Certificate Filter (CertificationCheck)

Audience: IT admins authoring or reviewing KEPM policies in JSON who need to scope a policy by the code-signing certificate of the target binary.

Overview

CertificationCheck is a policy filter array that restricts a policy to requests whose target binary is signed by a specific certificate (or set of certificates). It is paired with the built-in CheckCertificate() rule expression, which evaluates the array at policy-match time.

The filter is honored by the following policy types:

• FileAccess

• PrivilegeElevation

• HttpAccess

For other policy types, the field may be present in the JSON (the management console emits it by default) but is not evaluated.

JSON Structure

CertificationCheck is a top-level array of certificate hash strings, sibling to UserCheck, MachineCheck, and ApplicationCheck. It is paired with a rule entry that invokes CheckCertificate().

{
  "PolicyName": "Allow elevation for binaries signed by Vendor X",
  "PolicyType": "PrivilegeElevation",
  "Status": "enforce",
  "Rules": [
    {
      "RuleName": "CertificateCheck",
      "ErrorMessage": "Certificate hash is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckCertificate()"
    }
  ],
  "CertificationCheck": [
    "HASH1",
    "HASH2"
  ]
}

The rule entry is required for the filter to be evaluated. Policies emitted by the management console include the rule entry and an empty CertificationCheck: [] array by default.

Match Semantics

Configuration	Behavior
CertificationCheck: ["*"]	Matches any certificate. The policy applies regardless of which certificate signed the target binary.
CertificationCheck: [] (empty array)	Matches any certificate. Equivalent to ["*"]. This is the management-console default.
CertificationCheck: ["HASH1"]	Matches only requests where the target binary's certificate hash equals HASH1.
CertificationCheck: ["HASH1", "HASH2", "HASH3"]	Matches if the target binary's certificate hash equals any value in the array (OR logic).
Request has no certificate hash (binary is unsigned or hash unavailable)	The policy does not apply, unless CertificationCheck is ["*"] or empty.

Hash comparison is case-insensitive (hashes are normalized to uppercase during preprocessing).

Preprocessing Notes

• Hash values in CertificationCheck are direct strings, not collection UIDs. Unlike UserCheck, MachineCheck, and ApplicationCheck, the array does not reference Keeper collections.

• Hashes are normalized to uppercase at preprocessing time. Authoring the array in lowercase or mixed case is acceptable.

• The preprocessed snapshot can be inspected in currentPolicies.json (see Policy JSON & Extension) to confirm the resolved hash list for each policy.

Combining with Other Filters

CertificationCheck is evaluated alongside the other six built-in rule expressions (CheckUser, CheckMachine, CheckFile, CheckDate, CheckTime, CheckDay). The policy's top-level Operator field ("And" / "Or") determines how the rule results combine.

To scope a policy to a specific certificate and a specific application path, set both ApplicationCheck and CertificationCheck, and keep Operator: "And" (the management-console default).

Example

Allow Elevation Only for a Specific Signer

{
  "PolicyName": "Elevate Vendor X installers",
  "PolicyType": "PrivilegeElevation",
  "PolicyId": "example-policy-id",
  "Status": "enforce",
  "Operator": "And",
  "Actions": {
    "OnSuccess": { "Controls": ["ALLOW"] },
    "OnFailure": { "Command": "" }
  },
  "Rules": [
    { "RuleName": "UserCheck",        "RuleExpressionType": "BuiltInAction", "Expression": "CheckUser()" },
    { "RuleName": "MachineCheck",     "RuleExpressionType": "BuiltInAction", "Expression": "CheckMachine()" },
    { "RuleName": "ApplicationCheck", "RuleExpressionType": "BuiltInAction", "Expression": "CheckFile(false)" },
    { "RuleName": "CertificateCheck", "RuleExpressionType": "BuiltInAction", "Expression": "CheckCertificate()", "ErrorMessage": "Certificate hash is not included in this policy" }
  ],
  "UserCheck": ["*"],
  "MachineCheck": ["*"],
  "ApplicationCheck": ["*"],
  "CertificationCheck": [
    "A1B2C3D4E5F6..."
  ],
  "DayCheck": [],
  "DateCheck": [],
  "TimeCheck": [],
  "Extension": {}
}

This policy allows privilege elevation for any user, on any machine, for any application path — but only when the target binary is signed by the certificate matching the listed hash.