Index: components/policy/resources/policy_templates.json |
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json |
index ded99e06c48dcd824ff5a9cb74861b6a4242b8bb..b7b09b0125ecaeb263ebaf4bd25b3d4bd2df4865 100644 |
--- a/components/policy/resources/policy_templates.json |
+++ b/components/policy/resources/policy_templates.json |
@@ -139,7 +139,7 @@ |
# persistent IDs for all fields (but not for groups!) are needed. These are |
# specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs, |
# because doing so would break the deployed wire format! |
-# For your editing convenience: highest ID currently used: 365 |
+# For your editing convenience: highest ID currently used: 366 |
# And don't forget to also update the EnterprisePolicies enum of |
# histograms.xml (run tools/metrics/histograms/update_policies.py). |
# |
@@ -4850,6 +4850,25 @@ |
If this policy is not set, or it is set to false, then <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> follows the publicly announced SHA-1 deprecation schedule.''', |
}, |
{ |
+ 'name': 'EnableCommonNameFallbackForLocalAnchors', |
+ 'type': 'main', |
+ 'schema': { 'type': 'boolean' }, |
+ 'supported_on': ['chrome.*:58-65', 'chrome_os:58-65', 'android:54-65'], |
+ 'features': { |
+ 'dynamic_refresh': True, |
+ 'per_profile': False, |
+ }, |
+ 'example_value': False, |
+ 'id': 366, |
+ 'caption': '''Whether to allow certificates issued by local trust anchors that are missing the subjectAlternativeName extension''', |
+ 'tags': ['system-security'], |
+ 'desc': '''When this setting is enabled, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will use the commonName of a server certificate to match a hostname if the certificate is missing a subjectAlternativeName extension, as long as it successfully validates and chains to a locally-installed CA certificates. |
+ |
+ Note that this is not recommended, as this may allow bypassing the nameConstraints extension that restricts the hostnames that a given certificate can be authorized for. |
+ |
+ If this policy is not set, server certificates that lack a subjectAlternativeName extension containing either a DNS name or IP address will not be trusted.''', |
+ }, |
+ { |
'name': 'ForceEphemeralProfiles', |
'type': 'main', |
'schema': { 'type': 'boolean' }, |