@@ -323,22 +323,29 @@ toTitleCase(CertificateData.getSubjectSurname(userCertificate).orElseThrow()); /
 
 The default validator uses the platform OCSP implementation to check certificate revocation. A revoked certificate or an unsuccessful revocation check causes authentication to fail.
 
-Use `withAllowedCertificatePolicies(ASN1ObjectIdentifier... policies)` to require one of the configured certificate policies. A non-empty allow-list takes precedence over the deny-list. The deprecated `withDisallowedCertificatePolicies(ASN1ObjectIdentifier... policies)` method remains as a compatibility fallback when no allowed policies are configured. Estonian Mobile-ID policies are disallowed by default because smart-card authentication must not accept Mobile-ID certificates.
+Certificate policy allow-lists are selected by the subject certificate's exact issuer `X500Principal`. At build time, production Estonian ID-card policies from `ESTEID_ID_CARD_POLICIES` are used when the configured allow-list is empty. When one or more issuer entries are configured, only those entries are used. A matching issuer must contain one of its configured policy OIDs; other issuers fall back to the deprecated deny-list, which disallows Estonian Mobile-ID policies by default. Calling `withAllowedCertificatePolicies(issuer)` without policy OIDs removes that issuer's entry. If no entries remain, the Estonian defaults are used.
 
-For example, restrict authentication to production Estonian and European Union citizen ID cards:
+Use `withAllowedCertificatePolicies(X500Principal issuer, ASN1ObjectIdentifier... policies)` to define a custom allow-list. Repeated calls configure all supported issuers on the same validator. The following example explicitly configures both Estonian ID-card generations in one builder chain.
 
 ```java
-import static eu.webeid.security.certificate.SubjectCertificatePolicies.ESTEID_ID_CARD_POLICIES;
-
-...
-    AuthTokenValidator tokenValidator = new AuthTokenValidatorBuilder()
-            .withSiteOrigin(URI.create("https://example.org"))
-            .withTrustedCertificateAuthorities(trustedIntermediateCACertificates())
-            .withAllowedCertificatePolicies(ESTEID_ID_CARD_POLICIES)
-            .build();
-...
+AuthTokenValidator tokenValidator = new AuthTokenValidatorBuilder()
+    .withSiteOrigin(URI.create("https://example.org"))
+    .withTrustedCertificateAuthorities(trustedIntermediateCACertificates())
+    .withAllowedCertificatePolicies(
+        new X500Principal("CN=ESTEID2018,2.5.4.97=#0c0e4e545245452d3130373437303133,O=SK ID Solutions AS,C=EE"),
+        new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.1"),
+        new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.2")
+    )
+    .withAllowedCertificatePolicies(
+        new X500Principal("C=EE,O=Zetes Estonia OÜ,2.5.4.97=#0c0e4e545245452d3137303636303439,CN=ESTEID2025"),
+        new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.1"),
+        new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.2")
+    )
+    .build();
 ```
 
+For another country, add each supported issuer and its policy OIDs to the same builder chain and provide the corresponding trusted intermediate CAs.
+
 See the [certificate policy allow-list guide](readme-policy.md) for the Estonian ID-card whitelist and its rationale.
 
 For more advanced revocation requirements, supply a `CertificateRevocationChecker` with `withCertificateRevocationChecker(...)`. The [OCSP configuration guide](src/main/java/eu/webeid/ocsp/README.md) covers custom implementations, the bundled OCSP checker, custom PKIX checkers, responder selection, HTTP settings, and nonce policies.
 
@@ -6,10 +6,12 @@
 import eu.webeid.security.exceptions.JceException;
 import eu.webeid.security.validator.AuthTokenValidator;
 import eu.webeid.security.validator.AuthTokenValidatorBuilder;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.springframework.boot.test.context.TestConfiguration;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Primary;
 
+import javax.security.auth.x500.X500Principal;
 import java.net.URI;
 import java.util.List;
 
@@ -30,6 +32,13 @@ AuthTokenValidator validatorWithoutOcspCall(ValidationConfiguration validationCo
             .withSiteOrigin(URI.create(yamlConfig.getLocalOrigin()))
             .withTrustedCertificateAuthorities(validationConfiguration.loadTrustedCACertificatesFromCerFiles())
             .withTrustedCertificateAuthorities(validationConfiguration.loadTrustedCACertificatesFromTrustStore(yamlConfig))
+            .withAllowedCertificatePolicies(
+                new X500Principal(
+                    "CN=TEST of ESTEID2018,2.5.4.97=#0c0e4e545245452d3130373437303133," +
+                        "O=SK ID Solutions AS,C=EE"
+                ),
+                new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.2.1")
+            )
             // Do not call the real OCSP service in tests.
             .withCertificateRevocationChecker((subjectCertificate, issuerCertificate) -> List.of())
             .build();
 
@@ -5,6 +5,10 @@
 
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 
+import javax.security.auth.x500.X500Principal;
+import java.util.Map;
+import java.util.Set;
+
 public final class SubjectCertificatePolicies {
 
     private static final String ESTEID_SK_2015_MOBILE_ID_POLICY_PREFIX = "1.3.6.1.4.1.10015.1.3";
@@ -20,7 +24,7 @@ public final class SubjectCertificatePolicies {
 
