---
title: "Customizing policies"
description: "How to customize signature policies in PKI SDK: create your own policy or edit an existing one, such as AD-RT v2.1, and add trust arbitrators."
canonical: "https://docs.lacunasoftware.com/en-us/articles/pki-sdk/signatures/policies/customization"
locale: "en"
product: "PKI SDK"
last_updated: "2026-10-12"
---

# Customizing policies

Signature policies are a set of rules and properties that govern the creation and validation of digital signatures. PKI SDK has
policies already configured for use in signers and validators, and it is also simple to create your own policy or customize an
existing one.

## Editing a policy

The example below loads a preconfigured signature policy and edits some of its parameters.

```cs
// Loading the AD-RT v2.1 policy
var policy = BrazilCadesPolicySpec.GetAdrTempoV21();

// Including the signing-time signed attribute
policy.AttributeGeneration.IncludeSigningTime = true;

// Adding one more arbitrator to validate the signers' certificates
policy.AddTrustArbitrator(TrustArbitrators.Windows);

// Adding one more arbitrator to validate the timestamp authority's certificate
policy.SignatureTimestampPolicy.AddTrustArbitrator(new TrustedRoots(privateRoot));
```

When editing a policy, make sure its creation and validation properties don't conflict.

## Creating a policy

In the example below we create a basic implicit CAdES-BES signature policy: the policy is not signed, it is not part of the
signed attributes.

```cs
// Creating the policy
var policy = new CadesPolicySpec();

// Setting the signature creation properties
policy.AttributeGeneration = new AttributeGenerationSpec() {
    IncludeSigningTime = true,                                     // Includes signing-time in the signed attributes
    IncludeCertificatesInSignedData = InclusionLevel.WholeChain,   // Includes the whole certificate chain in the Certificates field of SignedData
    IncludeCrlsInSignedData = true,                                // Includes the CRLs used in the CRLs field of SignedData
};

// Setting the validation properties of the basic signature
policy.AttributeValidation = new AttributeValidationSpec() {
    SigningTime = ValidationRequirementLevels.May,
};

// Allowed algorithms
policy.DigestAlgorithms.Add(DigestAlgorithm.SHA256);
policy.DigestAlgorithms.Add(DigestAlgorithm.SHA1);
policy.SignatureAlgorithms.Add(SignatureAlgorithm.RSAWithSHA256);
policy.SignatureAlgorithms.Add(SignatureAlgorithm.RSAWithSHA1);

// Arbitrator to validate the signers' certificates
policy.AddTrustArbitrator(TrustArbitrators.Windows);

return policy;
```

