# Security Policy Keys Use these dictionary keys to get and set policy properties. ## Discussion Use these keys with calls to the [`SecPolicyCopyProperties(_:)`](/documentation/Security/SecPolicyCopyProperties(_:)) and [`SecPolicySetProperties`](/documentation/Security/SecPolicySetProperties) functions. ## Topics ### Constants [`let kSecPolicyOid: CFString`](/documentation/Security/kSecPolicyOid) The object identifier that defines the policy type (`CFStringRef`). All policies have a value for this key. [`let kSecPolicyName: CFString`](/documentation/Security/kSecPolicyName) A name (`CFStringRef`) that the certificate must match to satisfy this policy. For SSL/TLS, this specifies the server name which must match the common name of the certificate. For S/MIME, this specifies the RFC 822 email address. [`let kSecPolicyClient: CFString`](/documentation/Security/kSecPolicyClient) If true, indicates this policy should be evaluated against the client certificate. If false, the policy is evaluated against the certificate for the server. Default is false. [`let kSecPolicyRevocationFlags: CFString`](/documentation/Security/kSecPolicyRevocationFlags) [`let kSecPolicyTeamIdentifier: CFString`](/documentation/Security/kSecPolicyTeamIdentifier) [`let kSecPolicyKU_DigitalSignature: CFString`](/documentation/Security/kSecPolicyKU_DigitalSignature) If true, the certificate’s key usage must allow it to be used for signing. [`let kSecPolicyKU_NonRepudiation: CFString`](/documentation/Security/kSecPolicyKU_NonRepudiation) If true, the certificate’s key usage must allow it to be used for non-repudiation. [`let kSecPolicyKU_KeyEncipherment: CFString`](/documentation/Security/kSecPolicyKU_KeyEncipherment) If true, the certificate’s key usage must allow it to be used for key encryption. [`let kSecPolicyKU_DataEncipherment: CFString`](/documentation/Security/kSecPolicyKU_DataEncipherment) If true, the certificate’s key usage must allow it to be used for data encryption. [`let kSecPolicyKU_KeyAgreement: CFString`](/documentation/Security/kSecPolicyKU_KeyAgreement) If true, the certificate’s key usage must allow it to be used for key agreement. [`let kSecPolicyKU_KeyCertSign: CFString`](/documentation/Security/kSecPolicyKU_KeyCertSign) If true, the certificate’s key usage must allow it to be used for signing certificates. [`let kSecPolicyKU_CRLSign: CFString`](/documentation/Security/kSecPolicyKU_CRLSign) If true, the certificate’s key usage must allow it to be used for signing certificate revocation lists (CRLs). [`let kSecPolicyKU_EncipherOnly: CFString`](/documentation/Security/kSecPolicyKU_EncipherOnly) If true, the certificate’s key usage must allow it to be used *only* for encryption. [`let kSecPolicyKU_DecipherOnly: CFString`](/documentation/Security/kSecPolicyKU_DecipherOnly) If true, the certificate’s key usage must allow it to be used *only* for decryption. --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)