An XCCDF Rule
cert_policy
/etc/pam_pkcs11/pam_pkcs11.conf
ocsp_on
cert_policy = ca, ocsp_on, signature;