Knowledge Base

How to Configure Domain Policy Rules for Certificate Enrollment 

Overview 

This guide provides the step-by-step process for understanding and applying domain policy requirements when issuing certificates. It explains how to work with FQDNs, hostnames, IP addresses, and wildcard domains to ensure that certificate requests align with organizational rules and avoid enrollment failures. 
 
Use Cases 

Domain policies are commonly used for: 

Prerequisites 

Before you begin, ensure you have the following: 

Key Components 

Fully Qualified Domain Name (FQDN) 

Format: hostname.domain.tld (e.g., server1.corp.net) 

Role: Serves as a primary identifier for devices and must match approved formats for certificate issuance. 
 

Hostname 

Format: Short device name (e.g., server1, router) 

Role: Frequently combined with domain suffixes to maintain consistent device naming. 
 

IP Addresses 

Format: IPv4 or IPv6 (e.g., 192.168.1.1, 2001:db8::1) 

Role: May be included in SAN fields but are usually disabled unless explicitly allowed. 
 

Wildcard Domains 

Format: *.domain.tld (e.g., *.corp.net) 

Role: Must be explicitly permitted and are often restricted to internal domains only. 
 
Steps to configure domain policies for certificate enrollment 

Step 1: Review Approved FQDN Formats 

Verify that the Fully Qualified Domain Name (FQDN) used in the certificate request follows organizational standards. 
FQDNs should follow the format hostname.domain.tld (e.g., server1.corp.net). These values are typically used in the Subject Name (CN) or Subject Alternative Name (SAN) fields. 

Step 2: Validate Hostname Usage 

Check that the hostname complies with internal naming requirements. 
Hostnames should be short, device‑specific names (e.g., server1, mail, router) and are often combined with approved domain suffixes such as hostname.corp.net. 

Step 3: Confirm IP Address Permissions 

If your certificate requires an IP address in the SAN field, ensure IP addresses are explicitly allowed by your domain policy. 
The entry MUST contain the IPv4 or IPv6 address that the CA has confirmed the Applicant controls or has been granted the right to use through a method specified. The entry MUST NOT contain a Reserved IP Address. 

Step 4: Check Wildcard Domain Rules 

Determine whether wildcard domains are permitted within your environment. 
Wildcard entries (e.g., *.corp.net) must be explicitly enabled. Many organizations restrict them only to internal domains, such as *.internal.corp.net, while blocking external wildcards like *.com. 
 
Troubleshooting 

Validate Certificate Request Formatting 

Review SCM or Domain Policy Settings (if enrollment fails) 

If certificate enrollment is unsuccessful: 

Verification 

To confirm that the process was successful: