+ All Categories
Home > Documents > DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert...

DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert...

Date post: 22-Jun-2018
Category:
Upload: hanhi
View: 235 times
Download: 1 times
Share this document with a friend
58
DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25, 2018 2801 N. Thanksgiving Way Suite 500 Lehi, UT 84043 USA Tel: 1‐801‐877‐2100 Fax: 1‐801‐705‐0481 www.digicert.com
Transcript
Page 1: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

DigiCert

CertificatePolicy

DigiCert,Inc.Version4.14

January25,20182801N.ThanksgivingWay

Suite500Lehi,UT84043

USATel:1‐801‐877‐2100Fax:1‐801‐705‐0481

www.digicert.com

Page 2: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

i

TABLEOFCONTENTS1.  Introduction ............................................................................................................................................ 1 

1.1.  Overview ...................................................................................................................................... 1 1.2.  Document name and Identification ............................................................................................... 1 1.3.  PKI Participants ........................................................................................................................... 3 

1.3.1.  DigiCert Policy Authority and Certification Authorities ............................................................. 3 1.3.2.  Registration Authorities ........................................................................................................... 4 1.3.3.  Subscribers ............................................................................................................................. 4 1.3.4.  Relying Parties ........................................................................................................................ 4 1.3.5.  Other Participants ................................................................................................................... 4 

1.4.  Certificate Usage ......................................................................................................................... 4 1.4.1.  Appropriate Certificate Uses ................................................................................................... 4 1.4.2.  Prohibited Certificate Uses ...................................................................................................... 4 

1.5.  Policy administration .................................................................................................................... 5 1.5.1.  Organization Administering the Document .............................................................................. 5 1.5.2.  Contact Person ....................................................................................................................... 5 1.5.3.  Person Determining CPS Suitability for the Policy .................................................................. 5 1.5.4.  CP Approval Procedures ......................................................................................................... 5 

1.6.  Definitions and acronyms ............................................................................................................. 5 1.6.1.  Definitions ............................................................................................................................... 5 1.6.2.  Acronyms ................................................................................................................................ 6 1.6.3.  References .............................................................................................................................. 7 

2.  PUBLICATION AND REPOSITORY RESPONSIBILITIES .................................................................... 7 2.1.  Repositories ................................................................................................................................. 7 2.2.  Publication of certification information .......................................................................................... 8 2.3.  Time or frequency of publication .................................................................................................. 8 2.4.  Access controls on repositories ................................................................................................... 8 

3.  IDENTIFICATION AND AUTHENTICATION ......................................................................................... 8 3.1.  Naming ........................................................................................................................................ 8 

3.1.1.  Types of Names ...................................................................................................................... 8 3.1.2.  Need for Names to be Meaningful ........................................................................................... 8 3.1.3.  Anonymity or Pseudonymity of Subscribers ............................................................................ 8 3.1.4.  Rules for Interpreting Various Name Forms ............................................................................ 8 3.1.5.  Uniqueness of Names ............................................................................................................. 9 3.1.6.  Recognition, Authentication, and Role of Trademarks ............................................................ 9 

3.2.  Initial identity validation ................................................................................................................ 9 3.2.1.  Method to Prove Possession of Private Key ........................................................................... 9 3.2.2.  Authentication of Organization and Domain Control ............................................................... 9 3.2.3.  Authentication of Individual Identity ....................................................................................... 10 3.2.4.  Non-verified Subscriber Information ...................................................................................... 15 3.2.5.  Validation of Authority ........................................................................................................... 16 

3.3.  Identification and authentication for re-key requests .................................................................. 16 3.3.1.  Identification and Authentication for Routine Re-key ............................................................. 16 3.3.2.  Identification and Authentication for Re-key After Revocation............................................... 17 

3.4.  Identification and authentication for revocation request ............................................................. 17 4.  CERTIFICATE LIFE-CYCLE OPERATIONAL REQUIREMENTS ....................................................... 17 

4.1.  Certificate Application ................................................................................................................ 17 4.1.1.  Who Can Submit a Certificate Application ............................................................................ 17 4.1.2.  Enrollment Process and Responsibilities .............................................................................. 17 

4.2.  Certificate application processing .............................................................................................. 17 4.2.1.  Performing Identification and Authentication Functions ........................................................ 17 4.2.2.  Approval or Rejection of Certificate Applications ................................................................... 18 4.2.3.  Time to Process Certificate Applications ............................................................................... 18 

4.3.  Certificate issuance .................................................................................................................... 18 4.3.1.  CA Actions during Certificate Issuance ................................................................................. 18 4.3.2.  Notification to Subscriber by the CA of Issuance of Certificate ............................................. 18 

4.4.  Certificate acceptance ............................................................................................................... 18 4.4.1.  Conduct Constituting Certificate Acceptance ........................................................................ 18 4.4.2.  Publication of the Certificate by the CA ................................................................................. 18 4.4.3.  Notification of Certificate Issuance by the CA to Other Entities ............................................. 18 

Page 3: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

ii

4.5.  Key pair and certificate usage .................................................................................................... 18 4.5.1.  Subscriber Private Key and Certificate Usage ...................................................................... 18 4.5.2.  Relying Party Public Key and Certificate Usage .................................................................... 19 

4.6.  Certificate renewal ..................................................................................................................... 19 4.6.1.  Circumstance for Certificate Renewal ................................................................................... 19 4.6.2.  Who May Request Renewal .................................................................................................. 19 4.6.3.  Processing Certificate Renewal Requests ............................................................................ 19 4.6.4.  Notification of New Certificate Issuance to Subscriber .......................................................... 19 4.6.5.  Conduct Constituting Acceptance of a Renewal Certificate .................................................. 19 4.6.6.  Publication of the Renewal Certificate by the CA .................................................................. 19 4.6.7.  Notification of Certificate Issuance by the CA to Other Entities ............................................. 19 

4.7.  Certificate re-key ........................................................................................................................ 20 4.7.1.  Circumstance for Certificate Rekey ....................................................................................... 20 4.7.2.  Who May Request Certificate Rekey .................................................................................... 20 4.7.3.  Processing Certificate Rekey Requests ................................................................................ 20 4.7.4.  Notification of Certificate Rekey to Subscriber ...................................................................... 20 4.7.5.  Conduct Constituting Acceptance of a Rekeyed Certificate .................................................. 20 4.7.6.  Publication of the Rekeyed Certificate by the CA .................................................................. 20 4.7.7.  Notification of Certificate Issuance by the CA to Other Entities ............................................. 20 

4.8.  Certificate modification ............................................................................................................... 20 4.8.1.  Circumstance for Certificate Modification .............................................................................. 20 4.8.2.  Who May Request Certificate Modification............................................................................ 20 4.8.3.  Processing Certificate Modification Requests ....................................................................... 20 4.8.4.  Notification of Certificate Modification to Subscriber ............................................................. 21 4.8.5.  Conduct Constituting Acceptance of a Modified Certificate ................................................... 21 4.8.6.  Publication of the Modified Certificate by the CA .................................................................. 21 4.8.7.  Notification of Certificate Modification by the CA to Other Entities ........................................ 21 

4.9.  Certificate revocation and suspension ....................................................................................... 21 4.9.1.  Circumstances for Revocation .............................................................................................. 21 4.9.2.  Who Can Request Revocation .............................................................................................. 22 4.9.3.  Procedure for Revocation Request ....................................................................................... 22 4.9.4.  Revocation Request Grace Period ........................................................................................ 23 4.9.5.  Time within which CA Must Process the Revocation Request .............................................. 23 4.9.6.  Revocation Checking Requirement for Relying Parties ......................................................... 23 4.9.7.  CRL Issuance Frequency ...................................................................................................... 23 4.9.8.  Maximum Latency for CRLs .................................................................................................. 24 4.9.9.  On-line Revocation/Status Checking Availability ................................................................... 24 4.9.10.  On-line Revocation Checking Requirements .................................................................... 24 4.9.11.  Other Forms of Revocation Advertisements Available ..................................................... 24 4.9.12.  Special Requirements Related to Key Compromise ......................................................... 24 4.9.13.  Circumstances for Suspension ......................................................................................... 24 4.9.14.  Who Can Request Suspension ........................................................................................ 24 4.9.15.  Procedure for Suspension Request .................................................................................. 24 4.9.16.  Limits on Suspension Period ............................................................................................ 25 

4.10.  Certificate status services .......................................................................................................... 25 4.10.1.  Operational Characteristics .............................................................................................. 25 4.10.2.  Service Availability ........................................................................................................... 25 4.10.3.  Optional Features ............................................................................................................. 25 

4.11.  End of subscription .................................................................................................................... 25 4.12.  Key escrow and recovery ........................................................................................................... 25 

4.12.1.  Key Escrow and Recovery Policy Practices ..................................................................... 25 4.12.2.  Session Key Encapsulation and Recovery Policy and Practices ...................................... 26 

5.  FACILITY, MANAGEMENT, AND OPERATIONAL CONTROLS ........................................................ 26 5.1.  Physical Controls ....................................................................................................................... 26 

5.1.1.  Site Location and Construction ............................................................................................. 26 5.1.2.  Physical Access .................................................................................................................... 26 5.1.3.  Power and Air Conditioning ................................................................................................... 27 5.1.4.  Water Exposures ................................................................................................................... 27 5.1.5.  Fire Prevention and Protection .............................................................................................. 27 5.1.6.  Media Storage ....................................................................................................................... 27 5.1.7.  Waste Disposal ..................................................................................................................... 27 5.1.8.  Off-site Backup ...................................................................................................................... 27 

Page 4: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

iii

5.1.9.  Certificate Status Hosting, CMS and External RA Systems .................................................. 27 5.2.  Procedural controls .................................................................................................................... 27 

5.2.1.  Trusted Roles ........................................................................................................................ 27 5.2.2.  Number of Persons Required per Task ................................................................................. 28 5.2.3.  Identification and Authentication for each Role ..................................................................... 28 5.2.4.  Roles Requiring Separation of Duties ................................................................................... 28 

5.3.  Personnel controls ..................................................................................................................... 28 5.3.1.  Qualifications, Experience, and Clearance Requirements .................................................... 28 5.3.2.  Background Check Procedures ............................................................................................. 29 5.3.3.  Training Requirements .......................................................................................................... 29 5.3.4.  Retraining Frequency and Requirements .............................................................................. 29 5.3.5.  Job Rotation Frequency and Sequence ................................................................................ 30 5.3.6.  Sanctions for Unauthorized Actions ...................................................................................... 30 5.3.7.  Independent Contractor Requirements ................................................................................. 30 5.3.8.  Documentation Supplied to Personnel .................................................................................. 30 

5.4.  Audit logging procedures ........................................................................................................... 30 5.4.1.  Types of Events Recorded .................................................................................................... 30 5.4.2.  Frequency of Processing Log ................................................................................................ 32 5.4.3.  Retention Period for Audit Log .............................................................................................. 33 5.4.4.  Protection of Audit Log .......................................................................................................... 33 5.4.5.  Audit Log Backup Procedures ............................................................................................... 33 5.4.6.  Audit Collection System (internal vs. external) ...................................................................... 33 5.4.7.  Notification to Event-causing Subject .................................................................................... 33 5.4.8.  Vulnerability Assessments .................................................................................................... 33 

5.5.  Records archival ........................................................................................................................ 33 5.5.1.  Types of Records Archived ................................................................................................... 33 5.5.2.  Retention Period for Archive ................................................................................................. 34 5.5.3.  Protection of Archive ............................................................................................................. 34 5.5.4.  Archive Backup Procedures .................................................................................................. 34 5.5.5.  Requirements for Time-stamping of Records ........................................................................ 34 5.5.6.  Archive Collection System (internal or external) .................................................................... 34 5.5.7.  Procedures to Obtain and Verify Archive Information ........................................................... 35 

5.6.  Key changeover ......................................................................................................................... 35 5.7.  Compromise and disaster recovery ........................................................................................... 35 

5.7.1.  Incident and Compromise Handling Procedures ................................................................... 35 5.7.2.  Computing Resources, Software, and/or Data Are Corrupted .............................................. 35 5.7.3.  Entity Private Key Compromise Procedures ......................................................................... 35 5.7.4.  Business Continuity Capabilities after a Disaster .................................................................. 36 

5.8.  CA or RA termination ................................................................................................................. 36 6.  TECHNICAL SECURITY CONTROLS ................................................................................................ 36 

6.1.  Key pair generation and installation ........................................................................................... 36 6.1.1.  Key Pair Generation .............................................................................................................. 36 6.1.2.  Private Key Delivery to Subscriber ........................................................................................ 37 6.1.3.  Public Key Delivery to Certificate Issuer ............................................................................... 37 6.1.4.  CA Public Key Delivery to Relying Parties ............................................................................ 37 6.1.5.  Key Sizes .............................................................................................................................. 37 6.1.6.  Public Key Parameters Generation and Quality Checking .................................................... 38 6.1.7.  Key Usage Purposes (as per X.509 v3 key usage field) ....................................................... 38 

6.2.  Private Key Protection and Cryptographic Module Engineering Controls .................................. 38 6.2.1.  Cryptographic Module Standards and Controls ..................................................................... 38 6.2.2.  Private Key (n out of m) Multi-person Control ....................................................................... 39 6.2.3.  Private Key Escrow ............................................................................................................... 39 6.2.4.  Private Key Backup ............................................................................................................... 39 6.2.5.  Private Key Archival .............................................................................................................. 40 6.2.6.  Private Key Transfer into or from a Cryptographic Module ................................................... 40 6.2.7.  Private Key Storage on Cryptographic Module ..................................................................... 40 6.2.8.  Method of Activating Private Key .......................................................................................... 40 6.2.9.  Method of Deactivating Private Key ...................................................................................... 40 6.2.10.  Method of Destroying Private Key .................................................................................... 40 6.2.11.  Cryptographic Module Rating ........................................................................................... 40 

6.3.  Other aspects of key pair management ..................................................................................... 40 6.3.1.  Public Key Archival ............................................................................................................... 40 

Page 5: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

iv

6.3.2.  Certificate Operational Periods and Key Pair Usage Periods................................................ 41 6.4.  Activation data ........................................................................................................................... 42 

6.4.1.  Activation Data Generation and Installation .......................................................................... 42 6.4.2.  Activation Data Protection ..................................................................................................... 42 

6.5.  Computer security controls ........................................................................................................ 42 6.5.1.  Specific Computer Security Technical Requirements ........................................................... 42 6.5.2.  Computer Security Rating ..................................................................................................... 42 

6.6.  Life cycle technical controls ....................................................................................................... 43 6.6.1.  System Development Controls .............................................................................................. 43 6.6.2.  Security Management Controls ............................................................................................. 43 6.6.3.  Life Cycle Security Controls .................................................................................................. 43 

6.7.  Network security controls ........................................................................................................... 43 6.8.  Time-stamping ........................................................................................................................... 43 

7.  CERTIFICATE, CRL, AND OCSP PROFILES .................................................................................... 44 7.1.  Certificate profile ........................................................................................................................ 44 

7.1.1.  Version Number(s) ................................................................................................................ 44 7.1.2.  Certificate Extensions ........................................................................................................... 44 7.1.3.  Algorithm Object Identifiers ................................................................................................... 44 7.1.4.  Name Forms ......................................................................................................................... 45 7.1.5.  Name Constraints ................................................................................................................. 45 7.1.6.  Certificate Policy Object Identifier ......................................................................................... 46 7.1.7.  Usage of Policy Constraints Extension ................................................................................. 46 7.1.8.  Policy Qualifiers Syntax and Semantics ................................................................................ 46 7.1.9.  Processing Semantics for the Critical Certificate Policies Extension ..................................... 46 

7.2.  CRL profile ................................................................................................................................. 46 7.2.1.  Version number(s) ................................................................................................................. 46 7.2.2.  CRL and CRL Entry Extensions ............................................................................................ 46 

7.3.  OCSP profile .............................................................................................................................. 46 7.3.1.  Version Number(s) ................................................................................................................ 46 7.3.2.  OCSP Extensions ................................................................................................................. 47 

8.  COMPLIANCE AUDIT AND OTHER ASSESSMENTS ....................................................................... 47 8.1.  Frequency or circumstances of assessment .............................................................................. 47 8.2.  Identity/qualifications of assessor .............................................................................................. 47 8.3.  Assessor's relationship to assessed entity ................................................................................. 47 8.4.  Topics covered by assessment .................................................................................................. 47 8.5.  Actions taken as a result of deficiency ....................................................................................... 47 8.6.  Communication of results .......................................................................................................... 47 8.7.  Self-Audits ................................................................................................................................. 48 

9.  OTHER BUSINESS AND LEGAL MATTERS ...................................................................................... 48 9.1.  Fees ........................................................................................................................................... 48 

9.1.1.  Certificate Issuance or Renewal Fees ................................................................................... 48 9.1.2.  Certificate Access Fees ........................................................................................................ 48 9.1.3.  Revocation or Status Information Access Fees ..................................................................... 48 9.1.4.  Fees for Other Services ........................................................................................................ 48 9.1.5.  Refund Policy ........................................................................................................................ 48 

9.2.  Financial responsibility ............................................................................................................... 48 9.2.1.  Insurance Coverage .............................................................................................................. 48 9.2.2.  Other Assets ......................................................................................................................... 48 9.2.3.  Insurance or Warranty Coverage for End-Entities ................................................................. 48 

9.3.  Confidentiality of business information ....................................................................................... 48 9.3.1.  Scope of Confidential Information ......................................................................................... 48 9.3.2.  Information Not Within the Scope of Confidential Information ............................................... 48 9.3.3.  Responsibility to Protect Confidential Information ................................................................. 48 

