diff --git a/config/config.go b/config/config.go
index 4a035c78f..b5c030cf3 100644
--- a/config/config.go
+++ b/config/config.go
@@ -65,7 +65,7 @@ type SigningProfile struct {
 	NotAfter            time.Time `json:"not_after"`
 	NameWhitelistString string    `json:"name_whitelist"`
 
-	Policies      []asn1.ObjectIdentifier
+	Policies      []CertificatePolicy
 	Expiry        time.Duration
 	Backdate      time.Duration
 	Provider      auth.Provider
diff --git a/doc/api.txt b/doc/api.txt
index ecf2e1d5d..024071a40 100644
--- a/doc/api.txt
+++ b/doc/api.txt
@@ -376,6 +376,7 @@ mechanism and key "00000000000000000000000000000000".
                     "key encipherment",
                     "server auth"
                 ]
+                "name_whitelist": "^.*\\.cloudflare.com$",
                 "auth_key": "myauthkey",
                 "remote": "myremoteserver"
             }
diff --git a/testdata/good_config.json b/testdata/good_config.json
index 509c22a05..0b5342d80 100644
--- a/testdata/good_config.json
+++ b/testdata/good_config.json
@@ -9,7 +9,8 @@
                     "signing",
                     "key encipherment",
                     "server auth"
-                ]
+                ],
+                "name_whitelist": "^.*\\.cloudflare.com$"
             }
         }
     }