> For the complete documentation index, see [llms.txt](https://docs.certinext.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.certinext.io/documentation/policies-governance-and-compliance/cryptographic-standards-enforcement.md). # Cryptographic Standards Enforcement Cryptographic standards enforcement in CERTInext provides cryptographic governance capabilities for supported private PKI use cases, helping organizations manage certificates and cryptographic keys in accordance with applicable security standards and industry best practices. As cryptography underpins identity, authentication, encryption, and trust, consistent cryptographic governance is essential to reducing risk, maintaining compliance, and supporting long-term security resilience. For public trust certificates, cryptographic parameters such as key type and key size are currently determined from the Certificate Signing Request (CSR) submitted by the customer and are subject to the applicable Certificate Authority and industry requirements. Customer-configurable policies for permitted public-trust key algorithms or key sizes are not currently available in the CERTInext user interface. For private PKI, CERTInext supports cryptographic controls associated with configured private PKI products. These controls can be used to define the cryptographic characteristics permitted for applicable private PKI certificate issuance. **Purpose of Cryptographic Enforcement** The cryptographic standards framework in CERTInext is designed to: * Ensure consistent use of approved algorithms and key sizes where cryptographic policy controls are supported, particularly for private PKI * Help prevent issuance of certificates with cryptographic characteristics that do not comply with configured private PKI product policies * Support regulatory, audit, and compliance requirements * Enable crypto-agility and future cryptographic transitions * Reduce operational risk caused by inconsistent or manual cryptographic decisions For public trust products, these controls are currently governed by the applicable CA and industry/browser requirements rather than by customer configurable cryptographic policies within CERTInext. The broader cryptographic enforcement capability is being progressively enhanced to support additional policy-driven controls across certificate and key lifecycle operations. **Enforced Cryptographic Controls** For supported private PKI products, CERTInext provides cryptographic controls associated with the configured certificate product. Approved Algorithms and Key Sizes For private PKI products, the applicable cryptographic algorithms and key sizes are determined by the cryptographic configuration associated with the private PKI product. The permitted algorithms are defined by the private PKI product configuration. These controls are configured as part of the private PKI product configuration and are not currently exposed as a customer-configurable policy control in the CERTInext user interface. For public trust products, CERTInext does not currently provide a customer-configurable control to define permitted key algorithms or key sizes. The key type and key size are derived from the submitted CSR and remain subject to the issuing CA's applicable requirements. **Certificate and Key Lifetimes** CERTInext supports certificate lifecycle management in accordance with the validity and lifecycle requirements applicable to the certificate product. This ensures alignment with: * Industry and browser requirements for public trust * Internal security standards for private PKI * Short-lived certificate strategies for Zero Trust and automation For public trust certificates, maximum validity is governed by the applicable CA and industry/browser requirements. For private PKI, certificate lifetime requirements can be governed by the applicable private PKI product and organizational policy configuration. **Key Usage and Purpose Constraints** Cryptographic policies for supported certificate products can help ensure that keys and certificates are used for their intended purposes, such as: * Server authentication * Client authentication * Code signing or document signing * Encryption-only or signing-only use cases The specific key usage and extended key usage capabilities available depend on the certificate type, CA, and applicable product configuration. **Enforcement Across the Lifecycle** Cryptographic standards in CertiNext are applied across supported lifecycle operations based on the certificate type, CA, and applicable product configuration. The level of enforcement differs between private PKI and public trust certificates. * During Issuance For supported private PKI products, certificate requests can be evaluated against the cryptographic characteristics configured for the applicable product before issuance. For public trust certificates, CertiNext currently does not provide a customer-configurable cryptographic policy that validates permitted key algorithms or key sizes before issuance. The certificate key characteristics are derived from the submitted CSR and are subject to the issuing CA's requirements. * During Renewal and Replacement Certificate renewal and replacement continue to follow the applicable certificate product and CA requirements. Enhanced policy-driven cryptographic controls across these operations are part of the ongoing enhancement of the platform. * During Discovery and Monitoring CertiNext provides visibility into discovered certificate and cryptographic information. Organizations can use this information to identify certificates and keys that may require review based on their internal security standards. Customer-configurable policy-based evaluation of public-trust cryptographic algorithms and key sizes is not currently available. * During Revocation and Remediation Certificates identified as requiring remediation can be managed through the applicable certificate lifecycle operations, including renewal, replacement, or revocation where appropriate. This approach provides cryptographic visibility and supported policy controls today, while additional cryptographic policy enforcement capabilities can be introduced progressively across the certificate lifecycle. **Supporting Crypto-Agility** CertiNext’s cryptographic governance framework is intended to support crypto-agility by: * Decoupling cryptographic standards from applications * Supporting policy updates for applicable private PKI configurations without requiring application changes * Enabling bulk certificate and key replacement workflows * Supporting staged transitions for new cryptographic standards, including post-quantum readiness For public trust certificates, cryptographic changes remain subject to the issuing CA, applicable industry standards, and the cryptographic parameters contained in the CSR. Additional customer-configurable cryptographic policy controls for public trust products may be introduced as part of future platform enhancements. **Visibility, Alerts, and Reporting** CertiNext provides visibility into cryptographic information and certificate lifecycle status through: * Certificate and cryptographic asset information available through the platform * Certificate lifecycle and expiry information * Reports supporting security reviews and audits Where supported by the applicable product and available platform capabilities, organizations can use this information to identify certificates or cryptographic assets requiring security review or remediation. Customer-configurable alerts specifically based on public-trust cryptographic algorithm or key-size policy violations are not currently available. **Cryptographic Standards as a Control Plane** For supported private PKI use cases, cryptographic standards can form part of the certificate issuance control framework through product-level cryptographic configuration. For public trust certificates, cryptographic standards are currently governed primarily through the issuing CA's requirements and the cryptographic parameters contained in the submitted CSR rather than through customer-configurable cryptographic enforcement policies within CertiNext. CertiNext is progressively enhancing its cryptographic governance capabilities to provide stronger policy-driven controls across certificates, keys, machines, and environments as applicable capabilities are introduced. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.certinext.io/documentation/policies-governance-and-compliance/cryptographic-standards-enforcement.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.