Application Settings

The number of certificates at a time that are saved to the database when using the Edit All feature to edit certificate metadata. This setting can be adjusted if there are responsiveness issues when editing large numbers of certificates at once. The default value is 3000.

The number of minutes to offset when determining whether a certificate requested outside of Keyfactor Command should be included in an incremental synchronization. Adjusting this value can be helpful in situations of extreme clock skew or when the EJBCA Validity Offset setting is enabled.

The number of minutes before data for the Collections dashboard panel is refreshed. The default value is 20.

If set to True, causes an Enable Debug tickbox to appear on the parameters page for reports you access and run from the Navigator (reports on the Reports menu dropdown of the Management Portal). This option does not appear for reports generated from the Report Manager grid. When enabled it allows the reports to output debug level information when they run. If set to False, does not display the Enable Debug option. The default value is False.

Tip:  When the debugging option is enabled, a small debug icon () appears at the bottom of reports that generate successfully. You can click on it to see information about the report.

The path to the location on the Keyfactor Command server where the event handler .dll files are stored. By default this is:

As of version 9.0 of Keyfactor Command, PowerShell scripts for alert handlers need to be in the extension path or a subdirectory of it specified by this application setting. For example, create a directory called Scripts under the ExtensionLibrary directory and then reference your PowerShell script as Scripts\MyPowerShell.ps1. Any scripts referenced by PowerShell handlers that are outside this path will fail to run.

If set to True, causes the Revoke All button to appear at the top of certificate search and collection grids to allow users with appropriate permissions to revoke all certificates shown in the grid or included in the certificate collection. If set to False, hides the Revoke All button and disables the POST /Certificates/RevokeAll API endpoint. The default value is False for new installations of Keyfactor Command beginning with release 10.4.

The maximum number of expiration alert emails that will be sent when an expiration alert test is run from within the Management Portal. If the number set here is exceeded during a test, emails will not be sent, but a portion of the alerts will be visible on the expiration alerts test page (see Testing Expiration Alerts). The default value is 100.

The maximum number of pending alert emails that will be sent when a pending alert test is run from within the Management Portal. If the number set here is exceeded during a test, emails will not be sent, but a portion of the alerts will be visible on the pending alerts test page (see Testing Pending Request Alerts). The default value is 100.

The host name of the centralized logging server to receive the Keyfactor Command audit log entries.

If set to True, enables sending audit log details to a centralized logging server. See Audit Log Output to a Centralized Logging Solution.

The format of the subject field that will be created for the certificates requested through the Keyfactor Command Management Portal if the template used for enrollment is set to supply in request. For example:

The data in the subject format takes precedence over any data entered during PFX enrollment or supplied by enrollment defaults (see Enrollment Defaults Tab). For example, with the above subject format, the organization for certificates generated through PFX enrollment will always be Key Example, Inc. regardless of what is shown on the PFX enrollment page during enrollment.

This setting applies to CSRs generated using the CSR generation method in the Keyfactor Command Management Portal, CSR and PFX enrollments done in the Keyfactor Command Management Portal, and to CSR and PFX enrollments done using the Classic API.

Data from the default subject does not display on the CSR or PFX enrollment page. To define defaults that will display in the PFX enrollment form (and can be modified by users), use enrollment defaults (see Enrollment Defaults Tab).

If set to True, enables the section of the CSR enrollment page that allows for entry of custom subject alternative names (SANs). The default value is False.

If set to True, enables the section of the PFX enrollment page that allows for entry of a custom friendly name for the certificate. The default value is False.

If set to True, enables administrative PFX enrollment. The default value is True.

If set to True, the one-time password generated to encrypt the PFX file acquired through the Keyfactor Command Management Portal (if the user’s Active Directory password is not used) will contain just numbers and letters. If set to False, the password will contain numbers, letters and special characters. This setting is ignored if PFX Use Active Directory Password is set to True. The default value is True.

The number of characters in the one-time password generated to encrypt the PFX file acquired through the Keyfactor Command Management Portal. The minimum number is 8. The default value is 12.

The certificate authority used for reenrollment requests made from the Certificate Stores page. See Certificate Store Reenrollment.

Whether the configure call returns the property Entropy containing 2048 bytes. This property is optional via this app setting. The default is false on upgrades and new installs.

The maximum number of seconds an auto-registration handler is allowed to attempt to run before being halted and declared to be deferred. The default value is 90 for more recently installed systems. Keyfactor recommends using a value of at least 60 seconds.

The template used for reenrollment requests made from the Certificate Stores page. See Certificate Store Reenrollment. The template selected for this value must be available for enrollment against the CA listed in the Certificate Authority For Submitted CSRs setting.

If set to True, the orchestrator will connect to the F5 device using SSL even if it detects a problem with the certificate on the F5 device (e.g. it doesn’t trust the issuer of the certificate because the certificate is self-signed). This option applies only to the F5 methods based on the F5 SOAP API (see Certificate Stores). The F5 methods based on the F5 iControl REST API automatically ignore SSL warnings without the need to set this option. The default value is False.

The maximum number of results to display in an SSL monitoring results email message table of certificates that have expired or are expiring shortly. The default value is 500.

The number of days old an endpoint history record must be before it is available for deletion by the endpoint history cleanup process. Endpoint history records older than this will be retained if they are the last records for the given endpoint. Both the last discovery and last monitoring records will be retained regardless of age. The default value is 30.

The maximum rate at which API applications can make requests to the API. A larger value will mitigate risks from certain denial of service and brute-force/dictionary attacks, but will limit the performance of applications needing to make multiple API calls. This can be set to zero to disable throttling.

The regular expression against which the password entered when creating, rotating or downloading keys for both user SSH keys (My SSH Key) and service account SSH keys (Service Account Keys) will be validated. The default is a minimum of 12 characters configured as: