The PKI Hub Management Console and the Certificate Authority interface enforce the password security settings described in this section.
PKI Hub and Certificate Authority user interface password policy
The PKI Hub Management Console and the Certificate Authority user interface support the following password policy:
Rule | Value |
|---|---|
Minimum length | 16 characters |
Uppercase letters | At least 1 |
Lowercase letters | At least 1 |
Digits | At least 1 |
Special characters | At least 1 |
Password cannot contain username | Yes |
Password cannot be the username | Yes |
Password cannot be the email | Yes |
Password history | 8 (cannot reuse last 8 passwords) |
Password expiration | 365 days (forced change after expiry) |
Max authentication age | 365 days |
Brute-force protection enabled | Yes |
Failed attempts before lockout | 3 |
Lockout duration | 15 minutes |
Max wait increment | 15 minutes |
Max failure reset window | 24 hours |
Permanent lockout | No (temporary lockout only) |
PKI Hub and Certificate Authority user interface password configuration
Customers can configure the password policy and brute-force protection after deployment through the Management Console identity management interface. See:
If a customer configures an external Identity Provider (IdP) through OIDC federation, the external IdP's password policy and brute-force protection apply instead of the local settings.
PKI Hub and Certificate Authority interface password storage
The PKI Hub and Certificate Authority interface passwords are never stored in plaintext. A cryptographic key derivation function produces a hash that is stored instead of the original password.
Setting | Value |
|---|---|
Algorithm | PBKDF2 with HMAC-SHA512 |
Iterations (new passwords) | 210,000 |
Iterations (migrated from CSP PKI 1.2) | 10,000 |
Salt size | 16 bytes (random per credential) |
When a user whose password was migrated from an earlier version changes their password, it is automatically re-hashed with 210,000 iterations.