Kaspersky Embedded Systems Security 3.4 for Windows

Adding certificate monitoring rules

To add certificate monitoring rules via the Web Plug-in:

1. In the Web Plug-in, go to the Trusted Zone settings in the policy that you want to configure.
   1. In the main window of the Kaspersky Security Center Web Console, select Devices → Policies & profiles.
   2. Click the policy name you want to configure.
   3. In the <Policy name> window that opens, select the Application settings tab.
   4. Select the Supplementary section.
   5. In the Trusted Zone section, click Settings.

      A Trusted Zone window opens on the Exclusions tab.

2. Select the Certificate monitoring tab.
3. Add a certificate monitoring rule in one of the following ways:
   • Manually
     1. Click the Add button.

        A window opens with the certificate monitoring rule settings.

     2. If necessary, disable the rule by clearing the Enable certificate monitoring check box.
     3. Set a rule-triggering criterion:
        • by certificate subject mask. The application applies the rule to certificates whose title (the value in the Subject field) matches the mask entered in the Certificate subject mask field.

          You can use the ? and * wildcards for any number of masked characters. Value verification is case-insensitive.

        • by certificate thumbprint. The application applies the rule for the certificate whose thumbprint matches the one specified in the Certificate thumbprint field.

          Certificate thumbprint verification is case-insensitive.

     4. If necessary, disable
        Allow programs to run with an untrusted certificate

        

        If this option is enabled, the application allows applications signed with untrusted certificates that satisfy the rule's triggering criterion. In the context of the certificate monitoring task, an untrusted certificate is one whose validity period is found to be expired or could not be identified.

        If the option is disabled, applications signed with an untrusted certificates that match the rule-triggering criterion are blocked.

        This feature is enabled by default.

        .
     5. If necessary, disable the
        Publish event about certificate expiration

        

        If this option is enabled, the application publishes an event in the system audit log when a certificate matching the rule's criterion expires.

        The application publishes a certificate expiration event once before the application or protected device is restarted. The application does not publish an event when the software signed with an expired certificate is started again, if the application or the protected device have not been restarted.

        This feature is enabled by default.

        option.
     6. Click the OK button.
   • By importing an XML file with pre-configured certificate monitoring rules
     1. Click the Import button.
     2. In the standard Windows system window that opens, specify the path to the XML file.
     3. Click the Open button.

   The new certificate monitoring rule is displayed in the list on the Certificate monitoring tab.

4. In the Trusted Zone window, click the OK button.