Policy
Determines whether the built-in certificate verifier will enforce constraints encoded into trust anchors loaded from the platform trust store (obsolete)
Microsoft Edge
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows7
OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge 127. X.509 certificates might encode constraints, such as Name Constraints, in extensions in the certificate. RFC 5280 specifies that enforcing such constraints on trust anchor certificates is optional. From Microsoft Edge 112, such constraints in certificates loaded from the platform certificate store will now be enforced. This policy exists as a temporary opt-out in case an enterprise encounters issues with the constraints encoded in their private roots. In that case this policy may be used to temporarily disable enforcement of the constraints while correcting the certificate issues. If you enable this policy or don't configure it, Microsoft Edge enforces constraints encoded into trust anchors loaded from the platform trust store. If you disable this policy, Microsoft Edge won't enforce constraints encoded into trust anchors loaded from the platform trust store. This policy has no effect if the 'MicrosoftRootStoreEnabled' (Determines whether the Microsoft Root Store and built-in certificate verifier will be used to verify server certificates) policy is disabled. This policy was removed in Microsoft Edge version 128. Starting with that version, constraints in trust anchors are always enforced.
Registry values
How enabled and disabled states update the registry.
| Scope | Registry location | Type | Enabled value | Disabled value | Copy |
|---|---|---|---|---|---|
Path Software\Policies\Microsoft\Edge Value name EnforceLocalAnchorConstraintsEnabled | REG_DWORD | HKLM 1 HKCU 1 | HKLM 0 HKCU 0 |
Policy elements
Inputs and configuration options exposed by this policy.
This policy has no additional user input fields.