     /**
      * Production document policies for Estonian and European Union citizen ID cards issued under the ESTEID2018
-     * and eID certificate-policy generations.
+     * and eID certificate-policy generations, grouped by issuer distinguished name.
      *
      * @see <a href="https://www.id.ee/en/article/certificate-policy-for-identity-card-digital-identity-card-residence-permit-card-and-diplomatic-identity-card-2/">
      *     ID.ee certificate policy index for Estonian identity documents</a>
@@ -39,14 +43,22 @@ public final class SubjectCertificatePolicies {
      * @see <a href="https://repository.eidpki.ee/static/documents/CertificateProfiles-20260520.pdf">
      *     ESTEID2025 certificate profile</a>
      */
-    public static final ASN1ObjectIdentifier[] ESTEID_ID_CARD_POLICIES = {
-        // ESTEID2018 / IDEMIA generation
-        new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.1"),
-        new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.2"),
-        // eID / Thales generation
-        new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.1"),
-        new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.2")
-    };
+    public static final Map<X500Principal, Set<ASN1ObjectIdentifier>> ESTEID_ID_CARD_POLICIES = Map.of(
+        new X500Principal(
+            "CN=ESTEID2018,2.5.4.97=#0c0e4e545245452d3130373437303133,O=SK ID Solutions AS,C=EE"
+        ), Set.of(
+            // ESTEID2018 / IDEMIA generation
+            new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.1"),
+            new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.2")
+        ),
+        new X500Principal(
+            "C=EE,O=Zetes Estonia OÜ,2.5.4.97=#0c0e4e545245452d3137303636303439,CN=ESTEID2025"
+        ), Set.of(
+            // eID / Thales generation
+            new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.1"),
+            new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.2")
+        )
+    );
 
     private SubjectCertificatePolicies() {
         throw new IllegalStateException("Constants class");
 
@@ -8,13 +8,17 @@
 import eu.webeid.security.validator.revocationcheck.RevocationMode;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 
+import javax.security.auth.x500.X500Principal;
 import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.security.cert.PKIXRevocationChecker;
 import java.security.cert.X509Certificate;
 import java.util.Collection;
+import java.util.HashMap;
 import java.util.HashSet;
+import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
 
 /**
@@ -24,7 +28,7 @@ public final class AuthTokenValidationConfiguration {
 
     private URI siteOrigin;
     private Collection<X509Certificate> trustedCACertificates = new HashSet<>();
-    private Collection<ASN1ObjectIdentifier> allowedSubjectCertificatePolicies = new HashSet<>();
+    private Map<X500Principal, Set<ASN1ObjectIdentifier>> allowedSubjectCertificatePolicies = new HashMap<>();
     // Don't allow Estonian Mobile-ID policy by default.
     @Deprecated(since = "4.0.0")
     private Collection<ASN1ObjectIdentifier> disallowedSubjectCertificatePolicies = new HashSet<>(Set.of(
@@ -45,7 +49,8 @@ public final class AuthTokenValidationConfiguration {
     private AuthTokenValidationConfiguration(AuthTokenValidationConfiguration other) {
         this.siteOrigin = other.siteOrigin;
         this.trustedCACertificates = Set.copyOf(other.trustedCACertificates);
-        this.allowedSubjectCertificatePolicies = Set.copyOf(other.allowedSubjectCertificatePolicies);
+        this.allowedSubjectCertificatePolicies =
+            copyAllowedSubjectCertificatePolicies(other.allowedSubjectCertificatePolicies);
         this.disallowedSubjectCertificatePolicies = Set.copyOf(other.disallowedSubjectCertificatePolicies);
         this.isUserCertificateRevocationCheckEnabled = other.isUserCertificateRevocationCheckEnabled;
         this.platformOcspNonceEnabled = other.platformOcspNonceEnabled;
@@ -66,12 +71,22 @@ Collection<X509Certificate> getTrustedCACertificates() {
         return trustedCACertificates;
     }
 
-    public Collection<ASN1ObjectIdentifier> getAllowedSubjectCertificatePolicies() {
+    public Map<X500Principal, Set<ASN1ObjectIdentifier>> getAllowedSubjectCertificatePolicies() {
         return allowedSubjectCertificatePolicies;
     }
 
-    void setAllowedSubjectCertificatePolicies(Collection<ASN1ObjectIdentifier> allowedSubjectCertificatePolicies) {
-        this.allowedSubjectCertificatePolicies = new HashSet<>(allowedSubjectCertificatePolicies);
+    void setAllowedSubjectCertificatePolicies(
+            X500Principal issuer, Collection<ASN1ObjectIdentifier> allowedSubjectCertificatePolicies) {
+        Objects.requireNonNull(issuer, "Issuer must not be null");
+        final Set<ASN1ObjectIdentifier> policies = Set.copyOf(Objects.requireNonNull(
+            allowedSubjectCertificatePolicies,
+            "Allowed certificate policies must not be null"
+        ));
+        if (policies.isEmpty()) {
+            this.allowedSubjectCertificatePolicies.remove(issuer);
+        } else {
+            this.allowedSubjectCertificatePolicies.put(issuer, policies);
+        }
     }
 