9.4.  Privacy of personal information .................................................................................................. 49 9.4.1.  Privacy Plan .......................................................................................................................... 49 9.4.2.  Information Treated as Private .............................................................................................. 49 9.4.3.  Information Not Deemed Private ........................................................................................... 49 9.4.4.  Responsibility to Protect Private Information ......................................................................... 49 9.4.5.  Notice and Consent to Use Private Information .................................................................... 49 9.4.6.  Disclosure Pursuant to Judicial or Administrative Process .................................................... 49 9.4.7.  Other Information Disclosure Circumstances ........................................................................ 49 

9.5.  Intellectual property rights .......................................................................................................... 49 

Page 6: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

v

9.6.  Representations and warranties ................................................................................................ 49 9.6.1.  CA Representations and Warranties ..................................................................................... 49 9.6.2.  RA Representations and Warranties ..................................................................................... 49 9.6.3.  Subscriber Representations and Warranties ......................................................................... 49 9.6.4.  Relying Party Representations and Warranties ..................................................................... 50 9.6.5.  Representations and Warranties of Other Participants ......................................................... 50 

9.7.  Disclaimers of warranties ........................................................................................................... 50 9.8.  Limitations of liability .................................................................................................................. 50 9.9.  Indemnities ................................................................................................................................ 50 

9.9.1.  Indemnification by an Issuer CA ............................................................................................ 50 9.9.2.  Indemnification by Subscribers ............................................................................................. 50 9.9.3.  Indemnification by Relying Parties ........................................................................................ 50 

9.10.  Term and termination ................................................................................................................. 50 9.10.1.  Term ................................................................................................................................. 50 9.10.2.  Termination ...................................................................................................................... 50 9.10.3.  Effect of Termination and Survival .................................................................................... 51 

9.11.  Individual notices and communications with participants ........................................................... 51 9.12.  Amendments .............................................................................................................................. 51 

9.12.1.  Procedure for Amendment ............................................................................................... 51 9.12.2.  Notification Mechanism and Period .................................................................................. 51 9.12.3.  Circumstances under which OID Must Be Changed ........................................................ 51 

9.13.  Dispute resolution provisions ..................................................................................................... 51 9.14.  Governing law ............................................................................................................................ 51 9.15.  Compliance with applicable law ................................................................................................. 51 9.16.  Miscellaneous provisions ........................................................................................................... 52 

9.16.1.  Entire Agreement ............................................................................................................. 52 9.16.2.  Assignment ....................................................................................................................... 52 9.16.3.  Severability ....................................................................................................................... 52 9.16.4.  Enforcement (attorneys' fees and waiver of rights) ........................................................... 52 9.16.5.  Force Majeure .................................................................................................................. 52 

9.17.  Other provisions ......................................................................................................................... 52 

Page 7: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

1

1. INTRODUCTION

1.1. OVERVIEWThisCertificatePolicy(CP)definestheproceduralandoperationalrequirementsthatDigiCertrequiresentitiestoadheretowhenissuingandmanagingdigitallysignedobjects(digitalCertificatesandtime‐stamptokens)withinDigiCert’sPKI,excludingparticipantsinDigiCert’sPrivatePKIservices,whicharenotcross‐certifiedorpubliclytrusted.SpecificrequirementsregardingthoseCertificatesaresetforthintheindividualagreementswiththeappropriateDigiCertcustomer.DigiCert’sCertificateandtime‐stamppoliciesarecontrolledbytheDigiCertPolicyAuthority(DCPA)thatdetermineshowthisCPappliestoCertificateAuthorities(CAs),RegistrationAuthorities(RAs),Subscribers,RelyingPartiesandotherPKIentitiesthatinteroperatewithorwithintheDigiCertPKI.ThisdocumentspecifiesthepoliciesDigiCertadoptstomeetthecurrentversionsofthefollowingpolicies,guidelines,andrequirements:

theFederalBridgeCertificationAuthority(“FBCA”)CertificatePolicy, theCertificationAuthority/BrowserForum("CABForum")BaselineRequirementsforthe

IssuanceandManagementofPublicly‐TrustedCertificates(“BaselineRequirements”)locatedathttps://cabforum.org/baseline‐requirements‐documents,

theCABForumGuidelinesforExtendedValidationCertificates(“EVGuidelines”)locatedathttps://cabforum.org/extended‐validation,

theCABForumGuidelinesfortheIssuanceandManagementofExtendedValidationCodeSigningCertificates,and

MinimumRequirementsfortheIssuanceandManagementofPublicly‐TrustedCodeSigningCertificates(“MinimumRequirementsforCodeSigning”)locatedathttps://aka.ms/csbr.

WithregardtoSSL/TLSServerCertificatesorCodeSigningCertificates,ifanyinconsistencyexistsbetweenthisCPandtherequirementsandguidelinesabove,thentheCABForumrequirementsandguidelinesabovetakeprecedence.Time‐stampingpoliciesareinaccordancewithIETFRFC3161,X9.95,ETSI102023,andETSI101861technicalstandards.ThisCPisonlyoneofseveraldocumentsthatgoverntheDigiCertPKI.OtherimportantdocumentsincludeCertificationPracticeStatements,registrationauthorityagreementsandpracticestatements,subscriberagreements,relyingpartyagreements,customeragreements,privacypolicies,andmemorandaofagreement.DigiCertmaypublishadditionalcertificatepoliciesorcertificationpracticestatementsasnecessarytodescribeotherproductandserviceofferings.Thesesupplementalpoliciesandstatementsareavailabletoapplicableusersorrelyingparties.PursuanttotheIETFPKIXRFC3647CP/CPSframework,thisCPisdividedintoninepartsthatcoverthesecuritycontrolsandpracticesandproceduresforcertificateortime‐stampingserviceswithintheDigiCertPKI.TopreservetheoutlinespecifiedbyRFC3647,sectionheadingsthatdonotapplyhavethestatement"Notapplicable"or"Nostipulation."

1.2. DOCUMENTNAMEANDIDENTIFICATIONThisdocumentistheDigiCertCertificatePolicyandwasapprovedforpublicationon2August2010bytheDigiCertPolicyAuthority(DCPA).Thefollowingrevisionshavebeenmadetotheoriginaldocument:

Date Changes Version25‐January‐2018 AddedlanguagebasedontheCABForum’sBaseline

Requirements,asindicatedbyMozilla’sSelf‐Assessmentprocess

4.14

8‐November‐2017 MadeeditstoconformCPwithCPS andtoclarifyprovisions. 4.13

Page 8: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

2

Alsoaddedprovisionconcerning theprocessingof CAArecords.

8‐September‐2017 RemovedreferencestoPIV‐Ithroughout,conflictsofinterestinsection5.2.1,auditorqualificationsinsection8.2,andmadeotherminorchanges.

4.12

23‐February‐2017 Updatedaddress,maderevisionsrelatedtotheMinimumRequirementsfortheIssuanceandManagementofPublicly‐TrustedCodeSigningCertificates,andmadeotherchangestoupdatetheCP.

4.11

9‐September‐2016 Updatedto clarifyIDdocumentsallowedandforconsistencywithFBCACP2.29,andsec.9.6.3ofBaselineRequirements

4.10

1‐June‐2015 UpdatedforconsistencywithCA/BrowserForumBaselineRequirementsandnewFederalPIV‐IProfilereference

4.09

1‐April‐2015 MadeadditionalchangesbasedonFPKICPWGreview. 4.087‐October‐2014 UpdatedforconsistencywithFBCACPv.2.27 4.0714‐May‐2014 UpdatedtocomplywithchangestoBaselineRequirements

andtheEVGuidelines.4.06

2‐May‐2013 Updatedmailingaddress,removedreferencestoAdobeCDSProgram,revisedexplanationofLevel2identificationrequirements,revisedprivatekeymanagementprovisionsandkeyceremonywitnessrequirements.

4.05

10‐May‐2012 UpdatedtoincludeprovisionssetforthintheBaselineRequirements,toaddEVCodeSigning,improvereadability,andtomodifyrequirementsrelatedtoIGTFCertificates.

4.04

3‐May‐2011 PolicyOIDsrevisedforcertaincertificatetypesandminorupdatesmadetovarioussections.

4.03

29‐October‐2010 ChangesmadeinresponsetocommentsfromtheFPKICPWGregardingcertificatestatusservices,trustedroles,andoff‐sitebackupofarchive.

4.02

26‐August‐2010 Updatedtheprocessusedtoauthenticate thecertificaterequester’sauthorityundersection3.2.5forcodesigningcertificatesissuedtoorganizations

4.01

2‐August‐2010 Thisversion4.0replacestheDigiCertCertificatePolicyandCertificationPracticesStatement,Version3.08,datedMay29,2009.

4.0

TheOIDforDigiCertisjoint‐iso‐ccitt(2)country(16)USA(840)US‐company(1)DigiCert(114412).DigiCertorganizesitsOIDarcsforthevariousCertificatesanddocumentsdescribedinthisCPasfollows:

DigitallySignedObject ObjectIdentifier(OID)PolicyDocuments 2.16.840.1.114412.0 ThisCPDocument 2.16.840.1.114412.0.1.4CertificatesissuedpursuanttoCPS 2.16.840.1.114412.0.2.4NonEVSSL/TLSServerCertificates 2.16.840.1.114412.1 Organization‐ValidatedSSL/TLS Certificate* 2.16.840.1.114412.1.1Domain‐ValidatedSSL/TLSCertificate* 2.16.840.1.114412.1.2Hotspot2.0OSUServerCertificates 2.16.840.1.114412.1.5 FederatedDeviceCertificate 2.16.840.1.114412.1.11 FederatedDeviceHardwareCertificate 2.16.840.1.114412.1.12ExtendedValidationSSL/TLSCertificates* 2.16.840.1.114412.2.1ObjectSigningCertificates 2.16.840.1.114412.3 CodeSigning 2.16.840.1.114412.3.1 MinimumRequirementsforCodeSigning 2.16.840.1.114412.3.1.1

Page 9: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

3

ExtendedValidationCodeSigning* 2.16.840.1.114412.3.2 WindowsKernelDriverSigning 2.16.840.1.114412.3.11 AdobeSigningCertificates 2.16.840.1.114412.3.21ClientCertificateOIDarc 2.16.840.1.114412.4. Level1Certificates–Personal 2.16.840.1.114412.4.1.1 Level1Certificates–Enterprise 2.16.840.1.114412.4.1.2 Level2Certificates 2.16.840.1.114412.4.2 Level3Certificates–US 2.16.840.1.114412.4.3.1 Level3Certificates–CBP 2.16.840.1.114412.4.3.2 Level4Certificates–US 2.16.840.1.114412.4.4.1 Level4Certificates–CBP 2.16.840.1.114412.4.4.2GridCertificates 2.16.840.1.114412.4.31or

2.16.840.1.114412.31(Grid‐onlyarc)IGTF‐ComparabletoClassicwithSecuredInfrastructure

2.16.840.1.114412.4.31.1(Clientw/Public)or2.16.840.1.114412.31.4.1.1(ClientGridOnly)

IGTF‐ComparabletoMember‐IntegratedCredentialServiceswithSecuredInfrastructure

2.16.840.1.114412.4.31.5

IGTFGridHost‐PublicTrust 2.16.840.1.114412.1.31.1Grid‐OnlyHostCertificate 2.16.840.1.114412.31.1.1.1

Authentication‐OnlyCertificates 2.16.840.1.114412.6Legacyarc 2.16.840.1.114412.81Testarc 2.16.840.1.114412.99

*AlsogovernedbyguidelinesoftheCA/BrowserForum.ThisCPappliestoanyentityassertingoneormoreoftheDigiCertOIDsidentifiedabove.WhenaCAissuesaCertificatecontainingoneoftheabove‐specifiedpolicyidentifiers,itassertsthattheCertificatewasissuedandismanagedinaccordancewiththerequirementsapplicabletothatrespectivepolicy.AllotherOIDsmentionedabovebelongtotheirrespectiveowners.CommercialBestPractices(“CBP”)differsfrom“US”inthattherearenotrustedrolecitizenshiprequirementsforanIssuerCAissuingunderaCBPpolicy,whereaspoliciesdesignated“US”mustfollowthecitizenshippracticessetforthinSection5.3.1ofthisCP.TheLegacyarcexiststoidentifyCertificatesissuedforpurposeofachievingcompatibilitywithlegacysystemsthatareincapableofprocessingneweralgorithmsthatmightberequiredbycomparableindustrybestpractices.SubsequentrevisionstothisCPmightcontainnewOIDassignmentsforthecertificatetypesidentifiedabove.

1.3. PKIPARTICIPANTS

1.3.1. DigiCertPolicyAuthorityandCertificationAuthoritiesDigiCertRootCertificateAuthoritiesandIntermediateCAsaremanagedbytheDigiCertPolicyAuthority(DCPA)whichiscomposedofmembersofDigiCertmanagementappointedbyDigiCert’sexecutivemanagement.TheDCPAisresponsibleforthisCP,theapprovalofrelatedpracticestatements,andoverseeingtheconformanceofCApracticeswiththisCP.DigiCert’spoliciesaredesignedtoensurethattheDigiCertPKIcomplies,inallmaterialrespects,withU.S.andinternationalstandardsandregulations,includingtheFederalBridgeCertificatePolicy,CA/BrowserForumGuidelines,andrelevantlawonelectronicsignatures.DigiCertmayestablishorrecognizeotherCAs(e.g.subordinateCAs)inaccordancewiththisCP,applicablecross‐certification/

Page 10: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

4

federationpoliciesandmemorandaofagreement.Foreaseofreferenceherein,allCAsissuingCertificatesinaccordancewiththisCP(includingDigiCert)arehereafterreferredtoas“IssuerCAs.”DigiCertshallnotifytheU.S.FederalPKIPolicyAuthority(FPKIPA)priortoissuinganyCACertificatetoanexternalIssuerCAthatDigiCertdesirestochaintotheFederalBridgeCA.

1.3.2. RegistrationAuthoritiesRegistrationAuthorities(RA)operateidentitymanagementsystems(IdMs)andcollectandverifySubscriberinformationontheIssuerCA’sbehalf.TherequirementsinthisCPapplytoallRAs.AnIssuerCAshallmonitoreachRA’scompliancewiththispolicy,theCPS,andifapplicable,anyRegistrationPracticesStatement(RPS)underwhichtheRAoperates.AnIssuerCAthatreliesonavarietyofRAsorIdMstosupportvariouscommunitiesofinterestmaysubmitanRPSforeachRAorIdMtotheDCPAforapproval.TheRPSmustcontaindetailsnecessaryfortheDCPAtodeterminehowtheRAachievescompliancewiththisPolicy.NecessarydetailsincludehowtheRA’sprocessorIdMestablishestheidentitiesofapplicants,howtheintegrityandauthenticityofsuchidentifyinginformationissecurelymaintainedandmanaged,andhowchangesandupdatestosuchinformationarecommunicatedtotheIssuerCA.

1.3.3. SubscribersSubscribersuseDigiCert’sservicesandPKItosupporttransactionsandcommunications.SubscribersarenotalwaysthepartyidentifiedinaCertificate,suchaswhenCertificatesareissuedtoanorganization’semployees.TheSubjectofaCertificateisthepartynamedintheCertificate.ASubscriber,asusedherein,referstoboththesubjectoftheCertificateandtheentitythatcontractedwiththeIssuerCAfortheCertificate’sissuance.PriortoverificationofidentityandissuanceofaCertificate,aSubscriberisanApplicant.

1.3.4. RelyingPartiesRelyingPartiesareentitiesthatactinrelianceonaCertificateand/ordigitalsignatureissuedbytheIssuerCA.RelyingpartiesmustchecktheappropriateCRLorOCSPresponsepriortorelyingoninformationfeaturedinaCertificate.

1.3.5. OtherParticipantsOtherparticipantsincludeBridgeCAsandCAsthatcross‐certifyIssuerCAstoprovidetrustamongotherPKIcommunities.

1.4. CERTIFICATEUSAGEAdigitalCertificate(orCertificate)isformatteddatathatcryptographicallybindsanidentifiedsubscriberwithaPublicKey.AdigitalCertificateallowsanentitytakingpartinanelectronictransactiontoproveitsidentitytootherparticipantsinsuchtransaction.DigitalCertificatesareusedincommercialenvironmentsasadigitalequivalentofanidentificationcard.Atime‐stamptoken(TST)cryptographicallybindsarepresentationofdatatoaparticulartimestamp,thusestablishingevidencethatthedataexistedatacertainpointintime.

1.4.1. AppropriateCertificateUsesCertificatesissuedunderthisCPmaybeusedforthepurposesdesignatedinthekeyusageandextendedkeyusagefieldsfoundintheCertificate.However,thesensitivityoftheinformationprocessedorprotectedbyaCertificatevariesgreatly,andeachRelyingPartymustevaluatetheapplicationenvironmentandassociatedrisksbeforedecidingonwhethertouseaCertificateissuedunderthisCP.

1.4.2. ProhibitedCertificateUsesCertificatesdonotguaranteethattheSubjectistrustworthy,honest,reputableinitsbusinessdealings,safetodobusinesswith,orcompliantwithanylaws.ACertificateonlyestablishesthattheinformationintheCertificatewasverifiedasreasonablycorrectwhentheCertificateissued.Code

Page 11: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

5

signingCertificatesdonotindicatethatthesignedcodeissafetoinstallorisfreefrommalware,bugs,orvulnerabilities.

1.5. POLICYADMINISTRATION

1.5.1. OrganizationAdministeringtheDocumentThisCPandthedocumentsreferencedhereinaremaintainedbytheDCPA,whichcanbecontactedat:

DigiCertPolicyAuthoritySuite5002801N.ThanksgivingWayLehi,UT84043USATel:1‐801‐701‐9600Fax:1‐801‐705‐[email protected]

1.5.2. ContactPersonAttn:LegalCounselDigiCertPolicyAuthoritySuite5002801N.ThanksgivingWayLehi,[email protected]

1.5.3. PersonDeterminingCPSSuitabilityforthePolicyTheDCPAdeterminesthesuitabilityandapplicabilityofthisCPandtheconformanceofaCPStothisCPbasedontheresultsandrecommendationsreceivedfromanindependentauditor(seeSection8).TheDCPAisalsoresponsibleforevaluatingandactingupontheresultsofcomplianceaudits.

