This settings specifies the certificate comment when calling ExportCertificate. This setting is applicable only when ExportFormat is set to one of the following values:

• OpenSSHKey (ExportPrivateKey must be False)
• SSH2PublicKey
• PPK

This property controls the size of the following arrays:

• CertCustomExtensionCritical[i];
• CertCustomExtensionOID[i];
• CertCustomExtensionValue[i];

The array indices start at 0 and end at CertExtensionCount-1.

Whether or not the certificate extension at index "i" is defined as critical.

Valid array indices are from 0 to CertCustomExtensionCount - 1.

The ASN.1 object identifier (OID) that defines the certificate extension at index 'i'.

Valid array indices are from 0 to CertCustomExtensionCount - 1.

The raw value of this certificate extension (as a byte string). This value is encoded according to the extension's ASN.1 specification.

Valid array indices are from 0 to CertCustomExtensionCount - 1.

This setting specifies the extended key usage flags of the certificate created by calling CreateCertificate or IssueCertificate. If specified, the value is a comma-separated list of OIDs. Common OIDs are as follows:

For instance, the following value specified the extended key usage for Server Authentication, Client Authentication, and Code Signing: 1.3.6.1.5.5.7.3.1, 1.3.6.1.5.5.7.3.2, and 1.3.6.1.5.5.7.3.3

When CreateCertificate creates a new certificate and associated key, or when CreateKey creates a key, this setting determines the length of the new public key (in bits). The default value is 2048.

When CreateCertificate creates a new certificate and associated key, or when CreateKey creates a key, this setting determines the type of key generated: 1 for key exchange (encryption) keys, and 2 for digital signature keys. The default value is 1.

When CreateCertificate creates a new certificate and associated key, this setting determines the public key algorithm of the generated keys. Following are the valid values:

• RSA (default)
• DSA
• ECDSA_P256
• ECDSA_P384
• ECDSA_P521
• ECDSA_Secp256k1
• ECDSA_Secp224k1
• ECDSA_Secp192k1
• ECDSA_Secp160k1
• ECDSA_BRAINPOOLP160R1
• ECDSA_BRAINPOOLP192R1
• ECDSA_BRAINPOOLP224R1
• ECDSA_BRAINPOOLP256R1
• ECDSA_BRAINPOOLP320R1
• ECDSA_BRAINPOOLP384R1
• ECDSA_BRAINPOOLP512R1
• ECDSA_BRAINPOOLP160T1
• ECDSA_BRAINPOOLP192T1
• ECDSA_BRAINPOOLP224T1
• ECDSA_BRAINPOOLP256T1
• ECDSA_BRAINPOOLP320T1
• ECDSA_BRAINPOOLP384T1
• ECDSA_BRAINPOOLP512T1
• Ed25519
• Ed448

When CreateCertificate or IssueCertificate creates a new certificate, the signature algorithm used is specified by this setting. Following are the possible values:

• MD2
• MD5
• SHA1
• SHA256 (default)
• SHA384
• SHA512

This allows the Subject Alternative Names extension to be specified when creating or issuing a certificate via CreateCertificate or IssueCertificate. This setting only supports email, DNS, URI, and IPv4 addresses. Separate alternative names should be separated by commas. For example:

string altNames = "email:copy,dns:domain.com,dns.1:other.domain.com,uri:http://www.domain.com,ip:192.168.1.102"

This setting specifies the thumbprint of the certificate to be loaded. If specified, the supplied thumbprint will be used when identifying the certificate that should be loaded.

This configuration setting is not supported in the C# and Java editions, which already support loading by thumbprint via the Certificate type constructors. This setting is only supported on Windows operating systems. CertMgr cert; cert.Config("CertThumbprint=967adafd7add8f72ee4894ede866d6745970f82f"); cert.SetCertStore("MY", 2); cert.SetCertStoreType(CST_USER); cert.SetCertStorePassword(""); cert.SetCertSubject("TestCert");

This setting specifies the usage flags of the certificate created by calling CreateCertificate or IssueCertificate. If specified, the value is the binary or one or more of the supported values. For instance a value of 12 or 0xC is the binary or is one of the Certificate Signing and Key Signing usage flags. Following are the supported flags:

This configuration setting can be used to change when a newly created certificate becomes valid. By default, the certificate is valid as soon as it is created. Set CertValidityOffset to the number of days that this starting period should be offset from the current day. This setting also accepts negative values for back-dating the validity of a certificate. The default value is 0.

This configuration setting determines the duration in days that a newly created certificate remains valid. The certificate becomes valid as soon as it is created, unless CertValidityOffset is set. The duration is not changed if CertValidityOffset is set; the certificate will still expire CertValidityTime days after the validity period begins. The default value is 365 days.

When queried, this setting will check the Certificate Revocation List specified by the currently loaded Cert. The cmdlet will first obtain the list of CRL URLs from the certificate's CRL distribution points extension. The cmdlet will then make HTTP requests to each CRL endpoint to check the validity of the certificate. If the certificate has been revoked or any other issues are found during validation the cmdlet throws an exception.

This configuration setting is only supported in the Java, C#, and C++ editions. In the C++ edition, it is only supported on Windows operating systems.

When queried, the cmdlet will use OCSP to check the validity of the currently loaded Cert. The cmdlet will first obtain the OCSP URL from the certificate's OCSP extension. The cmdlet will then locate the issuing certificate and make an HTTP request to the OCSP endpoint to check the validity of the certificate. If the certificate has been revoked or any other issues are found during validation the cmdlet throws an exception.