     /**
@@ -135,6 +150,16 @@ AuthTokenValidationConfiguration copy() {
         return new AuthTokenValidationConfiguration(this);
     }
 
+    private static Map<X500Principal, Set<ASN1ObjectIdentifier>> copyAllowedSubjectCertificatePolicies(
+            Map<X500Principal, ? extends Collection<ASN1ObjectIdentifier>> policiesByIssuer) {
+        final Map<X500Principal, Set<ASN1ObjectIdentifier>> copy = new HashMap<>();
+        policiesByIssuer.forEach((issuer, policies) -> copy.put(
+            Objects.requireNonNull(issuer, "Issuer must not be null"),
+            Set.copyOf(Objects.requireNonNull(policies, "Allowed certificate policies must not be null"))
+        ));
+        return copy;
+    }
+
     /**
      * Validates that the given URI is an origin URL as defined in <a href="https://developer.mozilla.org/en-US/docs/Web/API/Location/origin">MDN</a>,
      * in the form of {@code <scheme> "://" <hostname> [ ":" <port> ]}.
 
@@ -3,12 +3,14 @@
 
 package eu.webeid.security.validator;
 
+import eu.webeid.security.certificate.SubjectCertificatePolicies;
 import eu.webeid.security.exceptions.JceException;
 import eu.webeid.security.validator.revocationcheck.CertificateRevocationChecker;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import javax.security.auth.x500.X500Principal;
 import java.net.URI;
 import java.security.cert.PKIXRevocationChecker;
 import java.security.cert.X509Certificate;
@@ -62,15 +64,19 @@ public AuthTokenValidatorBuilder withTrustedCertificateAuthorities(X509Certifica
     }
 
     /**
-     * Sets the list of allowed user certificate policies.
-     * When this list is not empty, the user certificate must contain at least one allowed policy and the configured
-     * disallowed policies are ignored. When this list is empty, validation falls back to the disallowed policy list.
+     * Adds or replaces the allowed user certificate policies for the given issuer. When no policies are configured,
+     * {@link SubjectCertificatePolicies#ESTEID_ID_CARD_POLICIES} is used by default.
+     * When the subject certificate's issuer matches a configured issuer, the certificate must contain at least one
+     * of that issuer's allowed policies and the configured disallowed policies are ignored. Otherwise, validation
+     * falls back to the disallowed policy list. Passing no policies removes the issuer's allow-list entry.
      *
-     * @param policies allowed user certificate policies
+     * @param issuer exact subject certificate issuer distinguished name
+     * @param policies allowed user certificate policies for the issuer
      * @return the builder instance for method chaining
      */
-    public AuthTokenValidatorBuilder withAllowedCertificatePolicies(ASN1ObjectIdentifier... policies) {
-        configuration.setAllowedSubjectCertificatePolicies(Arrays.asList(policies));
+    public AuthTokenValidatorBuilder withAllowedCertificatePolicies(
+            X500Principal issuer, ASN1ObjectIdentifier... policies) {
+        configuration.setAllowedSubjectCertificatePolicies(issuer, Arrays.asList(policies));
         LOG.debug("Allowed subject certificate policies set to {}", configuration.getAllowedSubjectCertificatePolicies());
         return this;
     }
@@ -82,7 +88,7 @@ public AuthTokenValidatorBuilder withAllowedCertificatePolicies(ASN1ObjectIdenti
      *
      * @param policies disallowed user certificate policies
      * @return the builder instance for method chaining
-     * @deprecated Use {@link #withAllowedCertificatePolicies(ASN1ObjectIdentifier...)} instead.
+     * @deprecated Use {@link #withAllowedCertificatePolicies(X500Principal, ASN1ObjectIdentifier...)} instead.
      */
     @Deprecated(since = "4.0.0")
     public AuthTokenValidatorBuilder withDisallowedCertificatePolicies(ASN1ObjectIdentifier... policies) {
@@ -164,8 +170,13 @@ public AuthTokenValidatorBuilder withPKIXRevocationChecker(PKIXRevocationChecker
      * @throws JceException             when JCE configuration is invalid
      */
     public AuthTokenValidator build() throws IllegalArgumentException, JceException {
-        configuration.validate();
-        return new AuthTokenValidatorImpl(configuration);
+        final AuthTokenValidationConfiguration configurationSnapshot = configuration.copy();
+        if (configurationSnapshot.getAllowedSubjectCertificatePolicies().isEmpty()) {
+            configurationSnapshot.getAllowedSubjectCertificatePolicies()
+                .putAll(SubjectCertificatePolicies.ESTEID_ID_CARD_POLICIES);
+        }
+        configurationSnapshot.validate();
+        return new AuthTokenValidatorImpl(configurationSnapshot);
     }
 
 }