Creating Custom Next-Gen CA Issuance Policies
Create a custom issuance policy to set your own limits on the certificates that a Next-Gen CA certificate authority (CA) issues. You can clone the global default, a platform template, or another custom policy.
A custom policy belongs to one
configuration tier and only works with CAs in that tier. You can't change the tier after you create the policy.
Note: To promote a Test tier policy to Production, clone it and select Production. The clone is a separate policy, so later changes to one don't affect the other.
Prerequisites
To complete these steps, you must have:
To Create a Custom Issuance Policy
Sign in to Next-Gen Trust Security.
Click Configuration > Certificate Policies > Issuance Policies.
On the Next-Gen CA Policies tab, do one of the following:
Under General Information, enter the following.
| Field | Description |
|---|
| Configuration Tier | Select Test or Production. A tier is available only when your tenant has a PKI in it. You can't change the tier later. |
| Clone from the existing policy | The policy that NGTS copies settings from. If you clicked Add New Policy, the field shows the global default. You can choose another policy, but NGTS then replaces any changes you have made in the form. If you clicked Clone, the field shows the policy you cloned, and you can't change it. |
| Policy Name | A name for the policy that's unique in the tier, up to 255 characters. |
| Description | (Optional) A description of the policy. |
Review the
settings under
Key Constraints and Validity,
Usage,
Distinguished Name, and
Subject Alternative Names (SAN), and change any that you want to differ from the source policy.
Note: Settings that the source policy doesn't configure start as Optional. Policies must require or allow at least one extended key usage.
Click Next and under Summary, review the policy. To make a change, click Back.
Click Submit.
The policy appears on the Next-Gen CA Policies tab as a Custom policy.
Next Steps
To apply the policy, select it in a
request policy that uses a CA in the same tier.
