Configuring a certificate-based access control policy