Key Constraint

Key Constraint

The Key Constraint (keyConstraintImpl) limits the algorithms and key strengths accepted in a certificate request.

Since PKI 11.10.2, allowed keys are configured with explicit per-algorithm entries:

<prefix>.constraint.params.allowedKeys.<alg>.<strength>=true|false

• <alg> — RSA, EC, MLDSA, or MLKEM

• <strength> — RSA/ML-DSA/ML-KEM key size, or EC curve name (e.g. nistp256)

Example (RSA only):

<prefix>.constraint.class_id=keyConstraintImpl
<prefix>.constraint.name=Key Constraint
<prefix>.constraint.params.allowedKeys.RSA.1024=false
<prefix>.constraint.params.allowedKeys.RSA.2048=true
<prefix>.constraint.params.allowedKeys.RSA.3072=true
<prefix>.constraint.params.allowedKeys.RSA.4096=true

Example (RSA and EC):

<prefix>.constraint.params.allowedKeys.RSA.1024=false
<prefix>.constraint.params.allowedKeys.RSA.2048=true
<prefix>.constraint.params.allowedKeys.RSA.3072=true
<prefix>.constraint.params.allowedKeys.RSA.4096=true
<prefix>.constraint.params.allowedKeys.EC.nistp256=true
<prefix>.constraint.params.allowedKeys.EC.nistp384=true
<prefix>.constraint.params.allowedKeys.EC.nistp521=true

params.allowedKeys.<alg>.ALL=true allows all strengths for that algorithm. An explicit false for the same strength takes precedence:

<prefix>.constraint.params.allowedKeys.RSA.ALL=true
<prefix>.constraint.params.allowedKeys.RSA.1024=false

Legacy Parameters

Note: params.keyType and params.keyParameters are deprecated since PKI 11.10.2. They remain supported for backward compatibility but must not be mixed with allowedKeys.

# deprecated — do not use in new profiles
<prefix>.constraint.params.keyType=RSA
<prefix>.constraint.params.keyParameters=1024,2048,3072,4096

Upgrading Existing Profiles

• On-disk CA profile files are migrated automatically by the upgrade script 01-UpdateKeyParameters.py (see PKI 11.10.2 Server Changes).

• Profiles stored only in LDAP keep the legacy parameters until updated manually.

See Migrating Key Constraint Parameters.

See Also

• Certificate Profile Constraints

• CA Certificate Profile

• Server Certificate Profile