IronPort - advanced configuration guide

Signer
Issuer
Escaping in Regular Expressions
6-40
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
and is the value for matching the “issuer” or “signer.”
If the message is signed using multiple signatures, the rule returns true if any of the issuers or signers
match the regular expression. The short form of this rule, signed-certificate(“issuer”) and
signed-certificate(“signer”), returns true if the S/MIME message contains an issuer or signer.
For message signers, the rule extracts the sequence of rfc822Name names from the X.509 certificate’s
subjectAltName extension. If there is no subjectAltName field in the signing certificate, or this field
does not have any rfc822Name names, the signed-certificate(“signer”) rule evaluates to false. In the
rare cases of multiple rfc822Name names, the rule tries to match all of the names to the regular
expression and evaluates as true on the first match.
The issuer is a non-empty distinguished name in the X.509 certificate. AsyncOS extracts the issuer from
the certificate and converts it to an LDAP-UTF8 Unicode string. For example:
C=US,S=CA,O=IronPort
C=US,CN=Bob Smith
Since X.509 certificates require the issuer field, signed-certificate(“issuer”) evaluates whether the
S/MIME message contains an X.509 certificate.
LDAP-UTF8 defines a mechanism for escaping that you can use in your regular expressions. For a
detailed discussion on escaping characters in LDAP-UTF8, consult Lightweight Directory Access
Protocol (LDAP): String Representation of Distinguished Names, accessible from
http://www.ietf.org/rfc/rfc4514.txt.
The escaping rules for the signed-certificate rule’s regular expressions differ from the escaping rules
defined in LDAP-UTF8 by limiting escaping to only the characters that require escaping. LDAP-UTF8
allows optional escaping for characters that can be represented without escaping. For example, the
following two strings are considered correct for “Example, Inc.” using the LDAP-UTF8 escaping rules:
Example\, Inc.
$CertificateSigners Action Variable
Example\,\ Inc\.
However, the signed-certificate rule only matches Example\, Inc. The regular expression does not
allow escaping the space and period for matching because these characters do not require escaping, even
though it is permitted in LDAP-UTF8. When creating a regular expression for the signed-certificate
rule, do not escape a character if it can be represented without escaping.
The action variable $CertificateSigners is a comma separated list of signers obtained from the
subjectAltName element of the signing certificate. Multiple email addresses of a single signer will be
included in the list with duplicates removed.
OL-25137-01