Keyfactor CA Policy Module

The Keyfactor CA A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. Policy Module includes four certificate authority A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. policy handlers that can be used to alter or restrict the functionality of a Microsoft certificate authority. The policy handlers are installed on the Microsoft CA and enabled through the Microsoft CA properties page. The available policy handlers are:

• RFC 2818 Policy Handler

  Applies template A certificate template defines the policies and rules that a CA uses when a request for a certificate is received.-level SAN The subject alternative name (SAN) is an extension to the X.509 specification that allows you to specify additional values when enrolling for a digital certificate. A variety of SAN formats are supported, with DNS name being the most common. handling by automatically adding a DNS The Domain Name System is a service that translates names into IP addresses. SAN that matches the certificate CN A common name (CN) is the component of a distinguished name (DN) that represents the primary name of the object. The value varies depending on the type of object. For a user object, this would be the user's name (for example CN=John Smith). For SSL certificates, the CN is typically the fully qualified domain name (FQDN) of the host where the SSL certificate will reside (for example servername.keyexample.com or www.keyexample.com). for requests using selected Microsoft certificate templates.

• SAN Attribute Policy Handler

  Allows CSR A CSR or certificate signing request is a block of encoded text that is submitted to a CA when enrolling for a certificate. When you generate a CSR within Keyfactor Command, the matching private key for it is stored in Keyfactor Command in encrypted format and will be married with the certificate once returned from the CA. enrollment Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA). requests to submit SANs outside the CSR for inclusion in the issued certificate. The submitted SANs replace any SANs included in the CSR. This behavior is similar to the Microsoft CA EDITF_ATTRIBUTESUBJECTALTNAME2 flag, but the SAN Attribute Policy Handler provides template-level control without activating the flag for the entire CA.

• Whitelist Policy Handler

  Enforces template-level enrollment restrictions by allowing certificate requests for selected Microsoft certificate templates only from specified computers. Use this handler to limit where requests for protected templates can originate, such as requiring enrollment through the Keyfactor Command server.