EnrollmentFlagsV4Property Struct
Template configurations for v4 template schema.
Example
ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_pcaconnectorad as pcaconnectorad } from 'aws-cdk-lib';
const enrollmentFlagsV4Property: pcaconnectorad.CfnTemplate.EnrollmentFlagsV4Property = {
enableKeyReuseOnNtTokenKeysetStorageFull: false,
includeSymmetricAlgorithms: false,
noSecurityExtension: false,
removeInvalidCertificateFromPersonalStore: false,
userInteractionRequired: false,
};
Properties
enableKeyReuseOnNtTokenKeysetStorageFulloptionalboolean | IResolvableenable_key_reuse_on_nt_token_keyset_storage_fulloptionaltyping.Union[bool, IResolvable]enableKeyReuseOnNtTokenKeysetStorageFulloptionalBooleanEnableKeyReuseOnNtTokenKeysetStorageFulloptionalboolEnableKeyReuseOnNtTokenKeysetStorageFulloptionalinterface{}#Allow renewal using the same key.
includeSymmetricAlgorithmsoptionalboolean | IResolvableinclude_symmetric_algorithmsoptionaltyping.Union[bool, IResolvable]includeSymmetricAlgorithmsoptionalBooleanIncludeSymmetricAlgorithmsoptionalboolIncludeSymmetricAlgorithmsoptionalinterface{}#Include symmetric algorithms allowed by the subject.
noSecurityExtensionoptionalboolean | IResolvableno_security_extensionoptionaltyping.Union[bool, IResolvable]noSecurityExtensionoptionalBooleanNoSecurityExtensionoptionalboolNoSecurityExtensionoptionalinterface{}#This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability.
removeInvalidCertificateFromPersonalStoreoptionalboolean | IResolvableremove_invalid_certificate_from_personal_storeoptionaltyping.Union[bool, IResolvable]removeInvalidCertificateFromPersonalStoreoptionalBooleanRemoveInvalidCertificateFromPersonalStoreoptionalboolRemoveInvalidCertificateFromPersonalStoreoptionalinterface{}#Delete expired or revoked certificates instead of archiving them.
userInteractionRequiredoptionalboolean | IResolvableuser_interaction_requiredoptionaltyping.Union[bool, IResolvable]userInteractionRequiredoptionalBooleanUserInteractionRequiredoptionalboolUserInteractionRequiredoptionalinterface{}#Require user interaction when the subject is enrolled and the private key associated with the certificate is used.