These parameters are used for caching the Certificates, CRLs and OCSP Responses in memory found during path building process. These properties are consumed by the Verification, XKMS and SCVP Services only.

Number of seconds to terminate a connection if a certificate/CRL is not downloaded when Advanced Discovery option is enabled in Verification, XKMS and SCVP Services.

Certificate status in the OCSP response when whitelisting is enabled and target certificate is not found in the database.

The possible values are 'REVOKED' & 'UNKNOWN' 

Time interval in seconds to update the CRL in its memory cache when high speed revocation checking has been enabled for a CA in Trust Manager.

When this property is set to TRUE, a non expired certificate can be deleted by a DELETE request from the Certification Service or the Admin GUI.

If the value is set to FALSE then only expired certificates can be deleted.

Configure this parameter to set the time interval in seconds, after which any cached keys will be deleted from the target HSM if KEK based wrapping is enabled.

These parameters are used for OTP configurations when using two factor authentication.

This value is used to set the PKCS11 keystore for the read only use.  If value is TRUE then fast PKCS11KeyStore will be used for read-only operations. 

The default value is FALSE thus allowing read / write operations and the (slower) communication option PKCS11KeyStore will be used. 

Used to validate the certificates according to the PKIX guidelines in Verification, XKMS and SCVP Services. Set this TRUE or FALSE as required.

Time interval after which an accumulated alert message is sent to operators when frequent occurrences of a log error event have occurred.

Time interval in seconds to synchronize the following files among ADSS Server instances when installed in load-balanced mode or stand-alone installation was made on multiple machines.

If ADSS Server fails to communicate with the external HTTP/S resource (i.e. TSA, CRLs (CDP), OCSP etc.), this retry parameter can be configured to recover the connection.

When enabled, MSCAPI will be shown on Crypto Source page and the keys stored in it could be used for cryptographic operations.   This is a license controlled feature.

ADSS Server debug logs can be accessed from the Admin GUI.   This feature can be exploited for a directory traversal attack and this parameter can be used to close off this feature.

ADSS Server uses different templates to display errors and exceptions in response messages. Operator can modify them as per needed. 

• HTML_FORMATTED_EXCEPTION_MESSAGE_TEMPLATE = [Error-%ERROR_CODE%] %ERROR_MESSAGE%, %EXCEPTION_MESSAGE%
  Defines the template to display exception for the ADSS Console instance. The "ERROR_CODE", "ERROR_MESSAGE" and "EXCEPTION_MESSAGE" placeholders are replaced with the actual text returned by the ADSS Console.
  
  
• FORMATTED_CUSTOM_ERROR_MESSAGE_TEMPLATE = [Error-%ERROR_CODE%] %ERROR_MESSAGE%, %CUSTOM_MESSAGE%
  Defines the template to display customized errors for the ADSS Server core, console and service instances. The "ERROR_CODE", "ERROR_MESSAGE" and "CUSTOM_MESSAGE" placeholders are replaced with text generated by the ADSS Server. 
  
  
• HTML_FORMATTED_CUSTOM_ERROR_MESSAGE_TEMPLATE
  Reserved for the future use

This property is used for internal purpose only. When this property is enabled the basic service code is not executed. This property is not intended for customers.

This property defines acceptable time difference between ADSS Server and HSM in milliseconds and send alerts to configured operators if hardware crypto source monitoring alert is enabled in Key Manager. To disable this feature set the -1 as value. 

ADSS Server uses different connection port to receive service requests from client hosts.

When set to FALSE, the ECC cryptographic provider from IAIK is not loaded. Default value is TRUE. The value should be set to FALSE when communication with the SMTP Server for email notifications is over TLS.

Number of pixels, the next visible attribute in Signature Appearance is shifted upward when the value of an attribute is not provided in the request. Default value: 0 (Signature appearance object adjustment not required) 

ADSS Server uses different settings for different types of license expiry alerts.

It defines the time period in minutes for which the client application status remains INACTIVE, if Inactivated automatically by the system due to authentication failures. Once this period is elapsed, the client application status is automatically reverted back to ACTIVE. 

It defines the number of failed authentications after which the client application status is automatically marked as INACTIVE. The inactivity duration is defined using the property "CLIENT_ACTIVATION_THRESHOLD". Default value: 0 (i.e. unlimited failed authentications allowed)  

When enabled ADSS Server Console enforces operator to change default Admin certificate within 7 days otherwise ADSS Server installation will be blocked. Default value is : False. If Common Criteria (CC) is enabled in license then updating Admin certificate is mandatory and this setting will be ignored.   

Time interval in seconds to be used as request time out in specific service calls between different ADSS Services. Default value: 60

When enabled, ADSS CA Server enforces that the certificate are issued according to the CA/B forum and WebTrust guidelines. Default value: FALSE

If the value is set to TRUE, before generating a certificate, the ADSS server will check the public key in a CSR is not a Debian weak key. Default Value: FALSE

When set to TRUE, the OCSP Service will skip the CRL expiry checking and return the certificate status in OCSP response. When set to FALSE, the OCSP service will check the CRL expiry before certificate status checking. Default value: FALSE

HSM monitoring thread checks the availability of HSM according to the configurations defined in a Crypto Profile. If HSM loses connection with the ADSS Server and the below property is set to TRUE, then the thread waits for 5 seconds to make another call to the HSM for connection. This process is repeated three times and still if the connection is not established with HSM, then the thread stops the ADSS Server Services and an alert is sent to the configured operators. If the below property is set to FALSE, then ADSS Services will remain active and only alert is sent to configured operators. Default Value: False