Extension-Specific Policy Module Reference
520
Red Hat Certificate System Administrator’s Guide • September 2005
For general information about this extension, see “nameConstraints” on page 737.
During installation, CS automatically creates an instance of the name constraints extension
policy, named
NameConstraintsExt
, that is disabled by default.
Table 12-29
NameConstraintsExt Configuration Parameters
Parameter
Description
enable
Specifies whether the rule is enabled or disabled. Select to enable, deselect to
disable.
predicate
Specifies the predicate expression for this rule. If you want this rule to be applied
to all certificate requests, leave the field blank (default). To form a predicate
expression, see section “Using Predicates in Policy Rules” in Chapter 18, “Setting
Up Policies” of
CS Administrator’s Guide
.
Example:
HTTP_PARAMS.certType==ca
critical
Specifies whether the extension should be marked critical or noncritical. Select to
mark critical (default), deselect to mark noncritical.
numPermittedSubtrees
Specifies the total number of subtrees to be permitted in the extension. Note that
each permitted subtree has a set of configuration parameters and you must specify
appropriate values for each of these parameters; otherwise the policy rule will
return an error.
You can change the total number of permitted subtrees by changing the value in
this field; there’s no restriction on the total number of permitted subtrees you can
include in the extension. Each set of configuration parameters is distinguished by
<n>
, which is an integer derived from the value you assign in this field. For
example, if you set the
numPermittedSubtrees
parameter to 2,
<n>
would
be
0
and
1
.
Permissible values:
0
or
n
.
•
0
specifies that no permitted subtrees can be contained in the extension.
•
n
specifies the total number of permitted subtrees to be included in the
extension; it must be an integer greater than zero. The default value is 8.
numExcludedSubtrees
Specifies the total number of subtrees to be excluded in the extension. Note that
each excluded subtree has a set of configuration parameters and you must specify
appropriate values for each of these parameters; otherwise the policy rule will
return an error.
You can change the total number of excluded subtrees by changing the value in
this field; there’s no restriction on the total number of excluded subtrees you can
include in the extension. Each set of configuration parameters is distinguished by
<n>
, which is an integer derived from the value you assign in this field. For
example, if you set the
numExcludedSubtrees
parameter to 2,
<n>
would be
0
and
1
.
Summary of Contents for CERTIFICATE 7.1 ADMINISTRATOR
Page 1: ...Administrator s Guide Red Hat Certificate System Version7 1 September 2005 ...
Page 22: ...22 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 128: ...Cloning a CA 128 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 368: ...ACL Reference 368 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 460: ...Constraints Reference 460 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 592: ...CRL Extension Reference 592 Red Hat Certificate System Administrator s Guide September 2005 ...
