Regular Expressions

Several fields on the CSRClosed enrollmentClosed, CSR generation, and PFXClosed enrollment pages support using regular expressions to validate that the data entered in the fields meets certain criteria. Both certificate subject fields and metadataClosed string fields can be configured with regular expressions. The certificate subject fields that support regular expressions are shown in Table 17: Supported Regular Expressions for Enrollment with Examples.

Regular expressions for enrollment can be defined at a global level to apply to all enrollments and at a templateClosed level to apply only to enrollments done with that template. Template-level definitions take precedence over global definitions.

Both the regular expressions that do the validation and the error message that the user receives when the validation fails are user definable. For example, for the common nameClosed field you could define a regular expression similar to the following:

^[a-zA-Z0-9'_\.\-]*\.keyexample\.com$

This regular expression specifies that the data entered in the field must consist of some number of characters in the first portion of the field made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly .keyexample.com. Using this regular expression would prevent users from requesting certificates with common names such as myserver.contoso.com, forcing them to request certificates for domain names that are valid for your organization. Your error message to the user in this case might be something like:

Common names must end with keyexample.com.

The error message to the user appears immediately once the user leaves the field being validated after entering data that doesn’t meet the regular expression requirements.

Table 17: Supported Regular Expressions for Enrollment with Examples

Subject Part Example
CN (Common Name)

This regular expression specifies that the data entered in the field must consist of some number of characters in the first portion of the field made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly .keyexample.com:

Copy 
^[a-zA-Z0-9'_\.\-]*\.keyexample\.com$

The default value for the Common Name regular expression is:

Copy 
.+

This requires entry of at least one character in the Common Name field in the enrollment pages.
O (Organization)

This regular expression requires that the organization name entered in the field be one of “Key Example Inc”, “Key Example” or “Key Example Inc.”:

Copy 
^(?:Key Example Inc|Key Example|Key Example, Inc\.)$

The period in the final company name (Key Example, Inc.) needs to be escaped in the regular expression with a slash ("\") but the comma does not.
OU (Organization Unit)

This regular expression requires that the organizational unit entered in the field be one of these four departments:

Copy 
^(?:IT|HR|Accounting|E-Commerce)$
L (City/ Locality)

This regular expression requires that the city entered in the field be one of these five cities:

Copy 
^(?:Boston|Chicago|New York|London|Dallas)$
ST (State/ Province)

This regular expression requires that the state entered in the field be one of these eight states:

Copy 
^(?:Massachusetts|Illinois|New York|Ontario|Texas)$
C (Country)

This regular expression requires that the country entered in the field be either US or CA:

Copy 
^(?:US|CA)$
E (Email)

This regular expression specifies that the data entered in the field must consist of some number of characters prior to the “@” made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly “@keyexample.com”:

Copy 
^[a-zA-Z0-9'_\.\-]*@keyexample\.com$
DNS (Subject Alternative Name: DNS Name)

This regular expression specifies that the data entered in the field must consist of some number of characters in the first portion of the field made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly either “.keyexample1.com” or “.keyexample2.com”:

Copy 
^[a-zA-Z0-9'_\.\-]*\.(?:keyexample1\.com|keyexample2\.com)$
IPv4 (Subject Alternative Name: IPv4 Address)

This regular expression specifies that the data entered in the field must be exactly “130.101.” followed by anywhere between 1 and 3 numbers followed by exactly “.” followed by anywhere between 1 and 3 numbers:

Copy 
^130\.101\.(?:[0-9]{1,3})\.(?:[0-9]{1,3})$

This regular expression specifies only that the IPv4 address is made up of 4 sets of between 1 and 3 numbers separated by periods:

Copy 
^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$
IPv6 (Subject Alternative Name: IPv6 Address)

This regular expression specifies that the data entered in the field must be made up of eight sets of between one and four numbers and/or uppercase letters separated by colons:

Copy 
^(?:[A-F0-9]{1,4}:){7}[A-F0-9]{1,4}$
MAIL (Subject Alternative Name: Email)

This regular expression specifies that the data entered in the field must consist of some number of characters prior to the “@” made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly “@keyexample.com”:

Copy 
^[a-zA-Z0-9'_\.\-]*@keyexample\.com$
UPN (Subject Alternative Name: User Principal Name)

This regular expression specifies that the data entered in the field must consist of some number of characters prior to the “@” made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly “@keyexample.com”:

Copy 
^[a-zA-Z0-9'_\.\-]*@keyexample\.com$

Figure 267: PFX Enrollment Regular Expression Validation Error

For more information about configuring regular expressions on metadata fields, see Certificate Metadata.