Configure certificate profiles and issuance policy
Certificate profiles determine what your organization is permitted to issue. For each profile:
Set the minimum key size and approved algorithms from the available FedRAMP options.
Set validity periods to the shortest duration that meets the business requirement.
Restrict subject and SAN fields to the values the use case requires.
Enable only the enrollment methods the use case requires.
Review profile changes through your organization's change-management process.
Unnecessary permissive profile settings increase the impact of a compromised issuance credential.