Security Policy

SecurityPolicy defines security attributes and behaivour applied to the profileName or KeyStore.

This policy is applied during the profile initialization, but sometimes it's also used during the installation of the certificate, so it must be informed on several methods of the certificate provider.

There are specific policies for each kind of keystore, but not all the keystores have an specific policy. Sometimes is not possible to change some default valued defined by the keystore or profile by themselve.  In this kind of cases, a default policy, using an empty JSON file, must be used.

Following there are a list of specific policy and values that can be used:

Microsoft CryptoAPI security policy

{
	"exportable": true,
	"protectionLevel": 1,
	"description": "John Doe - Digicert",
	"friendlyName": "Sign and Authenticate services",
	"title": "Digital Certificate"
}

Password security policy

Used by PFX keystores

{
	"passComplexity" : 2,
	"passMinLength" : 5 
}

Device security policy

Used by some kind of devices

{
	"installDummy" : false,
	"generateOnBoard" : true 
}

PKCS11 security policy

Used by PKCS11 keystores

{
	"passComplexity" : 2,
	"passMinLength" : 5,
	"installDummy" : false,
	"generateOnBoard" : true 
}

It combines the features of Password and Device security policies. This policy is used when the device can be initialized during the generation of keypair, and a new password must be entered to protect the key.

CSK security policy

Used on Alison KeyStore profiles.

{
	"id": "polIdv-A",
	"passComplexity": 3,
	"passMinLength": 8,
	"passExpiration": 365,
	"passLockCount": 10, 
	"lockTimeout": 15,
	"idleTimeout": 10, 
	"certExport": 15
}