Security Policy

SecurityPolicy defines attributes of security applied to the profileName or KeyStore.

This policy is applied during the initialization of the profile, but sometimes it's also used during the installation of the certificate, so it must be informed on several methods of the certificate provider.

There are specific policies for each kind of Keystore, like:

Microsoft CryptoAPI security policy

{
	"exportable": true,
	"protectionLevel": 1,
	"description": "John Doe - Digicert",
	"friendlyName": "Sign and Authenticate services",
	"title": "Digital Certificate"
}

Password security policy

Used by PFX keystores

{
	"passComplexity" : 2,
	"passMinLength" : 5 
}

Device security policy

Used by some kind of devices

{
	"installDummy" : false,
	"generateOnBoard" : true 
}

PKCS11 security policy

Used by PKCS11 keystores

{
	"passComplexity" : 2,
	"passMinLength" : 5,
	"installDummy" : false,
	"generateOnBoard" : true 
}

It combines the features of Password and Device security policies. This policy is used when the device can be initialized during the generation of keypair, and a new password must be entered to protect the key.

CSK security policy

Used on Alison KeyStore profiles.

{
	"id": "polIdv-A",
	"passComplexity": 3,
	"passMinLength": 8,
	"passExpiration": 365,
	"passLockCount": 10, 
	"lockTimeout": 15,
	"idleTimeout": 10, 
	"certExport": 15
}