Skip to main content

Add allowed list for server profiles

You can configure an allowed list to control the DNS names and IP addresses that can be included in server certificate requests. You can also configure DNS name pattern validation by using regular expressions (regex). This enables validation of SAN DNS name values during enrollment.

When you configure a DNS name regex pattern, you can optionally specify a custom validation error message. If a certificate request contains a SAN DNS name that does not match the configured pattern, DigiCert​​®​​ Trust Lifecycle Manager displays the custom error message. If you do not specify a custom validation error message, the default validation message appears. The default message includes the regex pattern that caused the validation failure.

To add allowed list of DNS and IP addresses to your server profile:

Note

To learn more about profile creation, see Use the profile configuration wizard.

Supported certificate profile templates

This feature is available for the profiles created from the following base templates:

  • CA Manager Private Server Certificate

  • Generic Private Server Certificate

Configure an allowed list

To add a allowed list of DNS and IP addresses to your server profile.

  1. Create a certificate profile from one of the preceding base templates.

  2. On the Extensions screen of the profile configuration wizard, add IP addresses and/or DNS names in the SAN extension as needed.

  3. On the Advanced settings screen, navigate to Allowed list of DNS and IP Addresses.

  4. Enter comma-separated domain names or IP addresses on the left. To enter a range of IP addresses, use a hyphen or netmask (CIDR) notation.

  5. Select Allowed to add the domains and IPs you entered to the allowed list.

  6. Review the settings and proceed with the profile creation steps.

Configure DNS name pattern validation

To add DNS name pattern validation by using regular expressions (regex):

  1. On the Advanced settings screen, expand DNS name pattern validation.

  2. In the DNS name regex pattern field, enter a regular expression that defines the allowed SAN DNS name pattern.

    For example: ^.*\.example\.com$

  3. (Optional) In the Validation error message field, enter the message to show when a SAN DNS name does not match the configured regex pattern.

    For example: DNS name must be a subdomain of example.com

  4. Select Allowed to add the regex pattern to the allowed list.

  5. Review the profile settings and complete the remaining steps to create the certificate profile.

    Note

    If you do not configure a validation error message, Trust Lifecycle Manager displays the default validation message, which includes the regex pattern that failed validation.

: