Setting policy on a folder

You can configure policy settings for all certificates in the same folder. The configuration is done on the folder.

IMPORTANT  You must have the View and Manage Policy permissions in order to see the Folders menu item.

To configure certificate policy on a folder

  1. From the TLS Protect menu bar, click Configuration > Folders.

  2. In the list of folders, click the folder that you want to configure.
  3. In the sidebar, click Certificate Policy.

    Certificate Policy Settings

    Field

    Description

    General Settings

    Contact

    User or group Identities assigned to this object.Default system notifications are sent to the contact identities.

    Default contact = master administrator

    Approver

    User or group Identities assigned to approve workflows (certificate approval or injection command) for the current Certificate object. For more information on defining Workflow objects, see Workflow object settings.

    Default approver = master administrator

    Management Type

    Select either Unassigned, Monitoring, Enrollment, or Provisioning. If you can't make a change, it's because the policy is locked at a higher level.

    Certificate Management types include the following:

    • Monitoring: Trust Protection Platform monitors existing certificates and provides current information on the certificate status and lifecycle. When the certificate nears the end of its lifecycle, Trust Protection Platform notifies the administrator. It does not, however, renew the certificate. The administrator must manually create the CSR, send it to the Certificate Authority (CA), then retrieve and install the renewed certificate.
    • Enrollment: Trust Protection Platform can automatically generate and submit CSRs to Certificate Authorities using the parameters defined in designated CA Template objects. If preferred, the administrator can manually generate the CSR, then upload it to Trust Protection Platform to complete the enrollment process with the appropriate CA. After the CA signs the certificate, Trust Protection Platform retrieves the certificate and securely stores it in the central database. The administrator must then download the certificate from Trust Protection Platform and install it on the target systems.
    • Provisioning: Trust Protection Platform manages the entire certificate lifecycle—it automatically requests, installs, and monitors your system certificates.
    • Unassigned: Unlicensed Trust Protection Platform certificates and keys that do not allow network validation, expiration monitoring, enrollment, provisioning, or onboard validation. However, they are included in selected reports and on the dashboard.

    Subject DN

    Organizational Unit

    Department or division within the organization that is responsible for maintaining the certificate.

    Organization

    Name that uniquely identifies the organization in the certificate.

    City / Locality

    The city or locality of the organization in the certificate.

    State / Province

    The state or province of the organization in the certificate.

    Country

    The country of the organization in the certificate.

    Allow Domain Component

    Check to allow domain component usage for certificates in this folder. This could allow you, for example, to use client authentication certificates to restrict access of the certificate to the sub-domain specified on the certificate using the domain component attribute.

    This setting should only be used if the application server you are authenticating to is configured to support verification of domain components. You can configure a schedule to run these rules on a regular basis.

    NOTE  This is not a commonly used feature.

    For more information about domain components, see About Domain Components.

    Enrollment Settings

    Renew automatically

    Sets an auto-renewal of certificates in this folder based on the specified number of days before expiration.

    CA Template

    CA Template object that Venafi TLS Protect references to generate the CSR and submit it to the CA.

    Key Algorithm

    The algorithm to be used for keys assigned to this folder.

    Key size (bits)

    Certificate’s key strength.

    If the key strength value conflicts with what the application can handle/requires, the application ignores the policy and sets the value accordingly. For example, if you set this value to 2048-bit encryption, but the target application cannot handle 2048-bit certificates, Trust Protection Platform generates the certificate CSR using 1024-bit encryption.

    Reuse Private Key (Service Generated CSR)

    Reuses the original private key when renewing the certificate.

    Allows Users to Import Duplicate Certificates and Reuse Private Keys

    Controls the reuse of certificates and private keys. When enabled, this permits you to import a certificate even if another certificate with the same private key already exists in the system. It would also allow you to renew a certificate without uploading / re-generating a new private key.

    When disabled, if you are renewing a certificate with a user-provided CSR, you cannot reuse a CSR that is tied to a private key that has ever been uploaded to Trust Protection Platform. Also, when importing a certificate manually, through WebSDK and Web UI, you won't be able to upload a certificate that is already in the inventory.

    We recommend you leave this option disabled (unchecked).

    CSR Provided By

    Determines how CSRs (Certificate Signing Request) are generated.

