Local Trust Anchor Certificates

Controls whether to allow or block certificates issued by local trust anchors that are missing the subjectAlternativeName extension. If Allow is selected, Chromium browser will use the commonName of a server certificate to match a host name if the certificate is missing a subjectAlternativeName extension, as long as it successfully validates and chains to a locally-installed CA certificate.

Note: Selecting Allow is not recommended—It might allow bypassing the nameConstraints extension that restricts the host names for a given authorized certificate.

Allows certificates issued by Symantec Corporation's Legacy PKI operations to be trusted if they otherwise successfully validate and chain to a recognized CA certificate. For non-FydeOS systems, this policy depends on the operating system still recognizing certificates from Symantec's legacy infrastructure. If an OS update changes the OS handling of certificates, this policy no longer has an effect. This policy is intended as a temporary workaround to give enterprises more time to transition away from legacy Symantec certificates.