← Your Systems
X.509 certificate issuance
Choose which certificate requests your issuer key can sign and when to ask for approval.
Certificate signing policies
Set signing rules for the decoded certificate, including its subject, key usage, and basic constraints. Require approval for selected requests.
Integration guideEdict exampleservice-certificates.edict
authority "service-certificates" {
intent = "x509.tbs-certificate"
version = "1"
policy "service-certificates" {
allow when {
version == 3
subject.commonName == "billing-api.internal"
extensions.basicConstraints.present
not extensions.basicConstraints.cA
extensions.keyUsage.digitalSignature
extensions.extKeyUsage.serverAuth
}
}
}