1.5.4. CPApprovalProceduresTheDCPAapprovestheCPandanyamendments.AmendmentsaremadebyeitherupdatingtheentireCPorbypublishinganaddendum.TheDCPAdetermineswhetheranamendmenttothisCPrequiresnoticeoranOIDchange.SeealsoSection9.10andSection9.12below.

1.6. DEFINITIONSANDACRONYMS

1.6.1. Definitions“AffiliatedOrganization”meansanorganizationthathasanorganizationalaffiliationwithaSubscriberandthatapprovesorotherwiseallowssuchaffiliationtoberepresentedinaCertificate.“Applicant”meansanentityapplyingforacertificate.“AuditPeriod”meansaninaperiod‐of‐timeaudit,theperiodbetweenthefirstday(start)andthelastdayofoperations(end)coveredbytheauditorsintheirengagement.(Thisisnotthesameastheperiodoftimewhentheauditorsareon‐siteattheCA.)Thecoveragerulesandmaximumlengthofauditperiodsarediscussedinsection8.1.

Page 12: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

6

“BaseDomainName”isasdefinedintheBaselineRequirements.“Certificate”meansanelectronicdocumentthatusesadigitalsignaturetobindaPublicKeyandanidentity.“DomainName”isasdefinedintheBaselineRequirements.“DomainNamespace”isasdefinedintheBaselineRequirements. “EVGuidelines”isdefinedinsection1.1.“KeyPair”meansaPrivateKeyanditsassociatedPublicKey.“OCSPResponder”meansanonlinesoftwareapplicationoperatedundertheauthorityofDigiCertandconnectedtoitsrepositoryforprocessingcertificatestatusrequests.“PrivateKey”meansthekeyofaKeyPairthatiskeptsecretbytheholderoftheKeyPair,andthatisusedtocreatedigitalsignaturesand/ortodecryptelectronicrecordsorfilesthatwereencryptedwiththecorrespondingPublicKey.“PublicKey”meansthekeyofaKeyPairthatmaybepubliclydisclosedbytheholderofthecorrespondingPrivateKeyandthatisusedbyaRelyingPartytoverifydigitalsignaturescreatedwiththeholder'scorrespondingPrivateKeyand/ortoencryptmessagessothattheycanbedecryptedonlywiththeholder'scorrespondingPrivateKey.“QualifiedCertificate”meansaCertificatethatmeetstherequirementsofEUlawandisprovidedbyanIssuerCAmeetingtherequirementsofEUlaw.“RelyingParty”meansanentitythatreliesuponeithertheinformationcontainedwithinaCertificateoratime‐stamptoken.“RelyingPartyAgreement”meansanagreementwhichmustbereadandacceptedbytheRelyingPartypriortovalidating,relyingonorusingaCertificateoraccessingorusingDigiCert’sRepository.“SecureSignatureCreationDevice”meansasignature‐creationdevicethatmeetstherequirementslaiddowninEUlaw.“Subscriber”meanseithertheentityidentifiedasthesubjectintheCertificateortheentityreceivingDigiCert’stime‐stampingservices.“SubscriberAgreement”meansanagreementthatgovernstheissuanceanduseofaCertificatethattheApplicantmustreadandacceptbeforereceivingaCertificate.“WebTrust”meansthecurrentversionofCPACanada’sWebTrustProgram(s)forCertificationAuthorities.

1.6.2. AcronymsCA CertificateAuthorityorCertificationAuthorityCAA CertificationAuthorityAuthorizationCAB CA/Browserasin“CABForum”CBP CommercialBestPracticesCMS CardManagementSystemCP CertificatePolicyCPS CertificationPracticeStatement

Page 13: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

7

CRL CertificateRevocationListCSR CertificateSigningRequestDCPA DigiCertPolicyAuthorityDV DomainValidatedETSI EuropeanTelecommunicationsStandardsInstituteEU EuropeanUnionEV ExtendedValidationFIPS (USGovernment)FederalInformationProcessingStandardFQDN FullyQualifiedDomainNameHSM HardwareSecurityModuleHTTP HypertextTransferProtocolIANA InternetAssignedNumbersAuthorityICANN InternetCorporationforAssignedNamesandNumbersIdM IdentityManagementSystemIETF InternetEngineeringTaskForceIGTF InternationalGridTrustFederationITU InternationalTelecommunicationUnionITU‐T ITUTelecommunicationStandardizationSectorMICS Member‐IntegratedCredentialService(IGTF)OCSP OnlineCertificateStatusProtocolOID ObjectIdentifierOV OrganizationValidatedPIN PersonalIdentificationNumber(e.g.asecretaccesscode)PKI PublicKeyInfrastructurePKIX IETFWorkingGrouponPublicKeyInfrastructurePKCS PublicKeyCryptographyStandardRA RegistrationAuthorityRFC RequestforComments(atIETF.org)SHA SecureHashingAlgorithmSSCD SecureSignatureCreationDeviceSSL SecureSocketsLayerTLD Top‐LevelDomainTLS TransportLayerSecurityURL UniformResourceLocatorUTC CoordinatedUniversalTimeX.509 TheITU‐TstandardforCertificatesandtheircorrespondingauthentication

framework

1.6.3. References

CA/BrowserForumBaselineRequirementsCertificatePolicyfortheIssuanceandManagementofPublicly‐TrustedCertificates(“BaselineRequirements”)CA/BrowserForumGuidelinesfortheIssuanceandManagementofExtendedValidationCertificates(“EVGuidelines”)

2. PUBLICATIONANDREPOSITORYRESPONSIBILITIES

2.1. REPOSITORIESIssuerCAsshallpublishallpubliclytrustedCACertificatesandcross‐Certificates,issuedtoandfromtheIssuerCA,revocationdataforissueddigitalCertificates,CP,CPS,andstandardRelyingPartyAgreementsandSubscriberAgreementsinonlinerepositories.TheIssuerCAshallensurethatitsrootCertificateandtherevocationdataforissuedCertificatesareavailablethrougharepository

Page 14: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

8

24hoursaday,7daysaweekwithaminimumof99%availabilityoverallperyearwithascheduleddowntimethatdoesnotexceed0.5%annually.TheIssuerCAshalldevelop,implement,enforce,andannuallyupdatetheCPand/orCPSthatdescribesindetailhowtheCAimplementsthelatestversionoftheBaselineRequirements.

2.2. PUBLICATIONOFCERTIFICATIONINFORMATIONIssuerCAsshallmakethefollowinginformationpubliclyaccessibleontheweb:allpubliclytrustedrootCertificates,crossCertificates,CRLs,CPsandCPSs.PointerstorepositoryinformationinCAandendentityCertificatesshallonlycontainvalidUniformResourceIdentifiers(URIs)thatareaccessiblebyrelyingparties.

2.3. TIMEORFREQUENCYOFPUBLICATIONIssuerCAsshallpublishCACertificatesandrevocationdataassoonaspossibleafterissuance.IssuerCAsshallpublishnewormodifiedversionsCPSswithinsevendaysoftheirapproval.

2.4. ACCESSCONTROLSONREPOSITORIESInformationpublishedinarepositoryispublicinformation.TheIssuerCAshallprovideunrestrictedreadaccesstoitsrepositoriesandshallimplementlogicalandphysicalcontrolstopreventunauthorizedwriteaccesstosuchrepositories.

3. IDENTIFICATIONANDAUTHENTICATION

3.1. NAMING

3.1.1. TypesofNamesIssuerCAsshallissueCertificateswithanon‐nullsubjectDistinguishedName(DN)thatcomplieswithITUX.500standards.Level1CertificatesmayincludeanullsubjectDNiftheyincludeatleastonealternativenameformthatismarkedcritical.SubjectAlternateNameformsmaybeincludedinCertificatesiftheyaremarkednon‐critical.WhenDNsareused,commonnamesmustrespectnamespaceuniquenessandmustnotbemisleading.IssuerCAsshallcomplywithsection3.1.2ofRFC3739whenprovidingEUQualifiedCertificates.

3.1.2. NeedforNamestobeMeaningfulWhenapplicable,IssuerCAsshallusedistinguishednamestoidentifyboththeentity(i.e.person,organization,device,orobject)thatisthesubjectoftheCertificateandtheentitythatistheissueroftheCertificate.Directoryinformationtreesshallaccuratelyreflectorganizationalstructures.Whenapplicable,IssuerCAsshallensurethateachUserPrincipalName(UPN)isuniqueandaccuratelyreflectsorganizationalstructures.

3.1.3. AnonymityorPseudonymityofSubscribersIssuerCAsmayissueend‐entityanonymousorpseudonymousCertificatesprovidedthat(i)suchCertificatesarenotprohibitedbyapplicablepolicy(e.g.forcertificatetype,assurancelevel,orcertificateprofile)and(ii)namespaceuniquenessispreserved.

3.1.4. RulesforInterpretingVariousNameFormsDistinguishedNamesinCertificatesareinterpretedusingX.500standardsandASN.1syntax.SeeRFC2253andRFC2616forfurtherinformationonhowX.500distinguishednamesinCertificatesareinterpretedasUniformResourceIdentifiersandHTTPreferences.

Page 15: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

9

3.1.5. UniquenessofNamesNameuniquenessisrequiredineachCertificateissuedbyeachCA.TheDCPAmayenforcenameuniquenessbyrequiringthateachCertificateincludeauniqueserialnumberthatisincorporatedaspartofthesubjectname.

3.1.6. Recognition,Authentication,andRoleofTrademarksSubscribersmaynotrequestCertificateswithanycontentthatinfringestheintellectualpropertyrightsofanotherentity.Unlessotherwisespecificallystated,thisCPdoesnotrequireanIssuerCAtoverifyanApplicant’srighttouseatrademark.IssuerCAsmayrejectanyapplicationorrequirerevocationofanyCertificatethatispartofatrademarkdispute.

3.2. INITIALIDENTITYVALIDATIONAnIssuerCAmayuseanylegalmeansofcommunicationorinvestigationtoascertaintheidentityofanorganizationalorindividualApplicant.TheIssuerCAmayrefusetoissueaCertificateinitssolediscretion.

3.2.1. MethodtoProvePossessionofPrivateKeyTheIssuerCAshallverifythattheApplicantpossessesthePrivateKeycorrespondingtothePublicKeyinthecertificaterequest.TheIssuerCAshallrequirethatPrivateKeysforEUQualifiedCertificatebegeneratedintheSubscriber’spresenceonaSecureSignatureCreationDevice(SSCD)(OID0.4.0.1456.1.1)andstoredsecurelyontheSSCDwithaSubscriber‐selectedPIN.

3.2.2. AuthenticationofOrganizationandDomainControlDomainnamesincludedinapubliclytrustedSSL/TLSCertificatemustbeverifiedinaccordancewithSection3.2.2.4oftheBaselineRequirements.Ifapublicly‐trustedSSL/TLSCertificatewillcontainanorganization’sname,thentheIssuerCA(oranRA)shallverifytheinformationabouttheorganizationanditslegalexistenceinaccordancewithSection3.2.2.1oftheBaselineRequirementsusingreliablethirdpartyandgovernmentdatabasesorthroughotherdirectmeansofcommunicationwiththeentityorjurisdictiongoverningtheorganization’slegalcreation,existence,orrecognition.IftherequestisforaCertificatethatassertsanorganizationalaffiliationbetweenahumansubscriberandanorganization,theIssuerCAshallobtaindocumentationfromtheorganizationthatrecognizestheaffiliationandobligatestheorganizationtorequestrevocationoftheCertificateifthataffiliationends.SeeSections3.2.5,4.9.1and9.6.1.IftheFQDNcontainsawildcardcharacter,thentheIssuerCAmustremoveallwildcardlabelsfromtheleftmostportionofrequestedFQDN.TheCAmayprunezeroormorelabelsfromlefttorightuntilencounteringaBaseDomainNameandmayuseanyoneoftheintermediatevaluesforthepurposeofdomainvalidation.BeforeissuingacertificatewithawildcardcharacterinaCNorsubjectAltNameofatypeDNS‐ID,theCAmustfollowadocumentedprocedurethatdeterminesifthewildcardcharacteroccursinthefirstlabelpositiontotheleftofa“registry‐controlled”labelor“publicsuffix”(e.g.“*.com”,“*.co.uk”,seeRFC6454Section8.2forfurtherexplanation).Ifawildcardwouldfallwithinthelabelimmediatelytotheleftofaregistry‐controlledorpublicsuffix,theIssuerCAmustrefuseissuanceunlesstheapplicantprovesitsrightfulcontroloftheentireDomainNamespace.IssuerCAsmustcompleteallDomain/IPAddressvalidationprocedures—suchvalidationproceduresmustnotbecompletedbythirdparties.

Page 16: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

10

ForaCertificateissuedtoaDomainNamewith.onionintheright‐mostlabeloftheDomainName,theIssuerCAconfirms,asofthedatetheCertificatewasissued,theApplicant’scontroloverthe.onionDomainNameinaccordancewithAppendixFoftheEVGuidelines.IssuerCAsandRAsshallidentifyhigh‐riskcertificaterequestsandshallconductadditionalverificationactivityandtakeadditionalprecautionsasarereasonablynecessarytoensurethathigh‐riskrequestsareproperlyverified.AllrequestsforIssuerCACertificatesorCertificateswithanorganization’snamethatarecross‐certifiedwiththeFBCAshallincludetheorganizationname,address,anddocumentationoftheexistenceoftheorganization.ForIssuerCACertificatesandCAcross‐Certificates,representativesoftheDCPAverifytheinformation,inadditiontotheauthenticityoftherequestingrepresentativeandtherepresentative’sauthorizationfortheCertificate.

3.2.3. AuthenticationofIndividualIdentityTheIssuerCAoranRAshallverifyanindividual’sidentityinaccordancewiththeprocessestablishedinitsCPSorRPSthatmeetsthefollowingminimumrequirements:

Certificate IdentityVerificationSSL/TLSServerCertificatesandObjectSigningCertificates(issuedtoanIndividual)

TheApplicantshallsubmitalegiblecopy,whichdiscerniblyshowstheApplicant’sface,ofatleastonecurrentlyvalidgovernment‐issuedphotoID(passport,driverslicense,militaryID,nationalID,orequivalentdocumenttype).Thecopyofthedocumentshallbeinspectedforanyindicationofalterationorfalsification.ForObjectSigningCertificates,theIssuerCAorRAshallobtainaface‐to‐faceidentificationoftheApplicant(i.e.aDeclarationofIdentity),whichmaybeperformedviaavideoconferencecall.IftheIssuerCAorRArequiresfurtherassurance,theApplicantshallprovideadditionalformsofidentification,includingnon‐photoandnon‐governmentalformsofidentificationsuchasrecentutilitybills,financialaccountstatements,Applicantcreditcard,additionalIDcredential,orequivalentdocumenttype.TheIssuerCAorRAshallconfirmthattheApplicantisabletoreceivecommunicationbytelephone,postalmail/courier,orfax.IftheIssuerCAorRAcannotverifytheApplicant’sidentityusingtheproceduresdescribedabove,thentheIssuerCAorRAshallobtainaDeclarationofIdentity*witnessedandsignedbyaRegistrationAuthority,TrustedAgent,notary,lawyer,accountant,postalcarrier,oranyentitycertifiedbyaStateorNationalGovernmentasauthorizedtoconfirmidentities.

DeviceCertificateSponsors

Seesection3.2.3.3

EVSSL/TLSCertificatesissuedtoaBusinessEntity

AsspecifiedintheEVGuidelines

Authentication‐OnlyCertificates

Theentitycontrollingthesecurelocationrepresentsthatthecertificateholderhasauthorizationtoaccessthelocation.

Page 17: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

11

Grid‐onlyCertificates EithertheRAresponsibleforthegridcommunityoraTrustedAgentmusteitherreviewanidentitydocumentduringaface‐to‐facemeetingwiththeApplicant,oraTrustedAgentmustattestthattheApplicantispersonallyknowntotheTrustedAgent.Ifanidentificationdocumentisused,theRAmustretainsufficientinformationabouttheApplicant’sidentityinordertoverifytheApplicantatalaterdate.

Level1ClientCertificates–Personal(emailcertificates)

Applicant’scontroloveranemailaddress(oranyoftheidentityverificationmethodslistedforahigherlevelclientcertificate).

Level1ClientCertificates‐Enterprise(emailcertificates)

Anyoneofthefollowing:

1.In‐personappearancebeforeanRAorTrustedAgentwithpresentmentofanidentitycredential(e.g.,driver'slicenseorbirthcertificate).

2.Usingproceduressimilartothoseusedwhenapplyingforconsumercreditandauthenticatedthroughinformationinconsumercreditdatabasesorgovernmentrecords,suchas:

‐theabilitytoplaceorreceivecallsfromagivennumber;or‐theabilitytoobtainmailsenttoaknownphysicaladdress.

