Automatically select client certificates for these sites

What it does

Setting the policy lets you make a list of URL patterns that specify sites for which Chrome can automatically select a client certificate. The value is an array of stringified JSON dictionaries, each with the form { "pattern": "$URL_PATTERN", "filter" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts the client certificates the browser automatically selects from. Independent of the filter, only certificates that match the server's certificate request are selected. On Android and iOS, Chrome can only select client certificates that it has provisioned itself; it cannot access certificates installed at the operating system level. Examples for the usage of the $FILTER section: * When $FILTER is set to { "ISSUER": { "CN": "$ISSUER_CN" } }, only client certificates issued by a certificate with the CommonName $ISSUER_CN are selected. * When $FILTER contains both the "ISSUER" and the "SUBJECT" sections, only client certificates that satisfy both conditions are selected. * When $FILTER contains a "SUBJECT" section with the "O" value, a certificate needs at least one organization matching the specified value to be selected. * When $FILTER contains a "SUBJECT" section with a "OU" value, a certificate needs at least one organizational unit matching the specified value to be selected. * When $FILTER is set to {}, the selection of client certificates is not additionally restricted. Note that filters provided by the web server still apply. Leaving the policy unset means there's no autoselection for any site. See https://chromeenterprise.google/policies/?policy=AutoSelectCertificateForUrls for more information about schema and formatting. Example value: {"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}

What it writes

Hive

HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER

Registry key

Software\Policies\BraveSoftware\Brave

Options

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\Software\Policies\BraveSoftware\Brave\AutoSelectCertificateForUrls]

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Automatically select client certificates for these sites
# Name: AutoSelectCertificateForUrls
# Scope: Machine
# State: Enabled
# Source: brave.admx

Clear-RegistryKeyValues -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\BraveSoftware\Brave\AutoSelectCertificateForUrls'

./Device/Vendor/MSFT/Policy/Config/ADMX_brave/AutoSelectCertificateForUrls

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Automatically select client certificates for these sites
# Name: AutoSelectCertificateForUrls
# Scope: Machine
# State: Enabled
# Source: brave.admx

$keyPath = 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\BraveSoftware\Brave\AutoSelectCertificateForUrls'
if (Test-Path -LiteralPath $keyPath) {
    $propertyNames = (Get-Item -LiteralPath $keyPath).Property
    if ($propertyNames.Count -gt 0) {
        $reasons.Add('Key should be empty: HKEY_LOCAL_MACHINE\Software\Policies\BraveSoftware\Brave\AutoSelectCertificateForUrls') | Out-Null
    }
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Automatically select client certificates for these sites
# Name: AutoSelectCertificateForUrls
# Scope: Machine
# State: Enabled
# Source: brave.admx

Clear-RegistryKeyValues -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\BraveSoftware\Brave\AutoSelectCertificateForUrls'

History 31 retained releases

1. 1.92.1342 Jul 2026
   • Description … Leaving the policy unset means there's no autoselection for any site. See https://c[removed: loud.google.com/docs/chrome-enterpris][added: hromeenterprise.googl]e/policies/?policy=AutoSelectCertificateForUrls for more information about schema and formatting. Example value: {"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", …
     Whole description, marked

     Setting the policy lets you make a list of URL patterns that specify sites for which Chrome can automatically select a client certificate. The value is an array of stringified JSON dictionaries, each with the form { "pattern": "$URL_PATTERN", "filter" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts the client certificates the browser automatically selects from. Independent of the filter, only certificates that match the server's certificate request are selected. On Android and iOS, Chrome can only select client certificates that it has provisioned itself; it cannot access certificates installed at the operating system level. Examples for the usage of the $FILTER section: * When $FILTER is set to { "ISSUER": { "CN": "$ISSUER_CN" } }, only client certificates issued by a certificate with the CommonName $ISSUER_CN are selected. * When $FILTER contains both the "ISSUER" and the "SUBJECT" sections, only client certificates that satisfy both conditions are selected. * When $FILTER contains a "SUBJECT" section with the "O" value, a certificate needs at least one organization matching the specified value to be selected. * When $FILTER contains a "SUBJECT" section with a "OU" value, a certificate needs at least one organizational unit matching the specified value to be selected. * When $FILTER is set to {}, the selection of client certificates is not additionally restricted. Note that filters provided by the web server still apply. Leaving the policy unset means there's no autoselection for any site. See https://c[removed: loud.google.com/docs/chrome-enterpris][added: hromeenterprise.googl]e/policies/?policy=AutoSelectCertificateForUrls for more information about schema and formatting. Example value: {"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}

