Parameter Description
critical Select
true
to mark this extension critical; select
false
to mark the extension noncritical.
digitalSignature Specifies whether to allow signing SSL client
certificates and S/MIME signing certificates.
Select
true
to set.
nonRepudiation Specifies whether to use for S/MIME signing
certificates. Select
true
to set.
WARNING
Using this bit is controversial.
Carefully consider the legal
consequences of its use before
setting it for any certificate.
keyEncipherment Specifies whether the public key in the subject
is used to encipher private or secret keys. This
is set for SSL server certificates and S/MIME
encryption certificates. Select
true
to set.
dataEncipherment Specifies whether to set the extension when the
subject's public key is used to encipher user data
as opposed to key material. Select
true
to set.
keyAgreement Specifies whether to set the extension whenever
the subject's public key is used for key
agreement. Select
true
to set.
keyCertsign Specifies whether the public key is used to verify
the signature of other certificates. This setting is