    • Service Generated CSR:Trust Protection Platform automatically generates the CSR.
    • User Provided CSR: CSR is manually generated by the administrator, then uploaded to Trust Protection Platform.

    Trust Protection Platform always generates CSRs in compliance with the Certificate object’s current parent policy. If the CSR is user submitted, Trust Protection Platform does not accept the CSR unless it is “in policy.”

    Validation Settings

    Validate SSL/TLS connections for this certificate?

    Select Yes or No. Yes will enable Trust Protection Platform to turn on daily TLS validation of this certificate.

    Port

    The network port that Trust Protection Platform will use to connect to the target device hosting the certificate when making the TLS connection.

    Use certificate's Common Name

    Validation scans include network addresses resolved from the common name of the certificate.

    Use certificate's DNS Subject Alternative Names

    Validation scans include network addresses resolved from the DNS Subject Alternative Names (SANs) of the certificate, if any.

    Validate the chain returned by the hosting server

    The chain returned by the hosting server is compared to the chain that Trust Protection Platform builds using its internal algorithm to ensure a match. By default, chain validation is enabled and affects the SSL/TLS validation result.

    Advanced Settings

    Managed By

    Choose Aperture if the policy is managed by that application. If not, leave this field blank.

    Certificate Origin

    The friendly name of the system requesting the certificate. Used for reporting purposes only. (Requires Client Protect product.)

    CSR Signature Algorithm

    Choose either SHA-1 or SHA-256.

    To learn more about signing algorithms, see About signing algorithms.

    Generate Key/CSR Remotely

    Option to enable the remote generation of the key or CSR on the HSM (requires Venafi Advanced Key Protect).

    When one or more of the following items are true, Remote Generation is not supported and, therefore, this setting is ignored:

    • You're using a driver that does not support remote generation.

      To learn which drivers support remote generation, see Supported integrations: devices, applications, services and features supported by Venafi.

    • You're using a self-signed CA template to enroll a certificate; self-signed CA templates do not work with remote generation.

      This is because Trust Protection Platform requires that the private key be stored centrally so that it can be used to sign the self-signed certificate.

    • Your certificate is associated with more than one application; to work correctly, the certificate must be associated with one application.
    • You have not set the certificate's management type setting to Provisioning.

    Key Generation and Encryption Key

    Encryption key used to generate the certificate’s private key.

    Trust Protection Platform provides either an AES-256 software encryption key to generate private keys, or you can configure AES encryption keys stored on supported HSM devices to generate certificate private keys. For information on using your own encryption keys, see Working with system credentials

    Allowed Domains

    Enter the suffix of allowed domains. Example: acme.com or sales.acme.com

    If you leave this field blank, ALL domains will be allowed.

    Allow wildcard Common and Subject Alternative Name

    Select to allow wildcards in the certificate's Common or Subject Alternative Names.

    Allow duplicate Common and Subject Alternate Names

    Select to allow duplicate Common or Subject Alternate Names.

    To learn more, see About Subject Alternative Names (SANs).

    Disable "Certificate Download Password" Complexity

    The setting allows an administrator to revert back to the previous functionality where a password is required but there are no length or complexity requirements.

    If this check box is not selected, the password requirements are:

    • Password is at least 12 characters.

    • Comprised of at least three of the following:

      • Uppercase alphabetic letters

      • Lowercase alphabetic letters

      • Numeric characters

      • Special characters

    Private Key PBE (password-based encryption) Algorithm

    This setting applies only to PKCS#8-formatted private keys downloaded from Aperture, WebAdmin, or WebSDK.

    Choose the type of algorithm appropriate for your environment.

    To learn more about PBE algorithms, see Using PBE (password-based encryption) algorithms to secure private keys.

    NOTE  The algorithms used to derive the protection key and encrypt the private key are not supported by all applications.  Generally, the more secure the protection key and algorithm, the fewer applications will support it.

    SAN Types Allowed

    This allows you to control the SAN types that are allowed or not allowed for certificate enrollment.

    The available SAN types that can be controlled by policy are:

    • DNS
    • IP
    • UPN
    • Email
    • URI

    If your system was installed with version 18.2 or older of Trust Protection Platform, all SAN types are allowed by default.

    If your first installation of Venafi Platform was version 18.3 or later, only DNS SAN types are allowed by default.

    Use this control to determine which SAN types you want to permit at this and lower folder levels.

Related Topics Link IconRelated Topics