2. 1.90.1217 May 2026
   • Description … filter, only certificates that match the server's certificate request are selected. On Android[added: and iOS], Chrome can only select client certificates that it has provisioned itself; it …
     Whole description, marked

     Setting the policy lets you make a list of URL patterns that specify sites for which Chrome can automatically select a client certificate. The value is an array of stringified JSON dictionaries, each with the form { "pattern": "$URL_PATTERN", "filter" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts the client certificates the browser automatically selects from. Independent of the filter, only certificates that match the server's certificate request are selected. On Android[added: and iOS], Chrome can only select client certificates that it has provisioned itself; it cannot access certificates installed at the operating system level. Examples for the usage of the $FILTER section: * When $FILTER is set to { "ISSUER": { "CN": "$ISSUER_CN" } }, only client certificates issued by a certificate with the CommonName $ISSUER_CN are selected. * When $FILTER contains both the "ISSUER" and the "SUBJECT" sections, only client certificates that satisfy both conditions are selected. * When $FILTER contains a "SUBJECT" section with the "O" value, a certificate needs at least one organization matching the specified value to be selected. * When $FILTER contains a "SUBJECT" section with a "OU" value, a certificate needs at least one organizational unit matching the specified value to be selected. * When $FILTER is set to {}, the selection of client certificates is not additionally restricted. Note that filters provided by the web server still apply. Leaving the policy unset means there's no autoselection for any site. See https://cloud.google.com/docs/chrome-enterprise/policies/?policy=AutoSelectCertificateForUrls for more information about schema and formatting. Example value: {"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}

3. 1.88.13214 Mar 2026
   • Already present in the first release ChangeIntel keeps.

28 later releases left it unchanged.

Template

Internal name

AutoSelectCertificateForUrls

Namespace

BraveSoftware.Policies.Brave

Template file

brave.admx

Release

Brave Browser 1.93.137 · file set 11b43ac4a4ada3ca…

<policy class="Both" displayName="$(string.AutoSelectCertificateForUrls)" explainText="$(string.AutoSelectCertificateForUrls_Explain)" key="Software\Policies\BraveSoftware\Brave" name="AutoSelectCertificateForUrls" presentation="$(presentation.AutoSelectCertificateForUrls)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="BraveSoftware.Policies.Brave:ContentSettings" />
      <supportedOn ref="BraveSoftware.Policies.Brave:SUPPORTED_WIN7" />
      <elements>
        <list id="AutoSelectCertificateForUrlsDesc" key="Software\Policies\BraveSoftware\Brave\AutoSelectCertificateForUrls" valuePrefix="" />
      </elements>
    </policy>

<presentation id="AutoSelectCertificateForUrls" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"><listBox refId="AutoSelectCertificateForUrlsDesc">Automatically select client certificates for these sites</listBox></presentation>

BraveSoftware.Policies.Brave:category:Cat_Brave
<category displayName="$(string.Cat_Brave)" name="Cat_Brave" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
BraveSoftware.Policies.Brave:category:ContentSettings
<category displayName="$(string.ContentSettings_group)" name="ContentSettings" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="BraveSoftware.Policies.Brave:brave" />
    </category>
BraveSoftware.Policies.Brave:category:brave
<category displayName="$(string.brave)" name="brave" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="BraveSoftware.Policies.Brave:Cat_Brave" />
    </category>
BraveSoftware.Policies.Brave:definition:SUPPORTED_WIN7
<definition displayName="$(string.SUPPORTED_WIN7)" name="SUPPORTED_WIN7" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
BraveSoftware.Policies.Brave:category:Cat_Brave
<category displayName="$(string.Cat_Brave)" name="Cat_Brave" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="BraveSoftware.Policies.Brave:Cat_Brave">Brave Software</string></strings>
BraveSoftware.Policies.Brave:category:ContentSettings
<category displayName="$(string.ContentSettings_group)" name="ContentSettings" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="BraveSoftware.Policies.Brave:brave" />
    </category>
<strings><string id="BraveSoftware.Policies.Brave:ContentSettings_group">Content settings</string></strings>
BraveSoftware.Policies.Brave:category:brave
<category displayName="$(string.brave)" name="brave" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="BraveSoftware.Policies.Brave:Cat_Brave" />
    </category>
<strings><string id="BraveSoftware.Policies.Brave:brave">Brave</string></strings>
BraveSoftware.Policies.Brave:definition:SUPPORTED_WIN7
<definition displayName="$(string.SUPPORTED_WIN7)" name="SUPPORTED_WIN7" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="BraveSoftware.Policies.Brave:SUPPORTED_WIN7">Microsoft Windows 7 or later</string></strings>