User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
128
 /O=Fortress* - matches any string beginning with
“
Fortress”.
 /O=*Tech* - matches any string containing “Tech” in the
middle of the string.
As shown in the examples above,
Pattern must be specified
using a forward slash (
/) to indicate each RDN subpattern:
/RDNsubpattern1/RDNsubpattern2/RDNsubpattern3
NOTE: In order to
match the ACE, an
X.509 certificate must
match all of the exten-
sion values specified in
KeyUsage and Ext-
KeyUsage.
Each RDN contained in a certificate’s DN is compared, in order,
to the RDN subpatterns specified by the ACE
Pattern
(Distinguished Name). RDN matching is case sensitive. The
DN match will succeed if every RDN subpattern matches, or
fail with the first non-matching subpattern.
KeyUsage specifies the optional Key Usage extension against
which X.509 certificates will be matched.
KeyUsage identifies
the purpose(s) for which the certificate’s public key can be
used, as defined by the certification authority (CA) that issued
the certificate:
 digitalsignature - matches certificates whose public keys
can be used to generate digital signatures.
 keyagreement - matches certificates whose public keys can
be used to establish key agreement.
You can enter one or both of these criteria, separated by a
comma.
ExtKeyUsage specifies the optional Extended Key Usage
extension against which X.509 certificates will be matched.
ExtKeyUsage defines additional restrictions placed by the
issuing CA on how the certificate's public key can be used:
 tlsserver - matches certificates whose public keys can be
used by TLS (Transport Layer Security) servers.
 tlsclient - matches certificates whose public keys can be
used by TLS clients.
You can enter one or both of these criteria, separated by a
comma.
If multiple criteria are specified for an ACE, it will apply only to
X.509 certificates that match them all.
An ACE configured on the Mesh Point has no effect on Mesh
Point operation until it has been included in an applicable
function’s ACL, as outlined at the beginning of this section.
View existing ACEs with
show:
# show ace
Name: excludeO
Pattern: /O=*