Compliance

CertForge includes built-in compliance tooling: framework assignment that enforces policy requirements automatically, an AI engine that scores approval requests for risk, and a hash-chained audit trail that can be cryptographically verified.

Compliance frameworks

A compliance framework can be assigned to an org or to individual Domain Trust Profiles. When active, the framework enforces its policy requirements without manual configuration of each DTP.

Supported frameworks

Framework	Key requirements enforced
SOC 2	Mandatory approval reason, audit trail chain verification enabled
ISO 27001	Mandatory approval reason, maximum certificate validity
PCI-DSS	Mandatory approval reason, maximum certificate validity, key algorithm requirements
HIPAA	Mandatory approval reason, audit trail chain verification enabled

Assigning a framework

Go to Compliance in the navigation and select one or more frameworks. Framework requirements apply immediately to all new approval decisions in the org. A framework can also be assigned per DTP from the DTP form. Per-DTP assignment restricts enforcement to certificates issued under that profile.

What frameworks enforce

When mandatory_approval_reason is set by the active framework:

Every approval and rejection decision requires the approver to select a predefined reason from the dropdown before submitting
If no predefined reasons are configured, a free-text field is required instead

When a maximum validity is set by the framework:

Certificate requests for longer validity are capped at the framework’s maximum
Applies to internal CA certificates only; ACME CAs always cap at 90 days

CA/Browser Forum EKU Requirement

Chrome Root Program Policy v1.8 and the CA/Browser Forum Baseline Requirements require that publicly-trusted TLS certificates use only serverAuth in the X.509 Extended Key Usage (EKU) field. Certificates that combine serverAuth and clientAuth on a publicly-trusted cert are non-compliant and may be rejected by Chrome. CertForge includes a built-in non_compliant_eku alert rule (enabled by default) that fires whenever your certificate inventory contains certs violating this requirement. The alert references the specific policy and identifies affected certificates by subject. See Chrome Root Program EKU Enforcement in the Discovery docs for detection details and remediation steps.

AI risk assessment

When the AI engine is enabled by the platform administrator, each incoming approval request is scored automatically before approvers review it. The AI engine evaluates:

The requested domain name pattern (sensitivity, public vs. internal)
The requested environment (production carries higher weight)
The requesting entity’s history (prior approvals, rejections, patterns)
The CA type and DTP settings

The result is a risk level — low, medium, or high — along with a plain-text explanation of the factors that drove the score. Both the score and the reasoning are displayed on the approval request and stored permanently in the audit trail as an approval.ai_risk event. The AI score is advisory. Approvers can approve or reject regardless of the score. To enable AI risk assessment, contact your platform administrator. Enabling requires an AI provider API key to be configured at the platform level.

Audit trail

Every action in CertForge — certificate issuances, approval decisions, admin changes, logins — is written to an append-only audit log. Each record includes:

Field	Description
`event_id`	Unique identifier for the event
`ts`	UTC timestamp
`type`	Event type, e.g. `certificate.issued`, `approval.decision`
`actor`	Who performed the action (user, API, system)
`resource_type`	The object affected (certificate, DTP, user, etc.)
`resource_id`	Identifier of the affected object
`outcome`	`success` or `error`
`details`	Event-specific payload (domains, CA, reason, etc.)

Hash chain integrity

The audit trail is hash-chained: each record includes the SHA-256 hash of the previous record. This makes the trail tamper-evident — modifying any past record breaks the chain. CertForge verifies the chain on every startup. If tampering is detected, CertForge will not start until the issue is investigated.

Manual verification

You can verify the audit chain on demand at Compliance → Audit Chain. This page shows the current chain status, the total number of records, and the hash of the most recent record. If the chain is intact, a verification badge is displayed with a timestamp.

Compliance evidence view

The Compliance → Trail tab shows a filtered view of the audit log containing only certificate and approval events. This view is designed for export and presentation to auditors. The Justification column shows the approval reason recorded at decision time.

Framework Reports

The Framework Reports tab provides a per-control compliance posture view of your live certificate inventory, scoped to a specific framework.

Setup

Go to Applications and open any application’s settings.
Under Compliance Scopes, check the frameworks this application’s certificates are in scope for.
Navigate to Compliance → Framework Reports and select a framework.

What it shows

Section	Description
Controls Passing	How many framework controls are fully met across your in-scope certs
Control Attestation	Per-control verdict (Pass / Partial / Fail), pass/partial/fail counts, and top issue reasons
Applications in Scope	Applications tagged with this framework
In-Scope Certificates	All certs linked to tagged applications — governance grade, expiry status, auto-renew state
Gap Findings	Certs with no application link that cannot be attributed to this scope

Control verdicts

Verdict	Meaning
Pass	All in-scope certs meet every criterion for this control
Partial	No cert actively fails, but some certs are at risk (e.g. auto-renew off, expiring soon)
Fail	One or more certs actively fail this control (e.g. weak key, expired, poor governance grade)

Printing for auditors

Click Print Report next to the scope selector. This opens a standalone printable page containing the full report — controls, cert inventory, and gap findings. Use the browser’s Print / Save as PDF function to produce an auditor-ready document. No login is required to read the printed PDF.

Supported frameworks and controls

Framework	Controls
PCI-DSS	4.2.1 Encryption in Transit, 6.3.3 Certificate Lifecycle Management, 12.3.3 Cryptographic Key Review
SOC 2	CC6.1 Logical Access Controls, CC6.7 Transmission Encryption, CC7.2 Monitoring
HIPAA	§164.312(e)(2)(ii) Encryption in Transit, §164.312(a)(2)(iv) Encryption at Rest
ISO 27001	A.10.1.1 Cryptographic Controls Policy, A.10.1.2 Key Management, A.14.1.3 Application Service Transactions

​Compliance

​Compliance frameworks

​Supported frameworks

​Assigning a framework

​What frameworks enforce

​CA/Browser Forum EKU Requirement

​AI risk assessment

​Audit trail

​Hash chain integrity

​Manual verification

​Compliance evidence view

​Framework Reports

​Setup

​What it shows

​Control verdicts

​Printing for auditors

​Supported frameworks and controls