3.Throughinformationderivedfromanongoingbusinessrelationshipwiththecredentialproviderorapartnercompany(e.g.,afinancialinstitution,airline,employer,orretailcompany).Acceptableinformationincludes:

‐theabilitytoobtainmailatthebillingaddressusedinthebusinessrelationship;or‐verificationofinformationestablishedinprevioustransactions(e.g.,previousordernumber);or‐theabilitytoplacecallsfromorreceivephonecallsataphonenumberusedinpreviousbusinesstransactions.4.AnymethodrequiredtoverifyidentityforissuanceofaLevel2,3,or4ClientCertificate

Level2ClientCertificates

ThislevelofassurancerequiresthattheIssuerCAorRAverifytheApplicant’sidentityusingthepossessionofareliableformofidentification.PersonalidentifyinginformationshallbecomparedwithApplicant‐providedinformationtoconfirmthattheassertednamematches:(a) thenamecontainedinthepresentedidentificationcredential;(b) theindividual’sdateofbirth;and(c) acurrentaddressorpersonaltelephonenumbersufficienttoidentifyauniqueindividual.TheIssuerCAorRAshallverifytheApplicant’sidentityusingoneofthefollowingfour(4)methods:1.In‐personproofingbeforeanRAorTrustedAgent(orentitycertifiedbyaStateorNationalGovernmentasauthorizedtoconfirmidentities)withpresentmentofavalidcurrentgovernment‐issuedidentitydocumentthatcontainstheApplicant’spictureandeitheraddressofrecordornationality(e.g.driver’slicenseorPassport).SuchauthenticationdoesnotrelievetheRAofitsresponsibilityto

Page 18: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

12

verifythepresenteddata.2.RemotelyverifyinginformationprovidedbytheApplicant(verifiedelectronicallybyarecordcheckwiththespecifiedissuingauthorityorthroughsimilardatabasestoestablishtheexistenceofsuchrecordswithmatchingnameandreferencenumbersandtocorroboratedateofbirthandcurrentaddressofrecordortelephonenumber).TheIssuerCAorRAmayconfirmanaddressbyissuingthecredentialsinamannerthatconfirmstheaddressofrecordorverifyingknowledgeofrecentaccountactivityassociatedwiththeApplicant’saddressandmayconfirmatelephonenumberbysendingachallenge‐responseSMStextmessageorbyrecordingtheapplicant’svoiceduringacommunicationafterassociatingthetelephonenumberwiththeapplicantinrecordsthatareavailabletotheIssuerCAorRA.

3.IftheIssuerCAorRAhasacurrent,ongoingrelationshipwiththeApplicant,theIssuerCAorRAmayverifyidentityusinganexchangeofapreviouslyexchangedsharedsecret(e.g.,aPINorpassword)thatmeetsorexceedsNISTSP800‐63Level2entropyrequirements,providedthat:(a)identitywasoriginallyestablishedwiththedegreeofrigorequivalenttothatrequiredin1or2aboveusingagovernment‐issuedphotoID,and(b)theongoingrelationshipexistssufficienttoensuretheApplicant’scontinuedpersonalpossessionofthesharedsecret.4.AnyofthemethodsrequiredtoverifyidentityforissuanceofaDigiCertLevel3or4ClientCertificate.

Level3ClientCertificates

In‐personproofingbeforeanRA,TrustedAgent, oranentitycertifiedbyaStateorNationalGovernmentthatisauthorizedtoconfirmidentities(providedthatthecertifiedentityforwardstheinformationcollectedfromtheapplicantdirectlytotheRAinasecuremannerandthattheRAisnotrelievedofitsresponsibilitytoverifythepresenteddata).

TheApplicantshallprovideatleastoneFederalGovernment‐issuedPictureI.D.,aREALID,ortwoNon‐FederalGovernmentI.D.s,oneofwhichmustbeaphotoI.D.AcceptableformsofNon‐FederalGovernmentphotoIDsincludeadriver'slicense,state‐issuedphotoIDcard,passport,nationalidentitycard,permanentresidentcard,trustedtravelercard,tribalID,militaryID,orsimilarphotoidentificationdocument.SeeUSCISFormI‐9.

TheIssuerCAorRAshallexaminethecredentialsanddeterminewhethertheyareauthenticandunexpired.ForeachLevel3orhigherassuranceClientCertificateissued,theIssuerCAortheRAshallreviewandrecordaDeclarationofIdentity*whichshallbesignedbytheapplicantandthepersonperformingthein‐personidentification.TheIssuerCAorRAshallchecktheprovidedinformation(name,dateofbirth,andcurrentaddress)toensurelegitimacyandmayverifyitelectronicallybyarecordcheckasdescribedabove.

Page 19: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

13

TheIssuerCAorRAmayemployanin‐personantecedentprocess,definedinFBCASupplementaryAntecedent,In‐PersonDefinition,tomeetthein‐personidentityproofingrequirement.Underthisdefinition,historicalin‐personidentityproofingissufficientif(1)itmeetsthethoroughnessandrigorofin‐personproofingdescribedabove,(2)supportingIDproofingartifactsexisttosubstantiatetheantecedentrelationship,and(3)mechanismsareinplacethatbindtheindividualtotheassertedidentity.Inoneusecase,theApplicant(e.g.anemployee)hasbeenidentifiedpreviouslybyanemployerusingUSCISFormI‐9andisboundtotheassertedidentityremotelythroughtheuseofknownattributesorsharedsecrets.Inanotherusecase,athirdpartyIdentityVerificationProviderconstructsareal‐time,five‐questionprocess,basedonmultiplehistoricantecedentdatabases,andtheapplicantisgiventwominutestoansweratleastfourofthefivequestionscorrectly.SeeFBCASupplementaryAntecedent,In‐PersonDefinition.IfthephotoIDisunexpiredandconfirmstheaddressofrecordfortheApplicant,thenthecertificatemaybeapprovedforissuancewithnoticeofissuancesenttotheaddressofrecord.IfthephotoIDdoesnotconfirmtheApplicant’saddressofrecord,thenthecertificateshallbeissuedinamannerthatconfirmstheaddressofrecord.ForallLevel3orhigherassuranceClientCertificates,theidentityoftheApplicantmustbeestablishednoearlierthan30dayspriortoinitialcertificateissuance.

Level4ClientCertificates(MediumHardware)Mustbeissuedtocryptographichardware.

In‐personproofingbeforeanRA,TrustedAgent,oranentitycertifiedbyaStateorNationalGovernmentthatisauthorizedtoconfirmidentities(providedthatthecertifiedentityforwardstheinformationcollectedfromtheapplicantdirectlytotheRAinasecuremannerandthattheRAisnotrelievedofitsresponsibilitytoverifythepresenteddata).TheApplicationshallsupply(i)oneFederalGovernment‐issuedPictureI.D.,aREALID,ortwoNon‐FederalGovernmentI.D.s,oneofwhichmustbeaphotoI.D.and(ii)thecontemporaneouscollectionofatleastonebiometric(e.g.photographorfingerprints)toensurethattheApplicantcannotrepudiatetheapplication.AcceptableformsofNon‐FederalGovernmentphotoIDsincludeadriver'slicense,state‐issuedphotoIDcard,passport,nationalidentitycard,permanentresidentcard,trustedtravelercard,tribalID,militaryID,orsimilarphotoidentificationdocument.SeeUSCISFormI‐9.TheIssuerCAorRAshallexaminethecredentialsanddeterminewhethertheyareauthenticandunexpired.ForeachLevel4ClientCertificateissued,theIssuerCAortheRAshallreviewandrecordaDeclarationofIdentity*thatissignedbytheapplicantandthepersonperformingthein‐personidentification.ForallLevel4ClientCertificatestheuseofanin‐personantecedentisnotapplicableandtheApplicantshallestablishhisorheridentitynomorethan30dayspriortoinitialcertificateissuance.IssuerCAsandRAsshallissueLevel4ClientCertificatesinamannerthatconfirmstheApplicant’saddressofrecord.

Page 20: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

14

EUQualifiedCertificates In‐personverificationofthe Applicant’sidentitybyappropriatemeansinaccordancewithnationallaw.Theentityperformingthevalidationshallchecktheevidenceofidentitydirectlyagainstaphysicalpersonorindirectlyusingmeansthatprovideequivalentassurancetophysicalpresence.

*ADeclarationofIdentityconsistsofthefollowing:

a. theidentityofthepersonperformingtheverification;b. asigneddeclarationbytheverifyingpersonstatingthattheyverifiedtheidentityofthe

Subscriberasrequiredusingtheformatsetforthat28U.S.C.1746(declarationunderpenaltyofperjury)orcomparableprocedureunderlocallaw;thesignatureonthedeclarationmaybeeitherahandwrittenordigitalsignatureusingacertificatethatisofequalorhigherlevelofassuranceasthecredentialbeingissued;

c. uniqueidentifyingnumber(s)fromtheApplicant’sidentificationdocument(s),orafacsimileoftheID(s);

d. thedateoftheverification;ande. adeclarationofidentitybytheApplicantthatissigned(inhandwritingorthroughuseofa

digitalsignaturethatisofequivalentorhigherassurancethanthecredentialbeingissued)inthepresenceofthepersonperformingtheverificationusingtheformatsetforthat28U.S.C.1746(declarationunderpenaltyofperjury)orcomparableprocedureunderlocallaw.

Wherein‐personidentityverificationisrequiredandtheApplicantcannotparticipateinface‐to‐faceregistrationalone(e.g.becauseApplicantisanetworkdevice,minor,orpersonnotlegallycompetent),thentheApplicantmaybeaccompaniedbyapersonalreadycertifiedbythePKIorwhohastherequiredidentitycredentialsforaCertificateatthesameorhigherlevelofassuranceappliedforbytheApplicant.ThepersonaccompanyingtheApplicant(i.e.the“Sponsor”)willpresentinformationsufficientforregistrationatthelevelofthecertificatebeingrequested,forhimselforherself,andfortheApplicant.Forin‐personidentityproofingatLevels3and4,anentitycertifiedbyaStateorNationalGovernmentasauthorizedtoconfirmidentitiesmayperformin‐personauthenticationonbehalfoftheRA.Theinformationcollectedfromtheapplicantshouldbereliablycollectedfromthecertifiedentity.Packagessecuredinatamper‐evidentmannerbythecertifiedentitysatisfythisrequirement;othersecuremethodsarealsoacceptable.SuchauthenticationdoesnotrelievetheRAofitsresponsibilitytoverifythepresenteddata.

3.2.3.1. Authentication for Role‐based Client Certificates AnIssuerCAmayissueCertificatesthatidentifyaspecificrolethattheSubscriberholds,providedthattheroleidentifiesaspecificindividualwithinanorganization(e.g.,ChiefInformationOfficerisauniqueindividualwhereasProgramAnalystisnot).Theserole‐basedCertificatesareusedwhennon‐repudiationisdesired.TheIssuerCAmayonlyissuerole‐basedcertificatestoSubscriberswhofirstobtainanindividualSubscriberCertificatethatisatthesameorhigherassurancelevelastherequestedrole‐basedCertificate.AnIssuerCAmayissueCertificateswiththesameroletomultipleSubscribers.However,theIssuerCAshallrequirethateachCertificatehaveauniqueKeyPair.Individualsmaynotsharetheirissuedrole‐basedCertificatesandarerequiredtoprotecttherole‐basedCertificateinthesamemannerasindividualCertificates.TheIssuerCAoranRAshallverifytheidentityoftheindividualrequestingarole‐basedCertificate(i.e.thesponsor)inaccordancewithSection3.2.3andrecordtheinformationidentifiedinSection3.2.3forasponsorassociatedwiththerolebeforeissuingarole‐basedCertificate.ThesponsormustholdanindividualCertificateinhis/herownnameissuedbythesameCAatthesameorhigherassurancelevelastherole‐basedCertificate.Proceduresandpoliciesforissuingrole‐basedCertificatesshallcomplywithallprovisionsofthisCP(e.g.,keygeneration,privatekeyprotection,andSubscriberobligations).

Page 21: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

15

IGTFandEUQualifiedCertificatesarenotissuedasrole‐basedCertificates.IftheCertificateisapseudonymouscertificatecross‐certifiedwiththeFBCAthatidentifiessubjectsbytheirorganizationalroles,thentheIssuerCAorRAshallverifythattheindividualeitherholdsthatroleorhastheauthoritytosignonbehalfoftherole.

3.2.3.2. Authentication for Group Client Certificates Ifseveralentitiesareactinginonecapacityandnon‐repudiationisnotnecessary,theIssuerCAmayissueaCertificatecorrespondingtoaPrivateKeysharedbymultipleSubscribers.TheIssuerCAorRAshallrecordtheinformationidentifiedinSection3.2.3forasponsorfromtheInformationSystemsSecurityOfficeorequivalentbeforeissuingagroupCertificate.Inaddition,theIssuerCAortheRAshall:

1. RequirethattheInformationSystemsSecurityOffice,orequivalent,beresponsibleforensuringcontrolofthePrivateKey,includingmaintainingalistofSubscriberswhohaveaccesstothePrivateKey,andaccountforthetimeperiodduringwhicheachSubscriberhadcontrolofthekey,

2. NotincludeasubjectNameDNinthecertificateinawaythatcouldimplythatthesubjectisasingleindividual,

3. RequirethatthesponsorprovideandcontinuouslyupdatealistofindividualswhoholdthesharedPrivateKey,and

4. EnsurethattheproceduresforissuinggroupcertificatescomplywithallotherstipulationsofthisCP(e.g.,keygeneration,privatekeyprotection,andSubscriberobligations).

IGTFandEUQualifiedCertificatesarenotissuedasgroupCertificates.

3.2.3.3. Authentication of Devices with Human Sponsors AnIssuerCAmayissueaLevel1,2,3or4ClientorFederatedDeviceCertificateforuseonacomputingornetworkdevice,providedthattheentityowningthedeviceislistedasthesubject.Insuchcases,thedevicemusthaveahumansponsorwhoprovides:

1. Equipmentidentification(e.g.,serialnumber)orservicename(e.g.,DNSname),2. EquipmentPublicKeys,3. Equipmentauthorizationsandattributes(ifanyaretobeincludedinthecertificate),and4. Contactinformation.

IftheCertificate’ssponsorchanges,thenewsponsorshallreviewthestatusofeachdevicetoensureitisstillauthorizedtoreceiveCertificates.TheCPSshalldescribeprocedurestoensurethatcertificateaccountabilityismaintained.TheIssuerCAshallverifyallregistrationinformationcommensuratewiththerequestedcertificatetype.Acceptablemethodsforperformingthisauthenticationandintegritycheckinginclude:

1. Verificationofdigitallysignedmessagessentfromthesponsor(usingCertificatesofequivalentorgreaterassurancethanthatbeingrequested)

2. Inpersonregistrationbythesponsor,withtheidentityofthesponsorconfirmedinaccordancewiththerequirementsofSection3.2.3.

3.2.4. Non‐verifiedSubscriberInformationIssuerCAsarenotrequiredtoconfirmthatthecommonnameinaLevel1‐PersonalClientCertificateisthelegalnameoftheSubscriber.Anyothernon‐verifiedinformationincludedinaCertificateshallbedesignatedassuchintheCertificate.NounverifiedinformationshallbeincludedinanyLevel2,Level,3,Level4,ObjectSigning,EV,FederatedDevice,orEUQualifiedCertificate.

Page 22: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

16

3.2.5. ValidationofAuthorityTheIssuerCAorRAshallverifytheauthorizationofacertificaterequestasfollows:

Certificate VerificationDVSSL/TLSCertificates,OVSSL/TLSCertificates,andFederatedDeviceCertificates

AnauthorizedcontactlistedwiththeDomainNameRegistrar,apersonwithcontroloverthedomainname,orthroughcommunicationwiththeapplicantusingaReliableMethodofCommunication,asdefinedintheBaselineRequirements.

EVCertificates InaccordancewiththeEVGuidelines.ObjectSigningCertificates(includingEVCodeSigningCertificates)

IfaCertificatenamesanorganization,anauthoritativesourcewithintheorganization(e.g.corporate,legal,IT,HR,orotherappropriateorganizationalsources)usingaReliableMethodofCommunication.

Level1ClientCertificates‐PersonalorEnterprise(emailcertificates)

Anindividualwithcontroloverthe emailaddresslistedintheCertificateorwithapersonwhohastechnicaloradministrativecontroloverthedomainortheemailaddresstobelistedintheCertificate.

IGTFCertificates Pursuanttotherelevantrequirementsbytheaccreditationauthority.

ClientCertificatesLevels2,3and4

Individuals affiliatedwiththeorganizationwhoconfirmtheapplicant’sauthoritytoobtainaCertificateindicatingtheaffiliationandwhoagreetorequestrevocationoftheCertificatewhenthataffiliationends.

EUQualifiedCertificates AnindividualisassociatedwiththeorganizationthatisauthorizedtoconsenttotheCertificate’spublication(seesection7.3.1ofTS101456).

TheIssuerCAshallimplementaprocesswherebyanApplicantmaylimitthenumberofindividualsauthorizedtorequestCertificates.TheIssuerCAshallprovidealistofauthorizedcertificaterequestersafterreceivingaverifiedrequestforsuchinformationfromanindividualauthorizedtomakesuchrequest.

3.3. IDENTIFICATIONANDAUTHENTICATIONFORRE‐KEYREQUESTS

3.3.1. IdentificationandAuthenticationforRoutineRe‐keyAnIssuerCAmayallowSubscribersofSSL/TLSServerandCodeSigningCertificatestoauthenticatethemselvesoveraTLS/SSLsessionwithusernameandpassword.EachSubscribershallreestablishitsidentityusingtheinitialregistrationprocessesofsection3.2accordingtothefollowingtable:

Certificate RoutineRe‐KeyAuthentication Re‐VerificationRequiredDVandOVSSL/TLSCertificates Usernameandpassword AccordingtotheBaseline

RequirementsEVSSL/TLSCertificates Usernameandpassword AccordingtotheEV

GuidelinesSubscriberCodeSigningCertificates(MinimumRequirementsandEV)

Usernameandpassword Atleastevery39months

SigningAuthorityEVCodeSigningCertificates

Usernameandpassword Atleastevery123months

TimestampEVCodeSigningCertificates

Usernameandpassword Atleastevery123months

ObjectSigningCertificates Usernameandpassword AtleasteverysixyearsLevel1ClientCertificates Usernameandpassword AtleasteverynineyearsLevel2ClientCertificates Currentsignaturekeyormulti‐

factorauthenticationmeetingAtleasteverynineyears

Page 23: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

17

NIST SP800‐63Level3Level3and4ClientCertificates Currentsignaturekey ormulti‐

factorauthenticationmeetingNISTSP800‐63Level3

Atleasteverynineyears

FederatedDeviceandFederatedDevice‐hardware

Currentsignaturekeyormulti‐factorauthenticationmeetingNIST‐800‐63Level3

Atleasteverynineyears

IGTFCertificates Usernameandpassword,RAattestationaftercomparisonofidentitydocuments,re‐authenticatethroughanapprovedIdM,orthroughassociatedPrivateKey

Atleastevery13months.However,certificatesassociatedwithaPrivateKeyrestrictedsolelytoahardwaretokenmayberekeyedorrenewedforaperiodofupto5years

Authentication‐OnlyCertificates UsernameandpasswordorwithassociatedPrivateKey

None

TheIssuerCAshallnotre‐keyaCertificatewithoutadditionalauthenticationifdoingsowouldallowtheSubscribertousetheCertificatebeyondthelimitsdescribedabove.

