mirror of
https://github.com/apple/device-management.git
synced 2026-08-13 12:00:21 +02:00
89 lines
3.3 KiB
YAML
89 lines
3.3 KiB
YAML
title: Certificate Transparency
|
|
description: The payload that configures certificate transparency enforcement.
|
|
payload:
|
|
payloadtype: com.apple.security.certificatetransparency
|
|
supportedOS:
|
|
iOS:
|
|
introduced: 12.1.1
|
|
multiple: true
|
|
supervised: false
|
|
allowmanualinstall: true
|
|
sharedipad:
|
|
mode: allowed
|
|
devicechannel: true
|
|
userchannel: false
|
|
userenrollment:
|
|
mode: allowed
|
|
macOS:
|
|
introduced: 10.14.2
|
|
multiple: true
|
|
devicechannel: true
|
|
userchannel: false
|
|
requiresdep: false
|
|
userapprovedmdm: false
|
|
allowmanualinstall: true
|
|
userenrollment:
|
|
mode: allowed
|
|
tvOS:
|
|
introduced: 12.1.1
|
|
multiple: true
|
|
supervised: false
|
|
allowmanualinstall: true
|
|
visionOS:
|
|
introduced: '1.0'
|
|
multiple: true
|
|
supervised: false
|
|
allowmanualinstall: true
|
|
userenrollment:
|
|
mode: allowed
|
|
watchOS:
|
|
introduced: 5.1.1
|
|
multiple: true
|
|
supervised: false
|
|
allowmanualinstall: true
|
|
content: Policies that affect system-wide certificate transparency enforcement.
|
|
payloadkeys:
|
|
- key: DisabledForCerts
|
|
title: Disabled certs
|
|
type: <array>
|
|
presence: optional
|
|
content: |-
|
|
An array of certificates for which certificate transparency is disabled. One of the following conditions needs to be met to disable certificate transparency enforcement when this policy is set:
|
|
|
|
- The hash is of the server certificate's `subjectPublicKeyInfo`.
|
|
- The hash is of a `subjectPublicKeyInfo` that appears in a CA certificate in the certificate chain; the X.509v3 `nameConstraints` extension constrains the CA certificate. One or more `directoryName` `nameConstraints` are present in the `permittedSubtrees`, and the `directoryName` contains an `organizationName` attribute.
|
|
- The hash is of a `subjectPublicKeyInfo` that appears in a CA certificate in the certificate chain. The CA certificate has one or more `organizationName` attributes in the certificate `Subject`, and the server's certificate contains the same number of `organizationName` attributes, in the same order, and with byte-for-byte identical values.
|
|
subkeys:
|
|
- key: SubjectPublicKeyInfoHashDict
|
|
type: <dictionary>
|
|
content: A dictionary of hashed public keys.
|
|
subkeys:
|
|
- key: Algorithm
|
|
type: <string>
|
|
presence: required
|
|
rangelist:
|
|
- sha256
|
|
content: The algorithm must be `sha256`.
|
|
- key: Hash
|
|
type: <data>
|
|
presence: required
|
|
content: |-
|
|
The hash of the DER-encoding of the certificate's `subjectPublicKeyInfo`.
|
|
|
|
The hash field requires the data (`subjectPublicKeyInfo` hash) in a specific format: a Base64 encoded (binary) SHA-256 hash of the certificate's public key.
|
|
- key: DisabledForDomains
|
|
title: Disabled domains
|
|
type: <array>
|
|
presence: optional
|
|
content: An array of strings that represent the domains to exclude from certificate
|
|
transparency enforcement. The system supports using a leading period (`.`) to
|
|
signify subdomains. However, the system doesn't support wildcards. If you include
|
|
a leading period, the domain can't be a top-level domain, such as `.com` and `.co.uk`.
|
|
subkeys:
|
|
- key: domain
|
|
type: <string>
|
|
examples:
|
|
- title: Profile example
|
|
files:
|
|
- file: examples/mdm/profiles/com.apple.security.certificatetransparency/example1.plist
|