## Creating an advanced policy

The code below is taken from an internal implementation of the SDK, to show how to create a signature policy with advanced
elements. The policy is the ICP-Brasil AD-RC v2.1.

```cs
// Creating the policy
var policy = new CadesPolicySpec();

// Setting the signature creation properties and attributes
policy.AttributeGeneration = new AttributeGenerationSpec() {
    IncludeFullPathReferenceInSigningCertificateAttribute = false,

    // Includes the policy in the signed attributes (explicit policy)
    IncludeSignaturePolicyIdentifier = true,
    SignaturePolicyQualifiers = CadesPolicySpec.SignaturePolicyQualifiers.Uri,

    SignatureTimestamp = GenerationRequirementLevels.Must,
    IncludeCompleteCertificateReferences = true,
    IncludeCompleteRevocationReferences = true,
    CadesCTimeStamp = GenerationRequirementLevels.Must,
    IncludeCertificateValues = true,
    IncludeRevocationValues = true,
};

// Setting the validation properties and the required attributes
policy.AttributeValidation = new AttributeValidationSpec() {
    SignaturePolicyIdentifier = ValidationRequirementLevels.Must,
    SigningTime = ValidationRequirementLevels.May,
    SignatureTimestamp = ValidationRequirementLevels.Must,
    CompleteCertificateReferences = ValidationRequirementLevels.Must,
    CompleteRevocationReferences = ValidationRequirementLevels.Must,
    CadesCTimeStamp = ValidationRequirementLevels.Must,
    CertificateValues = ValidationRequirementLevels.Must,
    RevocationValues = ValidationRequirementLevels.Must
};

// Allowed algorithms
policy.DigestAlgorithms.Add(DigestAlgorithm.SHA256);
policy.SignatureAlgorithms.Add(SignatureAlgorithm.RSAWithSHA256);

// Policy information
policy.PolicyOid = "<OID of the policy>";
policy.PolicyUri = new Uri("<URI of the policy>");
policy.PolicyDigest = new DigestAlgorithmAndValue(DigestAlgorithm.SHA256, adrcSha256Digest);

// Arbitrator to validate the certificates
policy.AddTrustArbitrator(TrustArbitrators.PkiBrazil);

// Period in which signatures are valid
policy.SigningPeriodStart = GetBrasilia0H(2012, 3, 6);
policy.SigningPeriodEnd = GetBrasilia24H(2023, 6, 21);


// Policy of the signature timestamp
policy.SignatureTimestampPolicy = new CadesPolicySpec() {
    AttributeGeneration = new AttributeGenerationSpec() {
        IncludeCompleteCertificateReferences = true,
        IncludeCompleteRevocationReferences = true,
        IncludeCertificateValues = true,
        IncludeRevocationValues = true
    },
    AttributeValidation = new AttributeValidationSpec() {
        SignaturePolicyIdentifier = ValidationRequirementLevels.MustNot,
        SigningTime = ValidationRequirementLevels.MustNot,
        SignatureTimestamp = ValidationRequirementLevels.MustNot,
        CompleteCertificateReferences = ValidationRequirementLevels.Must,
        CompleteRevocationReferences = ValidationRequirementLevels.Must,
        CadesCTimeStamp = ValidationRequirementLevels.MustNot,
        CertificateValues = ValidationRequirementLevels.Must,
        RevocationValues = ValidationRequirementLevels.Must,
        ArchiveTimestamp = ValidationRequirementLevels.MustNot
    },
};
policy.SignatureTimestampPolicy.DigestAlgorithms.Add(DigestAlgorithm.SHA256);
policy.SignatureTimestampPolicy.SignatureAlgorithms.Add(SignatureAlgorithm.RSAWithSHA256);
policy.SignatureTimestampPolicy.AddTrustArbitrator(TrustArbitrators.PkiBrazil);


// Policy of the references timestamp
policy.CadesCTimestampPolicy = new CadesPolicySpec() {
    AttributeGeneration = new AttributeGenerationSpec() {
        IncludeCompleteCertificateReferences = true,
        IncludeCompleteRevocationReferences = true,
        IncludeCertificateValues = true,
        IncludeRevocationValues = true
    },
    AttributeValidation = new AttributeValidationSpec() {
        SignaturePolicyIdentifier = ValidationRequirementLevels.MustNot,
        SigningTime = ValidationRequirementLevels.MustNot,
        SignatureTimestamp = ValidationRequirementLevels.MustNot,
        CompleteCertificateReferences = ValidationRequirementLevels.Must,
        CompleteRevocationReferences = ValidationRequirementLevels.Must,
        CadesCTimeStamp = ValidationRequirementLevels.MustNot,
        CertificateValues = ValidationRequirementLevels.Must,
        RevocationValues = ValidationRequirementLevels.Must,
        ArchiveTimestamp = ValidationRequirementLevels.MustNot
    },
};
policy.CadesCTimestampPolicy.DigestAlgorithms.Add(DigestAlgorithm.SHA256);
policy.CadesCTimestampPolicy.SignatureAlgorithms.Add(SignatureAlgorithm.RSAWithSHA256);
policy.CadesCTimestampPolicy.AddTrustArbitrator(TrustArbitrators.PkiBrazil);

return policy;
```