This bit-mask defines the additional certificate-creation-related services that an issuing CA (CA) can offer. Such services include (but are not limited to) archiving the certificate and keypair, publishing the certificate to one or more certificate directory services, and sending automatic, out-of-band notifications of the need to renew a certificate. A CA may offer any subset of these services. Additional services can be defined over time.

typedef uint32 CSSM_CA_SERVICES;
/* bit masks for additional CA services at cert enroll */
#define CSSM_CA_KEY_ARCHIVE        0x0001 /* archive cert & keys */
#define CSSM_CA_CERT_PUBLISH       &tab;0x0002 /* cert in directory service */
#define CSSM_CA_CERT_NOTIFY_RENEW  &tab;0x0004 /* notify at renewal time */
#define CSSM_CA_CRL_DISTRIBUTE     0x0010 /* push CRL to everyone */