Regular Expressions
Several fields on the CSR
A CSR or certificate signing request is a block of encoded text that is submitted to a CA when enrolling for a certificate. When you generate a CSR within Keyfactor Command, the matching private key for it is stored in Keyfactor Command in encrypted format and will be married with the certificate once returned from the CA. enrollment Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA)., CSR generation, and PFX A PFX file (personal information exchange format), also known as a PKCS#12 archive, is a single, password-protected certificate archive that contains both the public and matching private key and, optionally, the certificate chain. It is a common format for Windows servers. enrollment pages support using regular expressions to validate that the data entered in the fields meets certain criteria. Both certificate subject fields and metadata Metadata provides information about a piece of data. It is used to summarize basic information about data, which can make working with the data easier. In the context of Keyfactor Command, the certificate metadata feature allows you to create custom metadata fields that allow you to tag certificates with tracking information about certificates. string fields can be configured with regular expressions. The certificate subject fields that support regular expressions are shown in Table 17: Supported Regular Expressions for Enrollment with Examples.
Regular expressions for enrollment can be defined at a global level to apply to all enrollments and at a template A certificate template defines the policies and rules that a CA uses when a request for a certificate is received. level to apply only to enrollments done with that template. Template-level definitions take precedence over global definitions.
Both the regular expressions that do the validation and the error message that the user receives when the validation fails are user definable. For example, for the common name A common name (CN) is the component of a distinguished name (DN) that represents the primary name of the object. The value varies depending on the type of object. For a user object, this would be the user's name (e.g. CN=John Smith). For SSL certificates, the CN is typically the fully qualified domain name (FQDN) of the host where the SSL certificate will reside (e.g. servername.keyexample.com or www.keyexample.com). field you could define a regular expression similar to the following:
This regular expression specifies that the data entered in the field must consist of some number of characters in the first portion of the field made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly ".keyexample.com". Using this regular expression would prevent users from requesting certificates with common names such as myserver.contoso.com, forcing them to request certificates for domain names that are valid for your organization. Your error message to the user in this case might be something like:
The error message to the user appears immediately once the user leaves the field being validated after entering data that doesn’t meet the regular expression requirements.
Table 17: Supported Regular Expressions for Enrollment with Examples
| Subject Part | Example |
|---|---|
| CN A common name (CN) is the component of a distinguished name (DN) that represents the primary name of the object. The value varies depending on the type of object. For a user object, this would be the user's name (e.g. CN=John Smith). For SSL certificates, the CN is typically the fully qualified domain name (FQDN) of the host where the SSL certificate will reside (e.g. servername.keyexample.com or www.keyexample.com). (Common Name) |
This regular expression specifies that the data entered in the field must consist of some number of characters in the first portion of the field made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly ".keyexample.com": ^[a-zA-Z0-9'_\.\-]*\.keyexample\.com$
The default value for the Common Name regular expression is: .+
This requires entry of at least one character in the Common Name field in the enrollment pages. |
| O (Organization) |
This regular expression requires that the organization name entered in the field be one of "Key Example Inc", "Key Example" or "Key Example Inc.": ^(?:Key Example Inc|Key Example|Key Example, Inc\.)$
The period in the final company name (Key Example, Inc.) needs to be escaped in the regular expression with a slash ("\") but the comma does not. |
| OU (Organization Unit) |
This regular expression requires that the organizational unit entered in the field be one of these four departments: ^(?:IT|HR|Accounting|E-Commerce)$
|
| L (City/Locality) |
This regular expression requires that the city entered in the field be one of these five cities: ^(?:Boston|Chicago|New York|London|Dallas)$
|
| ST (State/Province) |
This regular expression requires that the state entered in the field be one of these eight states: ^(?:Massachusetts|Illinois|New York|Ontario|Texas)$
|
| C (Country) |
This regular expression requires that the country entered in the field be either US or CA ^(?:US|CA)$
|
| E (Email) |
This regular expression specifies that the data entered in the field must consist of some number of characters prior to the "@" made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly "@keyexample.com": ^[a-zA-Z0-9'_\.\-]*@keyexample\.com$
|
| DNS The Domain Name System is a service that translates names into IP addresses. (Subject Alternative Name The subject alternative name (SAN) is an extension to the X.509 specification that allows you to specify additional values when enrolling for a digital certificate. A variety of SAN formats are supported, with DNS name being the most common.: DNS Name) |
This regular expression specifies that the data entered in the field must consist of some number of characters in the first portion of the field made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly either ".keyexample1.com" or ".keyexample2.com": ^[a-zA-Z0-9'_\.\-]*\.(?:keyexample1\.com|keyexample2\.com)$
|
| IPv4 (Subject Alternative Name: IPv4 Address) |
This regular expression specifies that the data entered in the field must be exactly "130.101." followed by anywhere between 1 and 3 numbers followed by exactly "." followed by anywhere between 1 and 3 numbers: ^130\.101\.(?:[0-9]{1,3})\.(?:[0-9]{1,3})$
This regular expression specifies only that the IPv4 address is made up of 4 sets of between 1 and 3 numbers separated by periods: ^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$
|
| IPv6 (Subject Alternative Name: IPv6 Address) |
This regular expression specifies that the data entered in the field must be made up of eight sets of between one and four numbers and/or uppercase letters separated by colons: ^(?:[A-F0-9]{1,4}:){7}[A-F0-9]{1,4}$
|
| MAIL (Subject Alternative Name: Email) |
This regular expression specifies that the data entered in the field must consist of some number of characters prior to the "@" made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly "@keyexample.com": ^[a-zA-Z0-9'_\.\-]*@keyexample\.com$
|
| UPN (Subject Alternative Name: User Principal Name) |
This regular expression specifies that the data entered in the field must consist of some number of characters prior to the "@" made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly "@keyexample.com": ^[a-zA-Z0-9'_\.\-]*@keyexample\.com$
|
Figure 223: PFX Enrollment Regular Expression Validation Error
FFor more information about configuring regular expressions on metadata fields, see Certificate Metadata.