3.3.2. IdentificationandAuthenticationforRe‐keyAfterRevocationTheIssuerCAshallrequiresubscribersofCertificatesthathavebeenrevokedforreasonsotherthanastheresultofaroutinecertificaterenewal,update,ormodificationactiontoundergotheinitialregistrationprocess(describedinSection3.2)toobtainanewCertificate.

3.4. IDENTIFICATIONANDAUTHENTICATIONFORREVOCATIONREQUESTTheIssuerCAortheRAthatapprovedtheCertificate’sissuanceshallauthenticateallrevocationrequests.TheIssuerCAorRAmayauthenticatearevocationrequestusingtheCertificate’sPublicKey,regardlessofwhethertheassociatedPrivateKeyiscompromised.

4. CERTIFICATELIFE‐CYCLEOPERATIONALREQUIREMENTS

4.1. CERTIFICATEAPPLICATION

4.1.1. WhoCanSubmitaCertificateApplicationNoindividualorentitylistedonagovernmentdeniedlist,listofprohibitedpersons,orotherlistthatprohibitsdoingbusinesswithsuchorganizationorpersonunderthelawsoftheUnitedStatesmaysubmitanapplicationforaCertificate.ApplicantsorindividualsauthorizedtorequestCertificates,whoarenotincludedinanyofthepreviouslists,mayapplyforaCertificate.

4.1.2. EnrollmentProcessandResponsibilitiesTheIssuerCAisresponsibleforensuringthattheidentityofeachCertificateApplicantisverifiedinaccordancewiththisCPandtheapplicableCPSpriortotheissuanceofaCertificate.ApplicantsareresponsibleforsubmittingsufficientinformationanddocumentationfortheIssuerCAortheRAtoperformtherequiredverificationofidentitypriortoissuingaCertificate.

4.2. CERTIFICATEAPPLICATIONPROCESSING

4.2.1. PerformingIdentificationandAuthenticationFunctionsTheIssuerCAortheRAshallidentifyandverifyeachApplicantinaccordancewiththeapplicableCertificationPracticesStatementsandRegistrationPracticesStatements.AnIssuerCAissuingpubliclytrustedSSL/TLSservercertificatesshallstateinitsCPSitspracticesonprocessingCAARecordsforFullyQualifiedDomainNames.TheIssuerCAshallensurethatallcommunicationbetweentheIssuerCAandanRAregardingcertificateissuanceorchangesinthestatusofa

Page 24: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

18

Certificatearemadeusingsecureandauditablemethods.Ifdatabasesorothersourcesareusedtoconfirmsensitiveorconfidentialattributesofanindividualsubscriber,thenthatsensitiveinformationshallbeprotectedandsecurelyexchangedinaconfidentialandtamper‐evidentmanner,protectedfromunauthorizedaccess,andtrackedusinganauditablechainofcustody.

4.2.2. ApprovalorRejectionofCertificateApplicationsTheIssuerCAshallrejectanycertificateapplicationthatcannotbeverified.TheIssuerCAshallnotissueCertificatescontaininganewgTLDunderconsiderationbutnotyetapprovedbyICANN.TheIssuerCAmayalsorejectacertificateapplicationonanyreasonablebasis,includingiftheCertificatecoulddamagetheIssuerCA’sbusinessorreputation.IssuerCAsarenotrequiredtoprovideareasonforrejectingacertificateapplication.IssuerCAsandRAsshallfollowindustrystandardswhenapprovingandissuingCertificates.TheIssuerCAorRAshallcontractuallyrequiresubscriberstoverifytheinformationinaCertificatepriortousingtheCertificate.

4.2.3. TimetoProcessCertificateApplicationsAllpartiesinvolvedincertificateapplicationprocessingshallusereasonableeffortstoensurethatcertificateapplicationsareprocessedinatimelymanner.Identityshallbeestablishednomorethan30daysbeforeinitialissuanceofLevel3and4Certificates.

4.3. CERTIFICATEISSUANCE

4.3.1. CAActionsduringCertificateIssuanceIssuerCAsshallverifythesourceofacertificaterequestbeforeissuance.TheIssuerCAandanyRAshallprotectdatabasesundertheircontrolandthatareusedtoconfirmSubscriberidentityinformationfromunauthorizedmodificationoruse.TheIssuerCAshallperformitsactionsduringthecertificateissuanceprocessinasecuremanner.CertificateissuancebytheRootCArequiresanindividualauthorizedbytheIssuerCA(i.e.theCAsystemoperator,systemofficer,orPKIadministrator)todeliberatelyissueadirectcommandinorderfortheRootCAtoperformacertificatesigningoperation.

4.3.2. NotificationtoSubscriberbytheCAofIssuanceofCertificateTheIssuerCAorRAshallnotifytheSubscriberwithinareasonabletimeofcertificateissuanceandmayuseanyreliablemechanismtodelivertheCertificatetotheSubscriber.

4.4. CERTIFICATEACCEPTANCE

4.4.1. ConductConstitutingCertificateAcceptanceThepassageoftimeafterdeliveryornoticeofissuanceofaCertificatetotheSubscriberortheactualuseofaCertificateconstitutestheSubscriber’sacceptanceoftheCertificate.

4.4.2. PublicationoftheCertificatebytheCATheIssuerCAshallpublishallCACertificatestotheIssuerCA’srepository.

4.4.3. NotificationofCertificateIssuancebytheCAtoOtherEntitiesNostipulation.

4.5. KEYPAIRANDCERTIFICATEUSAGE

4.5.1. SubscriberPrivateKeyandCertificateUsageAllSubscribersshallprotecttheirPrivateKeysfromunauthorizeduseordisclosurebythirdpartiesandshallusetheirPrivateKeysonlyfortheirintendedpurpose.

Page 25: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

19

4.5.2. RelyingPartyPublicKeyandCertificateUsageRelyingPartiesshallusesoftwarethatiscompliantwithX.509andapplicableIETFPKIXstandards.TheIssuerCAshallspecifyrestrictionsontheuseofaCertificatethroughcertificateextensionsandshallspecifythemechanism(s)todeterminecertificatevalidity(CRLsandOCSP).RelyingPartiesmustprocessandcomplywiththisinformationinaccordancewiththeirobligationsasRelyingParties.ARelyingPartyshouldusediscretionwhenrelyingonaCertificateandshouldconsiderthetotalityofthecircumstancesandriskoflosspriortorelyingonaCertificate.RelyingonadigitalsignatureorCertificatethathasnotbeenprocessedinaccordancewithapplicablestandardsmayresultinriskstotheRelyingParty.TheRelyingPartyissolelyresponsibleforsuchrisks.Ifthecircumstancesindicatethatadditionalassurancesarerequired,theRelyingPartymustobtainsuchassurancesbeforeusingtheCertificate.

4.6. CERTIFICATERENEWAL

4.6.1. CircumstanceforCertificateRenewalAnIssuerCAmayrenewaCertificateif:

1. theassociatedPublicKeyhasnotreachedtheendofitsvalidityperiod,2. theassociatedPrivateKeyhasnotbeencompromised,3. theSubscriberandattributesremainconsistent,and4. re‐verificationofsubscriberidentityisnotrequiredbySection3.3.1.

AnIssuerCAmayalsorenewaCertificateifaCACertificateisre‐keyedorasotherwisenecessarytoprovideservices.AfterrenewingaclientCertificate,theIssuerCAmaynotre‐key,renew,ormodifytheoldCertificate.

4.6.2. WhoMayRequestRenewalOnlythecertificatesubjectoranauthorizedrepresentativeofthecertificatesubjectmayrequestrenewaloftheSubscriber’sCertificates.ForCertificatescross‐certifiedwiththeFBCA,renewalrequestsareonlyacceptedfromcertificatesubjects,PKIsponsorsorRAs.AnIssuerCAmayperformrenewalofitssubscriberCertificateswithoutacorrespondingrequest,suchaswhentheCAre‐keys.

4.6.3. ProcessingCertificateRenewalRequestsTheIssuerCAmayrequirereconfirmationorverificationoftheinformationinaCertificatepriortorenewal.

4.6.4. NotificationofNewCertificateIssuancetoSubscriberTheIssuerCAshallnotifytheSubscriberwithinareasonabletimeofcertificateissuanceandmayuseanyreliablemechanismtodelivertheCertificatetotheSubscriber.

4.6.5. ConductConstitutingAcceptanceofaRenewalCertificateThepassageoftimeafterdeliveryornoticeofissuanceoftheCertificatetotheSubscriber,oractualuseoftheCertificate,constitutestheSubscriber’sacceptanceofit.

4.6.6. PublicationoftheRenewalCertificatebytheCATheIssuerCAshallpublishallrenewedCACertificatestotheIssuerCA’srepository.

4.6.7. NotificationofCertificateIssuancebytheCAtoOtherEntitiesNostipulation.

Page 26: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

20

4.7. CERTIFICATERE‐KEY

4.7.1. CircumstanceforCertificateRekeyRe‐keyingaCertificateconsistsofcreatinganewCertificatewithadifferentPublicKey(andserialnumber)whileretainingtheremainingcontentsoftheoldCertificatethatdescribethesubject.ThenewCertificatemayhaveadifferentvalidityperiod,keyidentifiers,specifydifferentCRLandOCSPdistributionpoints,and/orbesignedwithadifferentkey.Subscribersrequestingre‐keyshouldidentifyandauthenticatethemselvesaspermittedbySection3.3.1.Afterre‐keyingaClientCertificateorafederateddeviceCertificate,theIssuerCAmaynotre‐key,renew,ormodifythepreviousCertificate.

4.7.2. WhoMayRequestCertificateRekeyOnlythesubjectoftheCertificateorthePKIsponsormayrequestre‐key.TheIssuerCAoranRAmayinitiatecertificatere‐keyattherequestofthecertificatesubjectorinitsowndiscretion.

4.7.3. ProcessingCertificateRekeyRequestsRe‐keyrequestsareonlyacceptedfromthesubjectoftheCertificateorthePKIsponsor.Ataminimum,theIssuerCAshallcomplywithsection3.3.1inidentifyingandauthenticatingtheSubscriberorPKIsponsorpriortorekeyingtheCertificate.

4.7.4. NotificationofCertificateRekeytoSubscriberTheIssuerCAshallnotifytheSubscriberwithinareasonabletimeofcertificateissuanceandmayuseanyreliablemechanismtodelivertheCertificatetotheSubscriber.

4.7.5. ConductConstitutingAcceptanceofaRekeyedCertificateThepassageoftimeafterdeliveryornoticeofissuanceoftheCertificatetotheSubscriberortheactualuseoftheCertificateconstitutestheSubscriber’sacceptanceofit.

4.7.6. PublicationoftheRekeyedCertificatebytheCATheIssuerCAshallpublishrekeyedCACertificatestotheIssuerCA’srepository.

4.7.7. NotificationofCertificateIssuancebytheCAtoOtherEntitiesNostipulation.

4.8. CERTIFICATEMODIFICATION

4.8.1. CircumstanceforCertificateModificationModifyingaCertificatemeanscreatinganewCertificateforthesamesubjectwithauthenticatedinformationthatdiffersslightlyfromtheoldCertificate(e.g.,changestoemailaddressornon‐essentialpartsofnamesorattributes)providedthatthemodificationotherwisecomplieswiththisCP.ThenewCertificatemayhavethesameoradifferentsubjectPublicKey.AftermodifyingaCertificatethatiscross‐certifiedwiththeFBCA,theIssuerCAmaynotre‐key,renew,ormodifytheoldCertificate.

4.8.2. WhoMayRequestCertificateModificationTheIssuerCAmaymodifyaCertificateattherequestofthecertificatesubjectorinitsowndiscretion.

4.8.3. ProcessingCertificateModificationRequestsAfterreceivingarequestformodification,theIssuerCAshallverifyanyinformationthatwillchangeinthemodifiedCertificate.TheIssuerCAmayissuethemodifiedCertificateonlyaftercompletingthe

Page 27: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

21

verificationprocessonallmodifiedinformation.ThevalidityperiodofamodifiedCertificatemustnotextendbeyondtheapplicabletimelimitsfoundinsection3.3.1or6.3.2.

4.8.4. NotificationofCertificateModificationtoSubscriberTheIssuerCAshallnotifytheSubscriberwithinareasonabletimeofcertificateissuanceandmayuseanyreliablemechanismtodelivertheCertificatetotheSubscriber.

4.8.5. ConductConstitutingAcceptanceofaModifiedCertificateThepassageoftimeafterdeliveryornoticeofissuanceoftheCertificatetotheSubscriberoractualuseoftheCertificateconstitutestheSubscriber’sacceptanceofit.

4.8.6. PublicationoftheModifiedCertificatebytheCATheIssuerCAshallpublishmodifiedCACertificatestotheIssuerCA’srepository.

4.8.7. NotificationofCertificateModificationbytheCAtoOtherEntitiesNostipulation.

4.9. CERTIFICATEREVOCATIONANDSUSPENSION

4.9.1. CircumstancesforRevocationRevocationofaCertificatepermanentlyendstheoperationalperiodoftheCertificatepriortotheCertificatereachingtheendofitsstatedvalidityperiod.PriortorevokingaCertificate,theIssuerCAshallverifythattherevocationrequestwasmadebyeithertheorganizationorindividualthatmadethecertificateapplicationorbyanentitywiththelegaljurisdictionandauthoritytorequestrevocation.TheIssuerCAshouldrevokeaCertificateiftheIssuerCAisawarethat:

1. TheSubscriberrequestedrevocationofitsCertificate;2. TheSubscriberdidnotauthorizetheoriginalcertificaterequestanddidnotretroactively

grantauthorization;3. EitherthePrivateKeyassociatedwiththeCertificateorthePrivateKeyusedtosignthe

Certificatewascompromisedormisused;4. TheSubscriberorthecross‐certifiedCAbreachedamaterialobligationundertheCP,the

CPS,ortherelevantagreement;5. EithertheSubscriber’sortheIssuerCA’sobligationsundertheCPorCPSaredelayedor

preventedbycircumstancesbeyondtheparty’sreasonablecontrol,includingcomputerorcommunicationfailure,and,asaresult,anotherentity’sinformationismateriallythreatenedorcompromised;

6. TheApplicanthaslostitsrightstoatrademarkorthedomainnamelistedintheCertificate;7. AwildcardCertificatewasusedtoauthenticateafraudulentlymisleadingsubordinate

domainname;8. TheCertificatewasnotissuedinaccordancewiththeCP,CPS,orapplicableindustry

standards;9. TheIssuerCAreceivedalawfulandbindingorderfromagovernmentorregulatorybodyto

revoketheCertificate;10. TheIssuerCAceasedoperationsanddidnotarrangeforanothercertificateauthorityto

providerevocationsupportfortheCertificate;11. TheIssuerCA'srighttomanageCertificatesunderapplicableindustrystandardswas

terminated(unlessarrangementshavebeenmadetocontinuerevocationservicesandtomaintaintheCRL/OCSPRepository);

12. AnyinformationappearingintheCertificatewasorbecameinaccurateormisleading;13. ThetechnicalcontentorformatoftheCertificatepresentsanunacceptablesecurityrisk

toapplicationsoftwarevendors,RelyingParties,orothers;14. TheSubscriberwasaddedasadeniedpartyorprohibitedpersontoablacklist,oris

operatingfromadestinationprohibitedunderU.S.law;or

Page 28: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

22

15. Forcode‐signingCertificates,theCertificatewasusedtosign,publish,ordistributemalwareorotherharmfulcontent,includinganycodethatisdownloadedontoauser’ssystemwithouttheirconsent.

TheIssuerCAshallrevokeaCertificateifthebindingbetweenthesubjectandthesubject’sPublicKeyintheCertificateisnolongervalidorifanassociatedPrivateKeyiscompromised.TheIssuerCAwillrevokeaSubordinateCACertificatewithinseven(7)daysifoneormoreofthefollowingoccurs:

1. TheSubordinateCArequestsrevocationinwriting;2. TheSubordinateCAnotifiestheIssuerCAthattheoriginalcertificaterequestwasnot

authorizedanddoesnotretroactivelygrantauthorization;3. TheIssuerCAobtainsevidencethattheSubordinateCA’sPrivateKeycorrespondingtothe

PublicKeyintheCertificatesufferedaKeyCompromiseornolongercomplieswiththerequirementsofSections6.1.5and6.1.6,

4. TheIssuerCAobtainsevidencethattheCACertificatewasmisused;5. TheIssuerCAismadeawarethattheCACertificatewasnotissuedinaccordancewithor

thatSubordinateCAhasnotcompliedwiththisdocumentortheapplicableCertificatePolicyorCertificationPracticeStatement;

6. TheIssuerCAdeterminesthatanyoftheinformationappearingintheCACertificateisinaccurateormisleading;

7. TheIssuerCAortheSubordinateCAceasesoperationsforanyreasonandhasnotmadearrangementsforanotherCAtoproviderevocationsupportfortheCACertificate;

8. TheIssuerCA’sortheSubordinateCA'srighttoissueCertificatesundertheBaselineRequirementsexpiresorisrevokedorterminated,unlesstheIssuerCAhasmadearrangementstocontinuemaintainingtheCRL/OCSPRepository;

9. RevocationisrequiredbytheIssuerCA’sCertificatePolicyand/orCertificationPracticeStatement;or

10.ThetechnicalcontentorformatoftheCACertificatepresentsanunacceptablerisktoApplicationSoftwareSuppliersorRelyingParties.

