> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Modify user certificate settings

Use this procedure to configure policy settings for user certificate authentication.

Before you begin, review limitations and setup requirements in [Manage user certificate authenticators](/docs/authentication-and-security/manage-authenticators/manage-user-certificate-authenticators.md).

### Modify user certificate authenticator settings

1. Click Menu icon **>** **Policies > Authenticators**. The **Authenticators** page appears.

2. Select **User Certificate Authenticator**. The **User Certificate Authenticator** page appears.

3. Add **User Matching Rules**:

   1. Click **Add**. The **Add Matching Rule** dialog box appears.

   2. From **Certificate Component**, select the certificate component used to match the user.

   3. From the **User Attributes** drop-down list, select the user attribute that matches the **Certificate Component**.

   4. Supported system user attributes include user ID (including aliases), User Principal Name, and security ID. Custom user attributes are also supported.

   5. Repeat these steps to add more **User Matching Rules**.

   note
   You must add at least one user matching rule, and additionally ensure that your users have the required values mapped in their **User Profile**. See [Edit, delete, unlock, and disable users](/docs/people-and-access/manage-members/add-users-to-identity-as-a-service/edit-delete-unlock-and-disable-users.md).

4. Enter the **Mandatory Policy OIDs**. Separate each OID on a new line.

5. Enter the **Prohibited Policy OIDs**. Separate each OID on a new line.

note
The Policy OIDs ensure that only certificates with the appropriate policies can be used.

6. Click **Save**.

7. Optional: Click Menu icon to display the **Reorder Matching Rules** dialog box.

8. Click and drag Menu icon to reorder the user matching rules.

9. Optional: Click Trash icon to delete a user matching rule.

### Validate your changes

After saving settings, validate the result.

1. Confirm user matching rules are saved and displayed in the expected order.
2. Confirm users have the required mapped profile attributes.
3. Test sign-in with a certificate that should match, and confirm authentication succeeds.
4. Test with a certificate that violates mandatory or prohibited policy OIDs, and confirm authentication is denied.