Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Руководство администратора

Страница: 463 / 564

Policy Constraints Extension Default
441
The following constraints can be defined with this default:
• Extension Constraint; see
Section B.2.3, “Extension Constraint”
.
• No Constraints; see
Section B.2.6, “No Constraint”
.
Parameter Description
critical Select
true
to mark this extension critical; select
false
to mark the extension noncritical.
Table B.11. OCSP No Check Extension Default Configuration Parameters
B.1.14. Policy Constraints Extension Default
This default attaches a Policy Constraints extension to the certificate. The extension, which can be
used in CA certificates only, constrains path validation in two ways: either to prohibit policy mapping or
to require that each certificate in a path contain an acceptable policy identifier. The default can specify
both
ReqExplicitPolicy
and
InhibitPolicyMapping
. PKIX standard requires that, if present
in the certificate, the extension must never consist of a null sequence. At least one of the two specified
fields must be present.
For general information about this extension, see
Section B.3.11, “policyConstraints”
.
The following constraints can be defined with this default:
• Extension Constraint; see
Section B.2.3, “Extension Constraint”
.
• No Constraints; see
Section B.2.6, “No Constraint”
.
Parameter Description
critical Select
true
to mark this extension critical; select
false
to mark the extension noncritical.
reqExplicitPolicy Specifies the total number of certificates
permitted in the path before an explicit policy is
required. This is the number of CA certificates
that can be chained below the subordinate
CA certificate before an acceptable policy is
required.
•
-1
specifies that the field should not be set in
the extension.
•
0
specifies that no subordinate CA certificates
are permitted in the path before an explicit
policy is required.
•
n
must be an integer that is greater than
zero. It specifies the maximum number of
subordinate CA certificates allowed in the path
before an explicit policy is required.
This number affects the number of CA
certificates to be used during certificate
validation. The chain starts with the end-entity