How do you enforce certificate policy compliance with Venafi?

Policy compliance in Venafi is enforced at two points: when a certificate is requested, and continuously afterward through discovery.

1. At request time, the owning policy folder or zone rejects any CSR that violates its rules — a key size below the minimum, a disallowed CA, a validity period longer than policy permits, or a SAN entry outside an approved domain list simply can't be submitted successfully.
2. After issuance, ongoing discovery scans re-evaluate every certificate against current policy, which catches drift: a certificate that was compliant when issued but now violates an updated policy (say, the organization just lowered its maximum allowed validity period), or a certificate installed manually outside Venafi entirely that never went through a policy check in the first place.
3. Reporting and dashboards surface non-compliant certificates by owner, business unit, or risk level, so a security team can drive remediation without manually cross-referencing spreadsheets.

The combination matters because policy alone, enforced only at issuance, would miss certificates that predate the policy or were issued outside the platform — continuous discovery is what keeps the compliance picture current rather than a one-time snapshot.