> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/virtual-hsm/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/virtual-hsm/troubleshooting/role-allows-implicit-localhost-issuance.md).

# Role Allows Implicit Localhost Issuance

This health check ensures that roles do not unintentionally allow certificates to be issued for localhost-based domains. Allowing implicit localhost issuance (via `allow_localhost=true`) in combination with non-empty `allowed_domains`may pose a security risk by enabling certificates for internal or unintended hostnames.

**Health Check Name:** `role_allows_localhost`

#### **Accessed APIs**

| API Endpoint        | Description                                |
| ------------------- | ------------------------------------------ |
| `LIST /roles`       | Lists all defined roles                    |
| `READ /roles/:name` | Reads the configuration of a specific role |

**Configuration Parameters**\
\&#xNAN;*None*

**Health Check Results**

| Check Condition                                                                   | Description                                                                                  |
| --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| `allow_localhost` is set to `true`                                                | The role permits implicit certificate issuance for localhost or localhost-like domains.      |
| `allowed_domains` contains one or more entries                                    | The role allows issuance for specific domains, which may unintentionally include localhost.  |
| Both conditions (`allow_localhost=true` and non-empty `allowed_domains`) are true | A **warning** is issued, indicating a risk of unintended certificate issuance for localhost. |

**Recommended Actions**

* Set `allow_localhost=false` for all roles.
* Update the `allowed_domains` field to include **only explicitly approved domains**, avoiding vague or wildcard domain entries that could inadvertently include localhost-style hostnames.