IfaCertificateexpressesanorganizationalaffiliation,theIssuerCAortheRAshallrequiretheAffiliatedOrganizationtoinformitifthesubscriberaffiliationchanges.IftheAffiliatedOrganizationnolongerauthorizestheaffiliationofaSubscriber,thentheIssuerCAshallrevokeanyCertificatesissuedtothatSubscribercontainingtheorganizationalaffiliation.IfanAffiliatedOrganizationterminatesitsrelationshipwiththeIssuerCAorRAsuchthatitnolongerprovidesaffiliationinformation,theIssuerCAshallrevokeallCertificatesaffiliatedwiththatAffiliatedOrganization.AnIssuerCAorcross‐certifiedentityshallrequestrevocationofitsDigiCert‐issuedcross‐CertificateifitnolongermeetsthestipulationsofDigiCert’spolicies,asindicatedbyDigiCert’spolicyOIDsinCertificatesorthoselistedinthepolicymappingextensionofthecross‐Certificate.

4.9.2. WhoCanRequestRevocationTheIssuerCAorRAshallacceptrevocationrequestsfromauthenticatedandauthorizedparties,suchasthecertificateSubscriberortheAffiliatedOrganizationnamedinaCertificate.TheIssuerCAorRAmayestablishproceduresthatallowotherentitiestorequestcertificaterevocationforfraudormisuse.TheIssuerCAshallrevokeaCertificateifitreceivessufficientevidenceofcompromiseoflossofthePrivateKey.TheIssuerCAmayrevokeaCertificateofitsownvolitionwithoutreason,evenifnootherentityhasrequestedrevocation.

4.9.3. ProcedureforRevocationRequestEntitiessubmittingcertificaterevocationrequestsmustlisttheiridentityandexplainthereasonforrequestingrevocation.TheIssuerCAorRAshallauthenticateandlogeachrevocationrequest.The

Page 29: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

23

IssuerCAwillalwaysrevokeaCertificateiftherequestisauthenticatedasoriginatingfromtheSubscriberortheAffiliatedOrganizationlistedintheCertificate.IfrevocationisrequestedbysomeoneotherthananauthorizedrepresentativeoftheSubscriberorAffiliatedOrganization,theIssuerCAorRAshallinvestigatetheallegedbasisfortherevocationrequest.TheIssuerCAshallmaintainacontinuous24/7abilitytointernallyrespondtoanyhighprioritycertificateproblemreports.Ifappropriate,theIssuerCAortheRAmayforwardcomplaintstolawenforcement.

4.9.4. RevocationRequestGracePeriodTherevocationrequestgraceperiodisthetimeavailabletothesubscriberwithinwhichthesubscribermustmakearevocationrequestafterreasonsforrevocationhavebeenidentified.IssuerCAsandRAsarerequiredtoreportthesuspectedcompromiseoftheirCAorRAPrivateKeyandrequestrevocationtoboththepolicyauthorityandoperatingauthorityofthesuperiorissuingCA(e.g.,theFPKIPA/FBCAOA,DCPA,cross‐signingCA,RootCA,etc.)withinonehourofdiscovery.SubscribersshallrequestrevocationassoonaspossibleifthePrivateKeycorrespondingtotheCertificateislostorcompromisedorifthecertificatedataisnolongervalid.TheIssuerCAmayextendrevocationgraceperiodsonacase‐by‐casebasis.

4.9.5. TimewithinwhichCAMustProcesstheRevocationRequestAnIssuerCAshallrevokeaCertificatewithinonehourofreceivingappropriateinstructionfromtheDCPA.AnIssuerCAshallrevoketheCACertificateofasubordinateorcross‐signedCAassoonaspracticalafterreceivingpropernoticethatthesubordinateorcross‐signedCAhasbeencompromised.Exceptasotherwisesetforthinsection4.9.1.2oftheBaselineRequirements,ifanIssuerCAortheDCPAdeterminesthatimmediaterevocationisnotpractical,becausethepotentialrisksofrevocationoutweightheriskscausedbythecompromise,thentheIssuerCAandtheDCPAshalljointlydeterminetheappropriateprocesstofollowinordertopromptlyrevokethesubordinateorcross‐signedCACertificate.TheIssuerCAshallrevokeotherCertificatesasquicklyaspracticalaftervalidatingtherevocationrequest.TheIssuerCAshallprocessrevocationrequestsasfollows:

1. BeforethenextCRLispublished,iftherequestisreceivedtwoormorehoursbeforeregularperiodicCRLissuance,

2. BypublishingitintheCRLfollowingthenextCRL,iftherequestisreceivedwithintwohoursoftheregularlyschedulednextCRLissuance,and

3. Regardless,within18hoursafterreceipt.

4.9.6. RevocationCheckingRequirementforRelyingPartiesPriortorelyingontheinformationlistedinaCertificate,aRelyingPartyshallconfirmthevalidityofeachCertificateinthecertificatepathinaccordancewithIETFPKIXstandards,includingchecksforcertificatevalidity,issuer‐to‐subjectnamechaining,policyandkeyuseconstraints,andrevocationstatusthroughCRLsorOCSPrespondersidentifiedineachCertificateinthechain.

4.9.7. CRLIssuanceFrequencyCRLissuanceiscomprisedofCRLgenerationandpublication.ForIssuerCAsandonlineintermediateCAs,theintervalbetweenCRLissuanceshallnotexceed24hours.ForRootCAsandIntermediateCAsthatareoperatedinanoff‐linemanner,routineCRLsmaybeissuedlessfrequentlythanspecifiedabove,providedthattheCAonlyissuesCACertificates,certificate‐status‐checkingCertificates,andinternaladministrativeCertificates.CRLissuanceintervalsforsuchofflineCAsarenogreaterthan6months.However,theintervalbetweenroutineCRLissuanceforofflineCAschainingtotheFederalBridgeCAshallnotexceed31days,andsuchCAsmustmeettherequirementsspecifiedinsection4.9.12forissuingEmergencyCRLsandarerequiredtonotifytheDCPAuponEmergencyCRLissuance.

Page 30: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

24

4.9.8. MaximumLatencyforCRLsAllCRLsforCAschainingtotheFederalBridgeshallbepublishedwithinfourhoursofgeneration.Furthermore,eachCRLshallbepublishednolaterthanthetimespecifiedinthenextUpdatefieldofthepreviouslyissuedCRLforsamescope.

4.9.9. On‐lineRevocation/StatusCheckingAvailabilityTheIssuerCAshallensurethatthecertificatestatusinformationdistributedbyiton‐linemeetsorexceedstherequirementsforCRLissuanceandlatencystatedinsections4.9.5,4.9.7and4.9.8.Whereoffered,OCSPresponsetimesshallbenolongerthansixseconds.OCSPresponsesmustconformtoRFC6960and/orRFC5019.OCSPresponsesmusteither:1.BesignedbytheCAthatissuedtheCertificateswhoserevocationstatusisbeingchecked,or2.BesignedbyanOCSPResponderwhoseCertificateissignedbytheCAthatissuedtheCertificatewhoserevocationstatusisbeingchecked.Inthelattercase,theOCSPsigningCertificatemustcontainanextensionoftypeid‐pkix‐ocsp‐nocheck,asdefinedbyRFC6960and/orRFC5019.

4.9.10. On‐lineRevocationCheckingRequirementsArelyingpartyshallconfirmthevalidityofaCertificateviaCRLorOCSPinaccordancewithsection4.9.6priortorelyingontheCertificate.IssuerCAsshallsupportanOCSPcapabilityusingtheGETmethodforCertificatesissuedinaccordancewiththeBaselineRequirements.IftheOCSPresponderreceivesarequestforstatusofacertificatethathasnotbeenissued,thentherespondershallnotrespondwitha"good"status.

4.9.11. OtherFormsofRevocationAdvertisementsAvailableAnIssuerCAmayuseothermethodstopublicizerevokedCertificates,providedthat:

1. thealternativemethodisdescribedinitsCPS,2. thealternativemethodprovidesauthenticationandintegrityservicescommensuratewith

theassuranceleveloftheCertificatebeingverified,and3. thealternativemethodmeetstheissuanceandlatencyrequirementsforCRLsstatedin

sections4.9.5,4.9.7,and4.9.8.

4.9.12. SpecialRequirementsRelatedtoKeyCompromiseTheIssuerCAortheRAshallusecommerciallyreasonableeffortstonotifypotentialRelyingPartiesifitdiscoversorsuspectsthatitsPrivateKeyhasbeencompromised.TheIssuerCAmusthavetheabilitytotransitionanyrevocationreasontocodeto“keycompromise”.IfaCertificateisrevokedbecauseofcompromiseorsuspectedcompromise,theIssuerCAshallissueaCRLwithin18hoursafteritreceivesnoticeofthecompromiseorsuspectedcompromise.

4.9.13. CircumstancesforSuspensionNotapplicable.

4.9.14. WhoCanRequestSuspensionNotapplicable.

4.9.15. ProcedureforSuspensionRequestNotapplicable.

Page 31: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

25

4.9.16. LimitsonSuspensionPeriodNotapplicable.

4.10. CERTIFICATESTATUSSERVICES

4.10.1. OperationalCharacteristicsIssuerCAsshallmakecertificatestatusinformationavailableviaCRLorOCSP.TheIssuerCAshalllistrevokedCertificatesontheappropriateCRLwheretheyremainuntiloneadditionalCRLispublishedaftertheendoftheCertificate’svalidityperiod,exceptforCodeSigningCertificatesandEVCodeSigningCertificates,whichshallremainontheCRLforatleast10yearsfollowingtheCertificate’svalidityperiod.

4.10.2. ServiceAvailabilityIssuerCAsshallprovidecertificatestatusservices24x7withoutinterruption.ThisincludestheonlinerepositorythatapplicationsoftwarecanusetoautomaticallycheckthecurrentstatusofallunexpiredCertificatesissuedbytheIssuingCA.TheIssuingCAoperatesandmaintainsitsCRLandOCSPcapabilitywithresourcessufficienttoprovidearesponsetimeoftensecondsorlessundernormaloperatingconditions.TheIssuingCAshallmaintainacontinuous24x7abilitytorespondinternallytoahigh‐priorityCertificateProblemReport,andwhereappropriate,forwardsuchacomplainttolawenforcementauthorities,and/orrevokeaCertificatethatisthesubjectofsuchacomplaint.

4.10.3. OptionalFeaturesNostipulation.

4.11. ENDOFSUBSCRIPTIONTheIssuerCAshallallowSubscriberstoendtheirsubscriptiontocertificateservicesbyhavingtheirCertificaterevokedorbyallowingtheCertificateorapplicableSubscriberAgreementtoexpirewithoutrenewal.

4.12. KEYESCROWANDRECOVERY

4.12.1. KeyEscrowandRecoveryPolicyPracticesIssuerCAsshallnotescrowCAPrivateKeys.IssuerCAsmayescrowSubscriberkeymanagementkeystoprovidekeyrecoveryservices.IssuerCAsshallencryptandprotectescrowedPrivateKeyswithatleastthelevelofsecurityusedtogenerateanddeliverthePrivateKey.ForCertificatescross‐certifiedwiththeFBCA,thirdpartiesarenotpermittedtoholdtheSubscribersignaturekeysintrust.Subscribersandotherauthorizedentitiesmayrequestrecoveryofanescrowed(decryption)PrivateKey.EntitiesescrowingPrivateKeysshallhavepersonnelcontrolsinplacethatpreventunauthorizedaccesstoPrivateKeys.Keyrecoveryrequestscanonlybemadeforoneofthefollowingreasons:

1. TheSubscriberhaslostordamagedtheprivate‐keytoken,2. TheSubscriberisnotavailableorisnolongerpartoftheorganizationthatcontractedwith

theIssuerCAforPrivateKeyescrow,3. ThePrivateKeyispartofarequiredinvestigationoraudit,4. Therequesterhasauthorizationfromacompetentlegalauthoritytoaccessthe

communicationthatisencryptedusingthekey,5. Ifkeyrecoveryisrequiredbylaworgovernmentalregulation,or6. IftheentitycontractingwiththeIssuerCAforescrowofthePrivateKeyindicatesthatkey

recoveryismissioncriticalormissionessential.

Page 32: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

26

AnentityreceivingPrivateKeyescrowservicesshall:

1. NotifySubscribersthattheirPrivateKeysareescrowed,2. Protectescrowedkeysfromunauthorizeddisclosure,3. ProtectanyauthenticationmechanismsthatcouldbeusedtorecoverescrowedPrivateKeys,4. Releaseescrowedkeysonlyforproperlyauthenticatedandauthorizedrequestsfor

recovery,and5. Complywithanylegalobligationstodiscloseorkeepconfidentialescrowedkeys,escrowed

key‐relatedinformation,orthefactsconcerninganykeyrecoveryrequestorprocess.

4.12.2. SessionKeyEncapsulationandRecoveryPolicyandPracticesIssuerCAsthatsupportsessionkeyencapsulationandrecoveryshalldescribetheirpracticesintheirCPS.

5. FACILITY,MANAGEMENT,ANDOPERATIONALCONTROLS

5.1. PHYSICALCONTROLS

5.1.1. SiteLocationandConstructionTheIssuerCAshallperformitsCAoperationsfromasecuredatacenterequippedwithlogicalandphysicalcontrolsthatmaketheCAoperationsinaccessibletonon‐trustedpersonnel.Thesitelocationandconstruction,whencombinedwithotherphysicalsecurityprotectionmechanismssuchasguards,doorlocks,andintrusionsensors,shallproviderobustprotectionagainstunauthorizedaccesstoCAequipmentandrecords.RAsmustprotecttheirequipmentfromunauthorizedaccessinamannerthatisappropriatetothelevelofthreattotheRA,includingprotectingequipmentfromunauthorizedaccesswhilethecryptographicmoduleisinstalledandactivatedandimplementingphysicalaccesscontrolstoreducetheriskofequipmenttampering,evenwhenthecryptographicmoduleisnotinstalledandactivated.

5.1.2. PhysicalAccessEachIssuerCAandeachRAshallprotectitsequipment(includingcertificatestatusservers)fromunauthorizedaccessandshallimplementphysicalcontrolstoreducetheriskofequipmenttampering.TheIssuerCAandallRAsshallstoreallremovablemediaandpapercontainingsensitiveplain‐textinformationrelatedtoCAorRAoperationsinsecurecontainers.Thesecuritymechanismsshouldbecommensuratewiththelevelofthreattotheequipmentanddata.TheIssuerCAshallmanuallyorelectronicallymonitoritssystemsforunauthorizedaccessatalltimes,maintainanaccesslogthatisinspectedperiodically,andrequiretwo‐personphysicalaccesstotheCAhardwareandsystems.AnIssuerCAshalldeactivateandsecurelystoreitsCAequipmentwhennotinuse.ActivationdatamusteitherbememorizedorrecordedandstoredinamannercommensuratewiththesecurityaffordedthecryptographicmoduleandmustnotbestoredwiththecryptographicmoduleorremovablehardwareassociatedwithremoteworkstationsusedtoadministertheCAequipmentorPrivateKeys.IfthefacilityhousingtheCAequipmentiseverleftunattended,theIssuerCA’sadministratorsshallverifythat:

1. theCAisinastateappropriatetothecurrentmodeofoperation,2. thesecuritycontainersareproperlysecured3. physicalsecuritysystems(e.g.,doorlocks,ventcovers)arefunctioningproperly,and4. theareaissecuredagainstunauthorizedaccess.

TheIssuerCAshallmakeapersonorgroupofpersonsexplicitlyresponsibleformakingsecuritychecks.Ifagroupofpersonsisresponsible,theIssuerCAshallmaintainalogthatidentifieswhoperformedthesecuritycheck.Ifthefacilityisnotcontinuouslyattended,thelastpersontodepart

Page 33: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

27

shallinitialasign‐outsheetthatindicatesthedateandtimeandassertsthatallnecessaryphysicalprotectionmechanismsareinplaceandactivated.

5.1.3. PowerandAirConditioningTheIssuerCAshallmaintainabackuppowersupplyandsufficientenvironmentalcontrolstoprotecttheCAsystemsandallowtheCAtoautomaticallyfinishpendingoperationsandrecordthestateofequipmentbeforealackofpowerorairconditioningcausesashutdown.

5.1.4. WaterExposuresTheIssuerCAshallprotectitsCAequipmentfromwaterexposure.

5.1.5. FirePreventionandProtectionTheIssuerCAshallusefacilitiesequippedwithfiresuppressionmechanisms.

5.1.6. MediaStorageIssuerCAsandRAsshallprotectallmediafromaccidentaldamageandunauthorizedphysicalaccess.EachIssuerCAandeachRAshallduplicateandstoreitsauditandarchiveinformationinabackuplocationthatisseparatefromitsprimaryoperationsfacility.

5.1.7. WasteDisposalPaperwastecontainingsensitivedatashallbeshreddedbeforedisposal.Sensitivedataonmagneticorotherdigitalmediamustbepermanentlyerasedbeforedisposal.

5.1.8. Off‐siteBackupTheIssuerCAorRAshallmakeweeklysystembackupssufficienttorecoverfromsystemfailureandshallstorethebackups,includingatleastonefullbackupcopy,atanoffsitelocationthathasproceduralandphysicalcontrolsthatarecommensuratewithitsoperationallocation.

