About certificate-based access control policies
Certificate-based access control policies allow you to authorize access to a device (for example, an HTTPS server) based on the attributes of an authenticated client's certificate.
Access control rules and certificate attribute groups
A certificate-based access control policy is a set of access control rules (permit or deny statements), each associated with a certificate attribute group. A certificate attribute group contains multiple attribute rules, each defining a matching criterion for an attribute in the certificate issuer name, subject name, or alternative subject name field.
Certificate matching mechanism
If a certificate matches all attribute rules in a certificate attribute group associated with an access control rule, the system determines that the certificate matches the access control rule. In this scenario, the match process stops, and the system performs the access control action defined in the access control rule.
The following conditions describe how a certificate-based access control policy verifies the validity of a certificate:
If a certificate matches a permit statement, the certificate passes the verification.
If a certificate matches a deny statement or does not match any statements in the policy, the certificate is regarded invalid.
If a statement is associated with a non-existing attribute group, or the attribute group does not have attribute rules, the certificate matches the statement.
If the certificate-based access control policy specified for a security application (for example, HTTPS) does not exist, all certificates in the application pass the verification.