API Validation Policy 

Your validation policy provides detailed guidance and rules for the fields required to request certificates using the POST /certificates endpoint. This includes all subjectDN fields, validity period, key usages/extended key usages, and public key information. The next two sections describe the properties of validation policies.   

String Fields  

A string field is text that is added to a certificate. This is the most common field type and is   
used for subjectDN fields. The validation policy for string fields consists of two components: Presence and Form. 

Presence specifies where the information comes from. There are four possible values:  

• REQUIRED: Required fields MUST be supplied by the user, and those validated values will then be placed in the certificate.  
• OPTIONAL: Optional fields MAY be supplied by the user, and those validated values (when provided) will be placed in the certificate. If no value is provided, then the field will not be present in the issued certificate.  
• FORBIDDEN: Forbidden fields will not be included in the issued certificate. If a value is supplied in the certificate request, the request will be rejected.  
• STATIC: Static fields are populated by the user’s identity and automatically included in the issued certificate. If there is no value in the corresponding identity field, the certificate request will be rejected.

Format determines the type of value a field can have. There are three possible values:  

• Empty: Used when a field has presence FORBIDDEN  
• Regex: Used when a field has presence REQUIRED or OPTIONAL. A regex expression is a special text string that defines what characters are allowed in the field. An example is “^[A-Za-z0-9]+$,” which allows a field to have all alphabet characters, upper and lower case, and all numbers.  
• Text: Used when a field has presence STATIC. It is a value that is placed in the certificate request on the back end, usually through your validated Atlas identity. For example, format = “GB” in the subjectDN country field means that the issued certificate will always have “GB” set in the subjectDN country field, and this value cannot be modified by the user.

For example:  

"common_name": {
"presence": "REQUIRED",
"format": "^[A-Za-z][A-Za-z -]+$"
},
"organization": {
"presence": "STATIC",
"format": "GMO GlobalSign"
},
"country": {
"presence": "STATIC",
"format": "GB"
},
"state": {
"presence": "OPTIONAL",
"format": "^[A-Za-z][A-Za-z \\-]+$"
}

List Fields  

A list field is a list of strings, such as DNS names in a SAN extension. The list fields in validation policies consist of four components: Static, List, Mincount, and Maxcount.  

• Static:   
  •  If Static is set to false, the list is provided by the user through the certificate request.  
  • If Static is set to true, the list is fixed on the back end and automatically included in the issued certificate.  
• List: Based on the Static value, the List field will either contain a list of regexes/suffixes to validate the list sent by the customer, or a fixed list supplied by the back end.  
  • Regex: See the String Fields section above  
  • Suffix: The ending portion of a text string that must match your validated Atlas identity. For example, suffix “.globalsign.com” will allow “test.globalsign.com” but not “test.example.com”  
• Mincount: The minimum number of elements a list can have. For example, min = 1  means you are required to send a list with at least 1 element.
• Maxcount: The maximum number of elements a list can have. For example, max = 0 means you are not allowed to send a list while max = 5 means the list can have up to 5 elements.  

For example:  

"organizational_unit": {
"static": false,
"list": [
"^[A-Za-z][A-Za-z \\-]+$"
],
"mincount": 1,
"maxcount": 3
},
"extra_attributes": {
"1.3.6.1.5.5.7.48.1.5": {
"static": true,
"value_type": "PRINTABLESTRING",
"value_format": "static attribute",
"mincount": 1,
"maxcount": 1
}