5.1.9. CertificateStatusHosting,CMSandExternalRASystemsAllphysicalcontrolrequirementsunderthisSection5.1applyequallytoanyCertificateStatusHosting,CMSorexternalRAsystem.

5.2. PROCEDURALCONTROLS

5.2.1. TrustedRolesCAandRApersonnelactingintrustedrolesincludeCAandRAsystemadministrationpersonnelandpersonnelinvolvedwithidentityvettingandtheissuanceandrevocationofCertificates.IssuerCAsandRAsshalldistributethefunctionsanddutiesperformedbypersonsintrustedrolesinawaythatpreventsonepersonfromcircumventingsecuritymeasuresorsubvertingthesecurityandtrustworthinessofthePKI.SeniormanagementoftheIssuerCAortheRAshallberesponsibleforappointingindividualstotrustedroles.Alistofsuchpersonnelshallbemaintainedandreviewedannually.ThefollowingfourtrustedrolesaredefinedbythisCP,althoughanIssuerCAorRAmaydefineadditionalones:

5.2.1.1. CA Administrators TheCAAdministratorisresponsiblefortheinstallationandconfigurationoftheCAsoftware,includingkeygeneration,userandCAaccounts,auditparameters,keybackup,andkeymanagement.TheCAAdministratorisresponsibleforperformingandsecurelystoringregularsystembackupsoftheCAsystem.AdministratorsmaynotissuecertificatestoSubscribers.

Page 34: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

28

5.2.1.2. Registration Officers – CMS, RA, Validation and Vetting Personnel TheRegistrationOfficerroleisresponsibleforissuingandrevokingCertificates,includingenrollment,identityverification,andcompliancewithrequiredissuanceandrevocationstepssuchasmanagingthecertificaterequestqueueandcompletingcertificateapprovalchecklistsasidentityvettingtasksaresuccessfullycompleted.

5.2.1.3. System Administrator/ System Engineer (Operator) TheSystemAdministrator,SystemEngineerorCAOperatorisresponsibleforinstallingandconfiguringCAsystemhardware,includingservers,routers,firewalls,andnetworkconfigurations.TheSystemAdministrator/Engineerisalsoresponsibleforkeepingsystemsupdatedwithsoftwarepatchesandothermaintenanceneededforsystemstabilityandrecoverability.

5.2.1.4. Internal Auditor Role TheInternalAuditorRoleisresponsibleforreviewing,maintaining,andarchivingauditlogsandperformingoroverseeinginternalcomplianceauditstodetermineiftheIssuerCAorRAisoperatinginaccordancewiththisCP.

5.2.1.5. RA Administrators RAAdministratorsinstall,configureandmanagetheRAsoftware,includingtheassignmentofIssuingCAsandcertificateprofilestocustomeraccounts.

5.2.2. NumberofPersonsRequiredperTaskEachIssuerCAshallrequirethatatleasttwopeopleactinginatrustedrole(oneshallbeaCAAdministratorandtheothercannotbeanInternalAuditor)takeactionrequiringatrustedrole,suchasactivatingtheIssuerCA’sPrivateKeys,generatingaCAKeyPair,orcreatingabackupofaCAPrivateKey.TheInternalAuditormayservetofulfilltherequirementofmultipartycontrolforphysicalaccesstotheCAsystem,butlogicalaccessshallnotbeachievedusingpersonnelthatserveintheInternalAuditorrole.

5.2.3. IdentificationandAuthenticationforeachRoleIssuerCApersonnelshallauthenticatethemselvestothecertificatemanagementsystembeforetheyareallowedaccesstothesystemsnecessarytoperformtheirtrustedroles.

5.2.4. RolesRequiringSeparationofDutiesIndividualpersonnelshallbespecificallydesignatedtothefourrolesdefinedinSection5.2.1above.AnindividualmayassumeonlyoneoftheRegistrationOfficer,Administrator,orInternalAuditorroles.IndividualsdesignatedasRegistrationOfficerorAdministratormayalsoassumetheOperatorrole.AnInternalAuditormaynotassumeanyotherrole.TheIssuerCAandRAmayenforceseparationofdutiesusingCAequipment,procedurally,orbybothmeans.TheCAandRAsoftwareandhardwareshallidentifyandauthenticateitsusersandshallensurethatnouseridentitycanassumebothanAdministratorandaRegistrationOfficerrole,assumeboththeAdministratorandInternalAuditorroles,orassumeboththeInternalAuditorandRegistrationOfficerroles.Anindividualmaynothavemorethanoneidentity.

5.3. PERSONNELCONTROLS

5.3.1. Qualifications,Experience,andClearanceRequirementsTheDCPAisresponsibleandaccountablefortheoperationoftheDigiCertPKIandcompliancewiththisCP.IssuerCAandRApersonnelandmanagementwhopurporttoactwithinthescopeofthisdocumentshallbeselectedonthebasisofloyalty,trustworthiness,andintegrity.AlltrustedrolesforIssuerCAsissuingFederatedDeviceCertificates,ClientCertificatesatLevels3‐USand4‐US(whichareintendedforinteroperabilitythroughtheFederalBridgeCAatid‐fpki‐certpcy‐mediumAssurance

Page 35: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

29

andid‐fpki‐certpcy‐mediumHardware)shallbeheldbycitizensoftheUnitedStatesorthecountrywheretheIssuerCAislocated.Inadditiontotheabove,anindividualperformingatrustedroleforanRAmaybeacitizenofthecountrywheretheRAislocated.ThereisnocitizenshiprequirementforIssuerCAorRApersonnelperformingtrustedrolesassociatedwiththeissuanceofSSL/TLSServer,CodeSigningorClientCertificatesatLevels1,2,3‐CBP,and4‐CBP.Managerialpersonnelinvolvedintime‐stampingoperationsmustpossessexperiencewithinformationsecurityandriskassessmentandknowledgeoftime‐stampingtechnology,digitalsignaturetechnology,mechanismsforcalibrationoftimestampingclockswithUTC,andsecurityprocedures.TheIssuerCAortheRAshallensurethatallindividualsassignedtotrustedroleshavetheexperience,qualifications,andtrustworthinessrequiredtoperformtheirdutiesunderthisCP.

5.3.2. BackgroundCheckProceduresTheIssuerCAandRAshallrequireeachpersonfulfillingatrustedroletoundergoidentityverification,backgroundchecks,andadjudicationpriortoactingintherole,includingverificationoftheindividual’sidentity,employmenthistory,education,characterreferences,socialsecuritynumber,previousresidences,drivingrecords,andcriminalbackground.TheIssuerCAorRAshallrequireeachindividualtoappearin‐personbeforeatrustedagentwhoseresponsibilityitisverifyidentity.Thetrustedagentshallverifytheidentityoftheindividualusingatleastoneformofgovernment‐issuedphotoidentification.Checksofpreviousresidencesareoverthepastthreeyears.Allotherchecksareforthepriorfiveyears.TheIssuerCAorRAshallverifythehighesteducationdegreeobtainedregardlessofthedateawardedandshallrefreshallbackgroundchecksatleasteverytenyears.Basedupontheinformationobtained,acompetentadjudicationauthoritywithintheIssuerCAorRAshalladjudicatewhethertheindividualissuitableforthepositiontowhichtheywillbeassigned.

5.3.3. TrainingRequirementsTheIssuerCAshallprovideskillstrainingtoallpersonnelinvolvedintheIssuerCA’sPKIoperations.Thetrainingmustrelatetotheperson’sjobfunctionsandcover:

1. basicPublicKeyInfrastructure(PKI)knowledge,2. softwareversionsusedbytheIssuerCA,3. authenticationandverificationpoliciesandprocedures,4. CA/RAsecurityprinciplesandmechanisms,5. disasterrecoveryandbusinesscontinuityprocedures,6. commonthreatstothevalidationprocess,includingphishingandothersocialengineering

tactics,and7. CA/BrowserForumGuidelinesandotherapplicableindustryandgovernmentguidelines.

IssuerCAsshallmaintainarecordofwhoreceivedtrainingandwhatleveloftrainingwascompleted.IssuerCAsandRAsshallensurethatRegistrationOfficershavetheminimumskillsnecessarytosatisfactorilyperformvalidationdutiesbeforetheyaregrantedvalidationprivileges.Wherecompetencewasdemonstratedinlieuoftraining,theIssuerCAorRAmustmaintainsupportingdocumentation.IssuerCAsshallrequireallRegistrationOfficerstopassanexaminationprovidedbytheIssuerCAontheinformationverificationrequirementsoutlinedintheBaselineRequirements.IssuerCAsandRAsinvolvedwiththeoperationofCMSshallensurethatallpersonnelwhoperformdutiesinvolvingtheCMSreceivecomprehensivetraining.IssuerCAsandRAsshallcreateatraining(awareness)plantoaddressanysignificantchangetoCMSoperationsandshalldocumenttheexecutionoftheplan.

5.3.4. RetrainingFrequencyandRequirementsPersonnelmustmaintainskilllevelsthatareconsistentwithindustry‐relevanttrainingandperformanceprogramsinordertocontinueactingintrustedroles.TheIssuerCAorRAshallmake

Page 36: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

30

individualsactingintrustedrolesawareofanychangestotheIssuerCA’sorRA’soperations.Ifsuchoperationschange,theIssuerCAorRAshallprovidedocumentedtraining,inaccordancewithanexecutedtrainingplan,toalltrustedroles.

5.3.5. JobRotationFrequencyandSequenceNostipulation.

5.3.6. SanctionsforUnauthorizedActionsIssuerCAorRAemployeesandagentsfailingtocomplywiththisCP,whetherthroughnegligenceormaliciousintent,shallbesubjecttoadministrativeordisciplinaryactions,includingterminationofemploymentoragencyandcriminalsanctions.Ifapersoninatrustedroleiscitedbymanagementforunauthorizedorinappropriateactions,thepersonwillbeimmediatelyremovedfromthetrustedrolependingmanagementreview.Aftermanagementreviewsanddiscussestheincidentwiththetrustedpersonnel,managementmayreassigntheemployeetoanon‐trustedroleordismisstheindividualfromemploymentasappropriate.

5.3.7. IndependentContractorRequirementsAnyIssuerCAorRAallowingindependentcontractorstobeassignedtoperformtrustedrolesshallrequirethattheyagreetotheobligationsunderthisSection5(Facility,Management,andOperationalControls)andthesanctionsstatedaboveinSection5.3.6.

5.3.8. DocumentationSuppliedtoPersonnelIssuerCAsandRAsshallprovidepersonnelintrustedroleswiththedocumentationnecessarytoperformtheirduties.

5.4. AUDITLOGGINGPROCEDURES

5.4.1. TypesofEventsRecordedIssuerCAandRAsystems(includinganyCMS)shallrequireidentificationandauthenticationatsystemlogon.Importantsystemactionsshallbeloggedtoestablishtheaccountabilityoftheoperatorswhoinitiatesuchactions.IssuerCAsandRAsshallenableallessentialeventauditingcapabilitiesofitsCAorRAapplicationsinordertorecordalleventsrelatedtothesecurityoftheCAorRA,includingthoselistedbelow.AmessagefromanysourcereceivedbytheIssuerCArequestinganactionrelatedtotheoperationalstateoftheCAisanauditableevent.IftheIssuerCA’sapplicationscannotautomaticallyrecordanevent,theIssuerCAshallimplementmanualprocedurestosatisfytherequirements.Foreachevent,theIssuerCAshallrecordtherelevant(i)dateandtime,(ii)typeofevent,(iii)successorfailure,and(iv)userorsystemthatcausedtheeventorinitiatedtheaction.TheIssuerCAshallmakealleventrecordsavailabletoitsauditorsasproofoftheIssuerCA’spractices.

AuditableEventSECURITYAUDITAnychangestotheauditparameters,e.g.,auditfrequency,typeofeventauditedAnyattempttodeleteormodifytheauditlogsAUTHENTICATIONTOSYSTEMSSuccessfulandunsuccessfulattemptstoassumearoleThevalueofmaximumnumberofauthenticationattemptsischangedMaximumnumberofauthenticationattemptsoccurduringuserloginAnadministratorunlocksanaccountthathasbeenlockedasaresultofunsuccessfulauthenticationattemptsAnadministratorchangesthetypeofauthenticator,e.g.,fromapasswordtoabiometricLOCALDATAENTRYAllsecurity‐relevantdatathatisenteredinthesystem

Page 37: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

31

AuditableEventREMOTEDATAENTRYAllsecurity‐relevantmessagesthatarereceivedbythesystemDATAEXPORTANDOUTPUTAllsuccessfulandunsuccessfulrequestsforconfidentialandsecurity‐relevantinformationKEYGENERATIONWheneveraCAgeneratesakey(notmandatoryforsinglesessionorone‐timeusesymmetrickeys)CAKEYLIFECYCLEMANAGEMENTKeygeneration,backup,storage,recovery,archival,anddestructionCryptographicdevicelifecyclemanagementeventsCAANDSUBSCRIBERCERTIFICATELIFECYCLEMANAGEMENTAllverificationactivitiesstipulatedintheBaseline RequirementsandthisCPSDate,time,phonenumberused,personsspokento,andendresultsofverificationtelephonecallsAcceptanceandrejectionofcertificaterequestsIssuanceofCertificatesGenerationofCertificateRevocationListsandOCSPentries.PRIVATEKEYLOADANDSTORAGETheloadingofComponentPrivateKeysAllaccesstocertificatesubjectPrivateKeysretainedwithintheCAforkeyrecoverypurposesTRUSTEDPUBLICKEYENTRY,DELETIONANDSTORAGESECRETKEYSTORAGEThemanualentryofsecretkeysusedforauthenticationPRIVATEANDSECRETKEYEXPORTTheexportofprivateandsecretkeys(keysusedforasinglesessionormessageareexcluded)CERTIFICATEREGISTRATIONAllcertificaterequests,includingissuance,re‐key,renewal,andrevocationCertificateissuanceVerificationactivitiesCERTIFICATEREVOCATIONAllcertificaterevocationrequestsCERTIFICATESTATUSCHANGEAPPROVALORREJECTIONCACONFIGURATIONAnysecurity‐relevantchangestotheconfigurationofaCAsystemcomponentACCOUNTADMINISTRATIONRolesandusersareaddedordeletedTheaccesscontrolprivilegesofauseraccountorarolearemodified CERTIFICATEPROFILEMANAGEMENTAllchangestothecertificateprofileREVOCATIONPROFILEMANAGEMENTAllchangestotherevocationprofileCERTIFICATEREVOCATIONLISTPROFILEMANAGEMENTAllchangestothecertificaterevocationlistprofileGenerationofCRLsandOCSPentriesTIMESTAMPINGClocksynchronizationMISCELLANEOUSAppointmentofanindividualtoaTrustedRoleDesignationofpersonnelformultipartycontrolInstallationofanOperatingSystem

Page 38: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

32

AuditableEventInstallationofaPKIApplicationInstallationofaHardwareSecurityModulesRemovalofHSMsDestructionofHSMsSystemStartupLogonattemptstoPKIApplicationReceiptofhardware/softwareAttemptstosetpasswordsAttemptstomodifypasswordsBackupoftheinternalCAdatabaseRestorationfrombackupoftheinternalCAdatabase Filemanipulation (e.g.,creation,renaming,moving)PostingofanymaterialtoarepositoryAccesstotheinternalCAdatabaseAllcertificatecompromisenotificationrequestsLoadingHSMswithCertificatesShipmentofHSMsZeroizingHSMsRe‐keyoftheComponentCONFIGURATIONCHANGESHardwareSoftwareOperatingSystemPatchesSecurityProfilesPHYSICALACCESS/SITESECURITYPersonnelaccesstosecureareahousingCAcomponentsAccesstoaCAcomponentKnownorsuspectedviolationsofphysicalsecurityFirewallandrouteractivitiesEntriestoandexitsfromtheCAfacility,PKIandsecuritysystemactionsperformedANOMALIESSystemcrashesandhardwarefailuresSoftwareerrorconditionsSoftwarecheckintegrityfailuresReceiptofimpropermessagesandmisroutedmessagesNetworkattacks(suspectedorconfirmed)EquipmentfailureElectricalpoweroutagesUninterruptiblePowerSupply(UPS)failureObviousandsignificantnetworkserviceoraccessfailuresViolationsofaCPorCPSResettingOperatingSystemclock

5.4.2. FrequencyofProcessingLogTheIssuerCAorRAshall,atleasteverytwomonths,reviewsystemlogs,makesystemandfileintegritychecks,andmakeavulnerabilityassessment.TheIssuerCAorRAmayuseautomatedtoolstoscanforanomaliesorspecificconditions.Duringitsreview,theIssuerCAorRAshallverifythatthelogshavenotbeentamperedwith,examineanystatisticallysignificantsetofsecurityauditdatageneratedsincethelastreview,andmakeareasonablesearchforanyevidenceofmaliciousactivity.TheIssuerCAorRAshallbrieflyinspectalllogentriesandinvestigateanydetectedanomaliesor

Page 39: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

33

irregularities.TheIssuerCAorRAshallmakeasummaryofthereviewavailabletoitsauditorsuponrequest.TheIssuerCAofRAshalldocumentanyactionstakenasaresultofareview.

5.4.3. RetentionPeriodforAuditLogTheIssuerCAandRAshallretainauditlogson‐siteuntilaftertheyarereviewed.AuditlogsrelatedtopubliclytrustedSSL/TLScertificatesshallberetainedforatleastseven(7)years.TheindividualwhoremovesauditlogsfromtheIssuerCA’sorRA’ssystemsmustbedifferentthantheindividualswhocontroltheIssuerCA’ssignaturekeys.

