|
Data items
The data items that
PathValidationOptionSpec
variables
contain.
anyPolicyInhibit
A
boolean
value
that indicates whether any policy can be processed if it is included
in the certificate. A value of
true
indicates that
any policy is not processed. The default value of
false
indicates
that any policy can be processed.
checkAllPaths
A
boolean
value
that specifies whether all paths to a trust anchor are checked for
validity. A value of
true
indicates that all paths
are checked. The default value of
false
indicates
not to validate the paths.
checkCABasicConstraints
A
boolean
value
that indicates whether the CA Basic Constraints certificate extension
must be present for CA certificates. For example, earlier versions
of some certificates are not compliant with RFC 3280 and do not
contain the basic constraints extension. The default value of
true
indicates
that CA Basic Constraints certificate extension is required, and
false
indicates
that the certificate extension is not required.
explicitPolicy
A
boolean
value
that indicates whether the path must be valid for at least one of
the certificate policies in the user's initial policy set. A value
of
true
indicates that there must be at least one
valid certificate policy path. The default value of
false
indicates
that no valid path is required.
followURIsInAIA
A
boolean
value
that indicates whether to follow any URIs specified in the certificate's
Authority Information Access (AIA) extension for path discovery.
The AIA extension specifies where to find up-to-date certificates.
A value of
true
indicates to follow URIs in the
certificate’s AIA extension. The default value of
false
indicates
not to follow URIs.
LDAPServer
A
string
value
that specifies the Lightweight Directory Access Protocol (LDAP) server
that is used to retrieve certificate revocation list (CRL) information.
The LDAP server searches for CRL information by using Distinguished
Name (DN) according to the rules specified in
RFC
3280
, section 4.2.1.14.
policyMappingInhibit
A
boolean
value
that indicates whether policy mapping is allowed in the certification
path. A value of
true
means that policy mapping
is not allowed. The default value of
false
means
that policy mapping is allowed.
requireValidSigForChaining
A
boolean
value
that indicates whether chains can be built with invalid signatures.
A value of
true
indicates that the chain is not
built if an invalid signature is encountered. The default value
of
false
indicates that invalid signatures are ignored
when building the chain.
Datatype specific settings
Properties for specifying the path validation options.
Require Explicit Policy
Select this option to specify that the
path must be valid for at least one of the certificate policies
in the user initial policy set. When this option is deselected,
the path validity is not required. By default, the option is deselected.
Inhibit ANY Policy
Select this option to specify that a policy
object identifier (OID) must be processed if it is included in a
certificate. When deselected, any policy can be selected. By default,
the option is deselected.
Check All Paths
Select this option to require all paths to a
trust anchor must be validated. When this option is deselected,
all paths to a trust anchor are not validated. By default, the option
is deselected.
Inhibit Policy Mapping
Determines whether policy mapping is allowed
in the certification path. If selected, policy mapping is allowed.
This option is not selected by default.
LDAP Server
Sets the URL or path of the Lightweight Directory
Access Protocol (LDAP) server used to retrieve information about
the certificate revocation list (CRL). The LDAP server searches
for CRL information using the distinguished name (DN) according
to the rules specified in
RFC
3280
, section 4.2.1.14. For example, you can type
www.ldap.com
for
the URL or
ldap://ssl.ldap.com:200
for the path
and port.
Follow URIs in Certificate AIA
Select this option to specify
to follow any URIs specified in the certificate’s Authority Information
Access (AIA) extension for path discovery. The AIA extension specifies
where to find up-to-date certificates. When this option is deselected,
no URIs are processed in the AIA extension from the certificate.
By default, the option is deselected.
Basic Constraints Extension required in CA Certificates
Select
this option to specify that the certificate authority (CA) Basic
Constraints certificate extension must be present for CA certificates.
Some early German certified root certificates (7 and earlier) are
not compliant to
RFC 3280
and do not contain the basic
constraint extension. If it is known that a user's EE certificate chains
up to such a German root, deselect this option. When this option
is deselected, the presence of the CA Basic Constraints certificate
in CA certificates is not required. By default, the value is selected.
Require Valid Certificate Signature During chain building
Select
this option to require that all Digital Signature Algorithm (DSA)
signatures on certificates be valid before a chain is built. For
example, in a chain CA > ICA > EE where the signature for
EE is not valid, the chain building stops at ICA. EEs are not included
in the chain. When this option is deselected, the entire chain is
built regardless of whether an invalid DSA signature is encountered.
By default, the option is deselected.
|
|
|
