The Certificate Manager interface enforces the password security settings described in this section.
By default, Certificate Manager (CertHub) uses its own built-in authentication system. It supports optional external identity providers such as OIDC and LDAP as additional login methods.
Certificate Manager interface password policy
Certificate Manager passwords must meet the following policy. Yes means the setting is configurable; No means it is not configurable.
Rule | Value | Configurable |
|---|---|---|
Strength algorithm | zxcvbn password strength estimator described at https://github.com/dropbox/zxcvbn |
|
Minimum strength score | 4 out of 4 (maximum strength enforced server-side) |
|
Password history | 3 (cannot reuse last 3 passwords) |
|
Minimum password age | 24 hours between changes |
|
Force change on first login | Yes (admin can set |
|
Session token expiry | 24 hours |
|
Failed attempts before lockout | 5 |
|
Lockout duration | 24 hours |
|
Lockout scope | Per username |
|
Permanent lockout | No |
|
Certificate Manager password strength assessment
Unlike traditional rule-based policies that use a minimum length and character-class requirements, zxcvbn assesses password strength using the following factors.
- Pattern matching
- Dictionary words
- Common character substitutions
- Keyboard patterns
A score of 4 is the highest zxcvbn score and indicates that the password is very hard to crack. Passwords that achieve this score are generally at least 16 characters long or, if shorter, have high entropy.
Certificate Manager interface password configuration
As described in the previous section, you can configure some password settings. However, if the customer configures OIDC, LDAP, or IDaaS (IntelliTrust) as additional or alternative authentication providers, that provider's password policy and brute-force protection apply instead.
Certificate Manager interface password storage
Passwords are never stored in plaintext. A cryptographic key derivation function produces a hash that is stored instead of the original password.
Setting | Value |
|---|---|
Algorithm | PBKDF2 with HMAC-SHA512 |
Iterations | 10,000 |
Salt size | 8 bytes (random per user) |