This configuration setting is only supported in the Java, C#, and C++ editions. In the C++ edition, it is only supported on Windows operating systems.

This setting returns the PKCS8 formatted private and public key pair of the key created when CreateKey is called. This is useful in scenarios where exporting the key for use in another environment is required.

The name of the Cryptographic Service Provider used to provide access to certificate signing operations.

Set this configuration setting to a comma separated list of OID's of any extensions already present in the CSR that should be ignored when the CSR is signed.

For example if the SAN's in a CSR should be ignored the below code would work: CertMgr1->Config("CSRIgnoredExtensions=2.5.29.17");

This setting optionally specifies a PKCS8 formatted private key to use when calling GenerateCSR. When set, the keyName parameter of GenerateCSR is ignored and the key specified by this setting is used instead.

This setting controls whether the certificate exported as a string when ExportCertificate is called is encoded. If ExportFormat is set to PFX or P7B before calling ExportCertificate the exported certificate may be binary (EncodeExportedCert is False), or base64 encoded (EncodeExportedCert is True) to allow easier handling of the certificate data.

The default value is False.

This setting returns true if the currently loaded Cert supports the CRL extension.

This configuration setting is only supported in the Java, C#, and C++ editions. In the C++ edition, it is only supported on Windows operating systems.

This setting returns true if the currently loaded Cert supports the OCSP extension.

This configuration setting is only supported in the Java, C#, and C++ editions. In the C++ edition, it is only supported on Windows operating systems.

When calling ImportCertificate if a matching certificate or a link to a matching certificate already exists in the Windows certificate store this setting governs what action will be taken. Possible values are:

When calling ImportCertificate, this setting controls the type of the certificate being specified in the first parameter.

This config can take one of the following values:

This setting specifies the JWK algorithm. It can be set before calling ExportCertificate (if ExportFormat is set to JWK) to control the key algorithm used to create the JWK. This setting will also be populated after loading a JWK file.

Valid values are:

• (empty string)
• HS256
• HS384
• HS512
• RS256
• RS384
• RS512
• EC256
• EC384
• EC512
• EC256K

When set to true, the component will attempt to build the X.509 certificate chain for the certificate currently selected by Cert. If successful, the x5c parameter will be added to the JWK. It can be set before calling ExportCertificate (if ExportFormat is set to JWK).

The default value is False.

This setting specifies the JWK key Id. It can be set before calling ExportCertificate (if ExportFormat is set to JWK). This setting will also be populated after loading a JWK file.

This setting specifies the intended key operations for the JWK. It can be set before calling ExportCertificate (if ExportFormat is set to JWK). This setting will also be populated after loading a JWK file.

This setting format is a JSON array. Examples: ["sign","verify"] or ["encrypt"].

This setting specifies the intended usage of the key. It can be set before calling ExportCertificate (if ExportFormat is set to JWK). This setting will also be populated after loading a JWK file.

Valid values are enc and sig.

This setting controls the format of CertPublicKey and CertPrivateKey. By default these properties hold PEM formatted public and private key data. When set to 1 (XML) the keys are stored in a XML format. This only affects the values returned by the cmdlet; the actual keys remain the same regardless of this setting. Possible values are:

• 0 (PEM - default)
• 1 (XML)

This setting controls the level of detail that is logged through the Log event. Possible values are:

If this is false (default), the component will throw an error if a duplicate key exists while generating a new keyset using CreateKey. If set to true, the component will replace a key if it already exists when generating new keys.

This allows Subject Alternative Names to be added to a Certificate Signing request. The setting only supports email, DNS, URI, and IPv4 addresses. Separate alternative names should be separated by commas. For example:

string altNames = "email:copy,dns:domain.com,dns.1:other.domain.com,uri:http://www.domain.com,ip:192.168.1.102"

This setting exposes the Public Key Algorithm object identifier (OID) value for the currently loaded Cert.

This setting exposes the Signature Algorithm object identifier (OID) value for the currently loaded Cert.

When queried, this setting will return a string containing information about the product's build.

The default code page is Unicode UTF-8 (65001).

The following is a list of valid code page identifiers:

When queried, this setting will return a string containing information about the license this instance of a cmdlet is using. It will return the following information:

• Product: The product the license is for.
• Product Key: The key the license was generated from.
• License Source: Where the license was found (e.g., RuntimeLicense, License File).
• License Type: The type of license installed (e.g., Royalty Free, Single Server).
• Last Valid Build: The last valid build number for which the license will work.

In certain circumstances it may be beneficial to mask sensitive data, like passwords, in log messages. Set this to true to mask sensitive data. The default is true.

This setting only works on these cmdlets: AS3Receiver, AS3Sender, Atom, Client(3DS), FTP, FTPServer, IMAP, OFTPClient, SSHClient, SCP, Server(3DS), Sexec, SFTP, SFTPServer, SSHServer, TCPClient, TCPServer.

When set to false, the cmdlet will use the system security libraries by default to perform cryptographic functions where applicable. In this case, calls to unmanaged code will be made. In certain environments, this is not desirable. To use a completely managed security implementation, set this setting to true.

Setting this configuration setting to true tells the cmdlet to use the internal implementation instead of using the system security libraries.

On Windows, this setting is set to false by default. On Linux/macOS, this setting is set to true by default.

If using the .NET Standard Library, this setting will be true on all platforms. The .NET Standard library does not support using the system security libraries.

Note: This setting is static. The value set is applicable to all cmdlets used in the application.

When this value is set, the product's system dynamic link library (DLL) is no longer required as a reference, as all unmanaged code is stored in that file.