<!--
{
  "documentType" : "article",
  "framework" : "Security",
  "identifier" : "/documentation/Security/standard-policies-for-specific-certificate-types",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Standard Policies for Specific Certificate Types"
}
-->

# Standard Policies for Specific Certificate Types

Use special OIDs to cause a certificate to be evaluated based on security policies specific to a given type of certificate.

## Topics

### Constants

[`let kSecPolicyAppleX509Basic: CFString`](/documentation/Security/kSecPolicyAppleX509Basic)

Basic X509-style certificate evaluation.

[`let kSecPolicyAppleSSL: CFString`](/documentation/Security/kSecPolicyAppleSSL)

Basic X509 plus host name verification per RFC 2818.

[`let kSecPolicyAppleSMIME: CFString`](/documentation/Security/kSecPolicyAppleSMIME)

Basic X509 plus email address verification and `KeyUsage` enforcement per RFC 2632.

[`let kSecPolicyAppleEAP: CFString`](/documentation/Security/kSecPolicyAppleEAP)

Extensible Authentication Protocol. Functionally identical to SSL policy. A separate OID is provided to facilitate per-policy, per-certificate trust settings using the `SecTrust` mechanism.

[`let kSecPolicyAppleIPsec: CFString`](/documentation/Security/kSecPolicyAppleIPsec)

Policy for use in IPsec communication. Functionally identical to SSL policy. A separate OID is provided to facilitate per-policy, per-certificate trust settings using the `SecTrust` mechanism.

[`extern CFStringRef const kSecPolicyAppleiChat;`](/documentation/Security/kSecPolicyAppleiChat)

Policy for use in iChat.

[`let kSecPolicyApplePKINITClient: CFString`](/documentation/Security/kSecPolicyApplePKINITClient)

Kerberos Pkinit client certificate validation.

[`let kSecPolicyApplePKINITServer: CFString`](/documentation/Security/kSecPolicyApplePKINITServer)

Kerberos Pkinit server certificate validation.

[`let kSecPolicyAppleCodeSigning: CFString`](/documentation/Security/kSecPolicyAppleCodeSigning)

Policy for use in evaluating Apple code signing certificates.

[`let kSecPolicyMacAppStoreReceipt: CFString`](/documentation/Security/kSecPolicyMacAppStoreReceipt)

Policy for use in evaluating Mac App Store receipts.

[`let kSecPolicyAppleIDValidation: CFString`](/documentation/Security/kSecPolicyAppleIDValidation)

Policy for use in evaluating Apple ID certificates.

[`let kSecPolicyAppleTimeStamping: CFString`](/documentation/Security/kSecPolicyAppleTimeStamping)

Policy that causes evaluation of the validity of the time stamp on a signature. This can be used to allow verification that a certificate was valid at the time that something was signed with that certificate even if the certificate is no longer valid.

[`let kSecPolicyApplePassbookSigning: CFString`](/documentation/Security/kSecPolicyApplePassbookSigning)

[`let kSecPolicyApplePayIssuerEncryption: CFString`](/documentation/Security/kSecPolicyApplePayIssuerEncryption)

[`let kSecPolicyAppleRevocation: CFString`](/documentation/Security/kSecPolicyAppleRevocation)


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)