Regular Expressions

Several fields on the CSR A CSR or certificate signing request is a block of encoded text that is submitted to a CA when enrolling for a certificate. When you generate a CSR within Keyfactor Command, the matching private key for it is stored in Keyfactor Command in encrypted format and will be married with the certificate once returned from the CA. enrollment Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA)., CSR generation, and PFX A PFX file (personal information exchange format), also known as a PKCS#12 archive, is a single, password-protected certificate archive that contains both the public and matching private key and, optionally, the certificate chain. It is a common format for Windows servers. enrollment pages support using regular expressions to validate that the data entered in the fields meets certain criteria. Both certificate subject fields and metadata Metadata provides information about a piece of data. It is used to summarize basic information about data, which can make working with the data easier. In Keyfactor Command, the certificate metadata feature allows you to create custom metadata fields that allow you to tag certificates with tracking information about certificates. string fields can be configured with regular expressions. The certificate subject fields that support regular expressions are shown in Table 22: Supported Regular Expressions for Enrollment with Examples.

Regular expressions for enrollment can be defined at a system-wide level to apply to all enrollments and at a template A certificate template defines the policies and rules that a CA uses when a request for a certificate is received. level to apply only to enrollments done with that template. Template-level definitions take precedence over system-wide definitions.

Both the regular expressions that do the validation and the error message that the user receives when the validation fails are user definable. For example, for the common name A common name (CN) is the component of a distinguished name (DN) that represents the primary name of the object. The value varies depending on the type of object. For a user object, this would be the user's name (e.g. CN=John Smith). For SSL certificates, the CN is typically the fully qualified domain name (FQDN) of the host where the SSL certificate will reside (e.g. servername.keyexample.com or www.keyexample.com). field you could define a regular expression A regular expression--RegEx--is a pattern used to validate data by ensuring it meets specific criteria. Several fields on the CSR enrollment, CSR generation, and PFX enrollment pages support RegEx validation, including certificate subject and metadata fields. similar to the following:

This regular expression specifies that the data entered in the field must consist of 1 to 63 characters in the first portion of the field made up only of lowercase letters, uppercase letters, numbers, and/or hyphens followed by exactly .keyexample.com. It disallows hyphens as the starting character—^(?!-)—or ending character—^(?!-)—of each label and disallows duplication of hyphens—(?!.*--). It allows periods between labels. Using this regular expression would prevent users from requesting certificates with common names such as myserver.contoso.com, forcing them to request certificates for domain names that are valid for your organization. Your error message to the user in this case might be something like:

The error message to the user appears immediately once the user leaves the field being validated after entering data that doesn’t meet the regular expression requirements.

Table 22: Supported Regular Expressions for Enrollment with Examples

^(?!-)(?!.*--)[A-Za-z0-9-]{1,63}(?<!-)(\.[A-Za-z0-9-]{1,63})*\.keyexample\.com$

.+

^(?:Key Example Inc|Key Example|Key Example, Inc\.)$

^(?:IT|HR|Accounting|E-Commerce)$

^(?:Boston|Chicago|New York|London|Dallas)$

^(?:Massachusetts|Illinois|New York|Ontario|Texas)$

^(?:US|CA)$

^[A-Za-z0-9._%'+-]+@keyexample\.com$

^(?!-)(?!.*--)[A-Za-z0-9-]{1,63}(?<!-)(\.[A-Za-z0-9-]{1,63})*\.(keyexample\.com|keyexample2\.com)$

^130\.101\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$

^(?:[0-9]{1,2}|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:[0-9]{1,2}|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:[0-9]{1,2}|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:[0-9]{1,2}|1[0-9]{2}|2[0-4][0-9]|25[0-5])$

^([A-F0-9]{1,4}:){1,7}([A-F0-9]{1,4})?(\:\:([A-F0-9]{1,4}:){0,6}[A-F0-9]{1,4})?$

^[A-Za-z0-9._%'+-]+@keyexample\.com$

^[A-Za-z0-9'_ -]{1,64}@keyexample\.com$

For more information about configuring regular expressions on metadata fields, see Certificate Metadata.