Chapter 12. CMCRequest (Creating CMC Requests)

The total number of PKCS #10 or CRMF requests. In some cases, the value of this parameter can be 0.

For example, numRequests=1.

The full path and filename of the PKCS #10 or CRMF request, which must be in base-64 encoded format. Multiple filenames are separated by white space. This parameter is a required if the value for numRequests is greater than 0.

For example, input=crmf1.

Required. The full path and filename for the generated binary CMC request.

For example, output=cmc.

Required. The nickname of the agent certificate used to sign the full CMC request.

For example, nickname=CS Agent-102504a's 102504a ID.

Required. The full path to the directory where the cert8.db, key3.db, and secmod.db databases are located. This is usually the agent's personal directory, such as their browser certificate database in the home directory.

For example, ~jsmith/.mozilla/firefox.

Required. The token password for cert8.db, which stores the agent certificate.

For example, password=secret.

The request format, either pkcs10 or crmf.

For example, format=crmf.

If set to true, then the request contains this control. If this parameter is not set, the value is assumed to be false.

For example, confirmCertAcceptance.enable=false.

The serial number for the confirmCertAcceptance control.

For example, confirmCertAcceptance.serial=3.

The issuer name for the confirmCertAcceptance control.

For example, confirmCertAcceptance.issuer=cn=Certificate Manager,ou=102504a,o=102504a,c=us.

If set to true, then the request contains this attribute. If this parameter is not set, the value is assumed to be false.

For example, getCert.enable=false.

The serial number for the getCert control.

For example, getCert.serial=300.

The issuer name for the getCert control.

For example, getCert.issuer=cn=Certificate Manager,ou=102504a,o=102504a,c=us.

If set to true, then the request contains this control. If this parameter is not set, the value is assumed to be false.

For example, dataReturn.enable=false.

The data contained in the dataReturn control.

For example, dataReturn.data=test.

If set to true, then the request contains this control. If this parameter is not set, the value is assumed to be false.

For example, transactionMgt.enable=true.

The transaction identifier for transactionMgt control. VeriSign recommends that the transaction ID should be an MD5 hash of the public key.

If set to true, then the request contains this control. If this parameter is not set, the value is assumed to be false.

For example, senderNonce.enable=false.

The ID for the senderNonce control.

For example, senderNonce.id=testing.

If set to true, then the request contains this control. If this parameter is not set, the value is assumed to be false.

For example, revRequest.enable=true.

The nickname for the certificate being revoked.

For example, revRequest.nickname=newuser's 102504a ID.

The issuer name for the certificate being revoked.

For example, revRequest.issuer=cn=Certificate Manager,ou=102504a,o=102504a,c=us.

The serial number for the certificate being revoked.

For example, revRequest.serial=75.

The reason for revoking this certificate. The allowed values are unspecified, keyCompromise, caCompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, and removeFromCRL.

For example, revRequest.reason=unspecified.

The shared secret for the revocation request.

For example, revRequest.sharedSecret=testing.

A text comment for the revocation request.

For example, revRequest.comment=readable comment.

If set to true, the current time is the invalidity date for the revoked certificate. If set to false, no invalidity date is present.

For example, revRequest.invalidityDatePresent=false.

If set to true, then the request contains this control. If this parameter is not set, the value is assumed to be false.

For example, identityProof.enable=false.

The shared secret for identityProof control.

For example, identityProof.sharedSecret=testing.

If set to true, then the request contains this control. If this parameter is not set, the value is assumed to be false.

For example, popLinkWitness.enable=false.

If set to true, then the request contains this control. If this parameter is not set, the value is assumed to be false.

For example, LraPopWitness.enable=false.

The space-delimited list of body part IDs for the LraPopWtiness control.

For example, LraPopWitness.bodyPartIDs=1 .