Skip to main content

サーバープロファイルの許可リストを追加

You can configure an allowed list to control the DNS names and IP addresses that can be included in server certificate requests. You can also configure DNS name pattern validation by using regular expressions (regex). This enables validation of SAN DNS name values during enrollment.

When you configure a DNS name regex pattern, you can optionally specify a custom validation error message. If a certificate request contains a SAN DNS name that does not match the configured pattern, DigiCert​​®​​ Trust Lifecycle Manager displays the custom error message. If you do not specify a custom validation error message, the default validation message appears. The default message includes the regex pattern that caused the validation failure.

サーバープロファイルに DNS と IP アドレスの許可リストを追加するには、次の手順を実行します。

注記

To learn more about profile creation, see プロファイル構成ウィザードの使用.

Supported certificate profile templates

This feature is available for the profiles created from the following base templates:

  • CA Manager Private Server Certificate

  • Generic Private Server Certificate

Configure an allowed list

To add a allowed list of DNS and IP addresses to your server profile.

  1. 証明書プロファイルを作成します。

  2. SAN で IP アドレスと DNS の一方または両方を追加します。

  3. ［高度な設定］セクションで、［Allowed list of DNS/IP address］に移動します。

  4. Enter comma-separated domain names or IP addresses on the left. To enter a range of IP addresses, use a hyphen or netmask (CIDR) notation.

  5. Select Allowed to add the domains and IPs you entered to the allowed list.

  6. 設定を確認した後、プロファイル作成手順に進みます。「プロファイル構成ウィザードの使用」を参照してください。

Configure DNS name pattern validation

To add DNS name pattern validation by using regular expressions (regex):

  1. On the Advanced settings screen, expand DNS name pattern validation.

  2. In the DNS name regex pattern field, enter a regular expression that defines the allowed SAN DNS name pattern.

    For example: ^.*\.example\.com$

  3. (Optional) In the Validation error message field, enter the message to show when a SAN DNS name does not match the configured regex pattern.

    For example: DNS name must be a subdomain of example.com

  4. Select Allowed to add the regex pattern to the allowed list.

  5. Review the profile settings and complete the remaining steps to create the certificate profile.

    注記

    If you do not configure a validation error message, Trust Lifecycle Manager displays the default validation message, which includes the regex pattern that failed validation.

このセクションの内容: