Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes

Supported OS tags: Windows7

Disables enforcement of Certificate Transparency requirements for a list of subjectPublicKeyInfo hashes. This policy lets you disable Certificate Transparency disclosure requirements for certificate chains that contain certificates with one of the specified subjectPublicKeyInfo hashes. This allows certificates that would otherwise be untrusted because they weren't properly publicly disclosed to still be used for Enterprise hosts. To disable Certificate Transparency enforcement when this policy is set, one of the following sets of conditions must be met: 1. The hash is of the server certificate's subjectPublicKeyInfo. 2. The hash is of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, that CA certificate is constrained via the X.509v3 nameConstraints extension, one or more directoryName nameConstraints are present in the permittedSubtrees, and the directoryName contains an organizationName attribute. 3. The hash is of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, the CA certificate has one or more organizationName attributes in the certificate Subject, and the server's certificate contains the same number of organizationName attributes, in the same order, and with byte-for-byte identical values. A subjectPublicKeyInfo hash is specified by concatenating the hash algorithm name, the "/" character, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. This Base64 encoding is the same format as an SPKI Fingerprint, as defined in RFC 7469, Section 2.4. Unrecognized hash algorithms are ignored. The only supported hash algorithm at this time is "sha256". If you disable this policy or don't configure it, any certificate required to be disclosed via Certificate Transparency is treated as untrusted if not disclosed according to the Certificate Transparency policy. Example value: sha256/AAAAAAAAAAAAAAAAAAAAAA== sha256//////////////////////w==

• ComputerUser
  Ads setting for sites with intrusive ads

  Microsoft Edge version 78, Windows 7 or later
• ComputerUser
  Allow access to a list of URLs in InPrivate mode.

  Microsoft Edge version 147, Windows 7 or later
• ComputerUser
  Allow access to sensors on specific sites

  Microsoft Edge version 86, Windows 7 or later
• ComputerUser
  Allow access to the Enterprise Mode Site List Manager tool

  Microsoft Edge version 86, Windows 7 or later
• ComputerUser
  Allow Back/Forward Cache for WebSockets

  Microsoft Edge version 152, Windows 7 or later
• ComputerUser
  Allow certificates signed using SHA-1 when issued by local trust anchors (obsolete)

  Microsoft Edge version 85-91, Windows 7 or later
• ComputerUser
  Allow clipboard use on specific sites

  Microsoft Edge version 109, Windows 7 or later