5.4.4. ProtectionofAuditLogTheIssuerCAandRAshallimplementproceduresthatprotectarchiveddatafromdestructionpriortotheendoftheauditlogretentionperiod.TheIssuerCAandRAshallconfigureitssystemsandestablishoperationalprocedurestoensurethat(i)onlyauthorizedpeoplehavereadaccesstologs,(ii)onlyauthorizedpeoplemayarchiveauditlogs,and(iii)auditlogsarenotmodified.TheIssuerCA’soff‐sitestoragelocationmustbeasafeandsecurelocationthatisseparatefromthelocationwherethedatawasgenerated.TheIssuerCAandRAshallmakerecordsavailableifrequiredforthepurposeofprovidingevidenceofthecorrectoperationoftime‐stampingservicesforthepurposeoflegalproceedings.TheIssuerCAshallmakeitsauditlogsavailabletoauditorsuponrequest.

5.4.5. AuditLogBackupProceduresOnatleastamonthlybasis,theIssuerCAandRAshallmakebackupsofauditlogsandauditlogsummariesandsaveacopyoftheauditlogtoasecure,off‐sitelocation.

5.4.6. AuditCollectionSystem(internalvs.external)TheIssuerCAorRAmayuseautomaticauditprocesses,providedthattheyareinvokedatsystemstartupandendonlyatsystemshutdown.Ifanautomatedauditsystemfailsandtheintegrityofthesystemorconfidentialityoftheinformationprotectedbythesystemisatrisk,theDCPAshallbenotifiedanddeterminewhethertosuspendtheIssuerCA’sorRA’soperationsuntiltheproblemisremedied.

5.4.7. NotificationtoEvent‐causingSubjectNostipulation.

5.4.8. VulnerabilityAssessmentsTheIssuerCAshallperformroutineriskassessmentsthatidentifyandassessreasonablyforeseeableinternalandexternalthreatsthatcouldresultinunauthorizedaccess,disclosure,misuse,alteration,ordestructionofanycertificatedataorcertificateissuanceprocess.TheIssuerCAshallalsoroutinelyassessthesufficiencyofthepolicies,procedures,informationsystems,technology,andotherarrangementsthattheIssuerCAhasinplacetocontrolsuchrisks.TheIssuerCA’sauditorsshouldreviewthesecurityauditdatachecksforcontinuityandalerttheappropriatepersonnelofanyevents,suchasrepeatedfailedactions,requestsforprivilegedinformation,attemptedaccessofsystemfiles,andunauthenticatedresponses.

5.5. RECORDSARCHIVALTheIssuerCAshallcomplywithanyrecordretentionpoliciesthatapplybylaw.TheIssuerCAshallincludesufficientdetailinarchivedrecordstoshowthataCertificatewasissuedinaccordancewiththeCPS.

5.5.1. TypesofRecordsArchivedTheIssuerCAshallretainthefollowinginformationinitsarchives(assuchinformationpertainstotheIssuerCA’sCAoperations):

1. AnyaccreditationoftheIssuerCA,

Page 40: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

34

2. CPandCPSversions,3. ContractualobligationsandotheragreementsconcerningtheoperationoftheCA,4. Systemandequipmentconfigurations,modifications,andupdates,5. Certificateissuance,rekey,renewal,andrevocationrequests,6. Rejectionoracceptanceofacertificaterequest,7. Identityauthenticationdata,8. AnydocumentationrelatedtothereceiptoracceptanceofaCertificateortoken,9. SubscriberAgreements,10. Issuedcertificates,11. Arecordofcertificatere‐keys,12. CRLsforCAscross‐certifiedwiththeFederalBridgeCA,13. Anydataorapplicationsnecessarytoverifyanarchive’scontents,14. Complianceauditorreports,15. AnychangestotheIssuerCA’sauditparameters,16. Anyattempttodeleteormodifyauditlogs,17. CAKeygenerationanddestruction,18. AccesstoPrivateKeysforkeyrecoverypurposes,19. ChangestotrustedPublicKeys,20. ExportofPrivateKeys,21. Approvalorrejectionofarevocationrequest,22. Appointmentofanindividualtoatrustedrole,23. Destructionofacryptographicmodule,24. Certificatecompromisenotifications,25. Remedialactiontakenasaresultofviolationsofphysicalsecurity,and26. ViolationsoftheCPorCPS.

5.5.2. RetentionPeriodforArchiveTheIssuerCAshallretainarchiveddataassociatedwithLevel3,Level4,andfederateddeviceCertificatesfor10.5years.ForallotherCertificates,theIssuerCAshallretainarchiveddataforatleast7.5years.RAssupportingCertificatesthatarenotcross‐certifiedwiththeFBCAmayretainarchiveddataforashorterperiodoftimeifthepracticeisdocumentedinaRPSordocumentretentionpolicy.

5.5.3. ProtectionofArchiveTheIssuerCAshallstoreitsarchivedrecordsatasecureoff‐sitelocationinamannerthatpreventsunauthorizedmodification,substitution,ordestruction.Nounauthorizedusermayaccess,write,ordeletethearchives.Iftheoriginalmediacannotretainthedatafortherequiredperiod,thearchivesitemustdefineamechanismtoperiodicallytransferthearchiveddatatonewmedia.TheIssuerCAshallmaintainanysoftwareapplicationrequiredtoprocessthearchivedatauntilthedataiseitherdestroyedortransferredtoanewermedium.

5.5.4. ArchiveBackupProceduresIfanIssuerCAorRAchoosestobackupitsarchiverecords,thentheIssuerCAorRAshalldescribehowitsrecordsarebackedupandmanagedinitsCPSorareferenceddocument.

5.5.5. RequirementsforTime‐stampingofRecordsTheIssuerCAshallautomaticallytime‐stamparchiverecordsastheyarecreated.Cryptographictime‐stampingofarchiverecordsisnotrequired;however,theIssuerCAshallsynchronizeitssystemtimeatleasteveryeighthoursusingarealtimevaluetraceabletoarecognizedUTC(k)laboratoryorNationalMeasurementInstitute.

5.5.6. ArchiveCollectionSystem(internalorexternal)TheIssuerCAshallcollectarchiveinformationinternally.

Page 41: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

35

5.5.7. ProcedurestoObtainandVerifyArchiveInformationTheIssuerCAmayarchivedatamanuallyorautomatically.Ifautomaticarchivalisimplemented,theIssuerCAshallsynchronizeitsarchiveddataonadailybasis.TheIssuerCAmayallowSubscriberstoobtainacopyoftheirarchivedinformation.Otherwise,theIssuerCAshallrestrictaccesstoarchivedatatoauthorizedpersonnelinaccordancewiththeIssuerCA'sinternalsecuritypolicyandshallnotreleaseanyarchivedinformationexceptasallowedbylaw.CAsshallstateintheirCPSthedetailsofhowtheycreate,verify,package,transmit,andstorearchivedinformation.

5.6. KEYCHANGEOVERTheIssuerCAshallperiodicallychangeitsPrivateKeysinamannersetforthintheCPSthatpreventsdowntimeintheIssuerCA’soperation.Afterkeychangeover,theIssuerCAshallsignCertificatesusingonlythenewkey.TheIssuerCAshallstillprotectitsoldPrivateKeysandshallmaketheoldCertificateavailabletoverifysignaturesuntilalloftheCertificatessignedwiththePrivateKeyhaveexpired.IssuerCAscross‐certifiedwiththeFBCAmustbeabletocontinuetointeroperatewiththeFBCAaftertheFBCAperformsakeyrollover,whetherornottheFBCADNischanged.IssuerCAseithermustestablishkeyrolloverCertificatesasdescribedaboveormustobtainanewCACertificateforthenewPublicKeyfromtheissuersoftheircurrentCertificates.

5.7. COMPROMISEANDDISASTERRECOVERY

5.7.1. IncidentandCompromiseHandlingProceduresTheIssuerCAshalldevelopandimplementprocedurestobefollowedintheeventofaserioussecurityincidentorsystemcompromise.Requireddocumentationincludes,butisnotlimitedto,anIncidentResponsePlan,aDisasterRecoveryorBusinessContinuityPlan(DR/BCP),andrelatedresources.TheIssuerCAshallreview,test,andupdateitsIncidentResponsePlanandDR/BCP,andsupportingprocedures,atleastannually.TheIssuerCAshallrequirethatanyCMShavedocumentedincidenthandlingproceduresthatareapprovedbytheheadoftheorganizationresponsibleforoperatingtheCMS.IftheCMSiscompromised,theIssuerCAshallrevokeallCertificatesissuedtotheCMS,ifapplicable.TheIssuerCAanditsRAsshallalsoassessanydamagecausedbytheCMScompromise,revokeallpotentiallycompromisedSubscriberCertificates,notifyaffectedsubscribersoftherevocation,andre‐establishtheoperationoftheCMS.

5.7.2. ComputingResources,Software,and/orDataAreCorruptedTheIssuerCAshallmakeregularback‐upcopiesofitsPrivateKeysandstoretheminasecureoff‐sitelocation.TheIssuerCAshallalsomakeregularsystemback‐upsonatleastaweeklybasis.IfadisastercausestheIssuerCA’soperationstobecomeinoperative,theIssuerCAshall,afterensuringtheintegrityoftheCAsystems,re‐initiateitsoperationsonreplacementhardwareusingbackupcopiesofitssoftware,data,andPrivateKeysatasecurefacility.TheIssuerCAshallgiveprioritytoreestablishingthegenerationofcertificatestatusinformation.IfthePrivateKeysaredestroyed,theIssuerCAshallreestablishoperationsasquicklyaspossible,givingprioritytogeneratingnewKeyPairs.

5.7.3. EntityPrivateKeyCompromiseProceduresIftheIssuerCAsuspectsthataCAPrivateKeyiscomprisedorlostthentheIssuerCAshallfollowitsIncidentResponsePlanandimmediatelyassessthesituation,determinethedegreeandscopeoftheincident,andtakeappropriateaction.IssuerCApersonnelshallreporttheresultsoftheinvestigation.Thereportmustdetailthecauseofthecompromiseorlossandthemeasuresshouldbetakentopreventareoccurrence.Ifthereisacompromiseorloss,theIssuerCAshallnotifyany

Page 42: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

36

affiliatedentitiessothattheymayissueCRLsrevokingcross‐CertificatesissuedtotheIssuerCAandshallnotifyinterestedpartiesandmakeinformationavailablethatcanbeusedtoidentifywhichCertificatesandtime‐stamptokensaffected,unlessdoingsowouldbreachtheprivacyoftheIssuerCA’suserorthesecurityoftheIssuerCA’sservices.FollowingrevocationofaCACertificateandimplementationoftheIssuerCA’sIncidentResponsePlan,theIssuerCAshallgenerateanewCAKeyPairandsignanewCACertificateinaccordancewithitsCPS.TheIssuerCAshalldistributethenewself‐signedCertificateinaccordancewithSection6.1.4.TheIssuerCAshallceaseitsCAoperationsuntilappropriatestepsaretakentorecoverfromthecompromiseandrestoresecurity.

5.7.4. BusinessContinuityCapabilitiesafteraDisasterStatedgoalsoftheIssuerCA’sDR/BCPshallincludethatcertificatestatusservicesbeminimallyaffectedbyanydisasterinvolvingtheIssuerCA’sprimaryfacilityandthatotherservicesresumeasquicklyaspossiblefollowingadisaster.TheIssuerCAshallestablishasecurefacilityinatleastonesecondary,geographicallydiverselocationtoensurethatitsdirectoryandon‐linestatusservers,ifany,remainoperationalintheeventofaphysicaldisasterattheIssuerCA’smainsite.TheIssuerCAshallprovidenoticeattheearliestfeasibletimetoallinterestedpartiesifadisasterphysicallydamagestheIssuerCA’sequipmentordestroysallcopiesoftheIssuerCA’ssignaturekeys.

5.8. CAORRATERMINATIONIfanIssuerCA’soperationsareterminated,theIssuerCAshallprovidenoticetointerestedpartiesandshalltransferitsresponsibilitiesandrecordstosuccessorentities.TheIssuerCAmayallowasuccessortore‐issueCertificatesifthesuccessorhasallrelevantpermissionstodosoandhasoperationsthatareatleastassecuretheIssuerCA’s.Ifaqualifiedsuccessordoesnotexist,theIssuerCAshalltransferallrelevantrecordstoagovernmentsupervisoryorlegalbody.

6. TECHNICALSECURITYCONTROLS

6.1. KEYPAIRGENERATIONANDINSTALLATION

6.1.1. KeyPairGenerationAllkeysmustbegeneratedusingaFIPS‐approvedmethodorequivalentinternationalstandard.IssuerCAsshallgeneratecryptographickeyingmaterialonaFIPS140level3validatedcryptographicmoduleusingmultipleindividualsactingintrustedroles.Whengeneratingkeymaterial,theIssuerCAshallcreateauditableevidencetoshowthattheIssuerCAenforcedroleseparationandfolloweditskeygenerationprocess.AnindependentthirdpartyshallvalidatethateachCAkey,includinganyrootorintermediateCAkeysassociatedwithaCertificatecross‐certifiedwiththeFBCAandeachRootCAKey(forCertificatesnotcross‐certifiedwiththeFBCA),isgeneratedinaccordancewiththisCPeitherbyhavingtheindependentthirdpartywitnessthekeygenerationorbyexaminingasignedanddocumentedrecordofthekeygeneration.SubscriberswhogeneratetheirownkeysshalluseaFIPS‐approvedmethodandeitheravalidatedhardwareorvalidatedsoftwarecryptographicmodule,dependingonthelevelofassurancedesired.KeysforLevel3HardwareorLevel4BiometricCertificatesmustbegeneratedonvalidatedhardwarecryptographicmodulesusingaFIPS‐approvedmethod.SubscriberswhogeneratetheirownkeysforaQualifiedCertificateonanSSCDshallensurethattheSSCDmeetstherequirementsofCWA14169andthatthePublicKeytobecertifiedisfromtheKeyPairgeneratedbytheSSCD.

Page 43: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

37

6.1.2. PrivateKeyDeliverytoSubscriberIftheIssuerCA,aCMS,oranRAgenerateskeysonbehalfoftheSubscriber,thentheentitygeneratingthekeyshalldeliverthePrivateKeysecurely(encrypted)totheSubscriber.TheentitymaydeliverPrivateKeystoSubscriberselectronicallyoronahardwarecryptographicmodule/SSCD.Inallcases:

1. Exceptwhereescrow/backupservicesareprovided,thekeygeneratormaynotretainacopyoftheSubscriber’sPrivateKeyafterdelivery,

2. ThekeygeneratorshallprotectthePrivateKeyfromactivation,compromise,ormodificationduringthedeliveryprocess,

3. TheSubscribershallacknowledgereceiptofthePrivateKey(s),and4. ThekeygeneratorshalldeliverthePrivateKeyinawaythatensuresthatthecorrecttokens

andactivationdataareprovidedtothecorrectSubscribers,including:a. Forhardwaremodules,thekeygeneratormaintainingaccountabilityforthe

locationandstateofthemoduleuntiltheSubscriberacceptspossessionofitandb. ForelectronicdeliveryofPrivateKeys,thekeygeneratorencryptingkeymaterial

usingacryptographicalgorithmandkeysizeatleastasstrongasthePrivateKey.Thekeygeneratorshalldeliveractivationdatausingaseparatesecurechannel.

TheentityassistingwithSubscriberkeygenerationshallmaintainarecordoftheSubscriber’sacknowledgementofreceiptofthedevicecontainingtheSubscriber’sKeyPair.ACMSorRAprovidingkeydeliveryservicesshallprovideacopyofthisrecordtotheIssuerCA.

6.1.3. PublicKeyDeliverytoCertificateIssuerSubscribersshalldelivertheirPublicKeystotheIssuerCAinasecurefashionandinamannerthatbindstheSubscriber’sverifiedidentitytothePublicKey.ThecertificaterequestprocessshallensurethattheApplicantpossessesthePrivateKeyassociatedwiththePublicKeypresentedforcertification.Ifcryptographyisusedtoachievethebinding,thecryptographymustbeatleastasstrongastheCAkeysusedtosigntheCertificate.

6.1.4. CAPublicKeyDeliverytoRelyingPartiesTheIssuerCAshallprovideitsPublicKeystoRelyingPartiesinasecurefashionandinamannerthatprecludessubstitutionattacks.TheIssuerCAmaydeliveritsCAPublicKeystoRelyingPartiesas(i)specifiedinacertificatevalidationorpathdiscoverypolicyfile,(ii)trustanchorsincommercialbrowsersandoperatingsystemrootstores,and/or(iii)rootssignedbyotherCAs.TheIssuerCAmaydistributePublicKeysthatarepartofanupdatedsignatureKeyPairasaself‐signedCertificate,asanewCACertificate,orinakeyroll‐overCertificate.AllaccreditationauthoritiessupportingDigiCertCertificatesandallapplicationsoftwareprovidersarepermittedtoredistributeanyRootCertificatethatisissuedunderthisCP.

6.1.5. KeySizesForsigningCertificatesissuedwithinthepolicyOIDarcsof2.16.840.1.114412.1,2.16.840.1.114412.2,or2.16.840.1.114412.4,andforsigningCRLsandcertificatestatusserverresponsesforsuchCertificates,theIssuerCAsshalluseatleasta2048‐bitRSAKeyor384‐bitECDSAKeywithSHA‐256(orahashalgorithmthatisequallyormoreresistanttoacollisionattack).TheIssuerCAshallonlyissueend‐entityCertificatesthatcontainatleast2048‐bitPublicKeysforRSA,DSA,orDiffie‐Hellman,or224bitsforellipticcurvealgorithms.TheIssuerCAmayrequirehigherbitkeysinitssolediscretion.AnyCertificates(exceptRootCACertificates)expiringafter12/31/2030mustbeatleast3072‐bitforRSAand256‐bitforECDSA.TheIssuerCAandSubscribersmayfulfillthetransmissionsecurityrequirementsofthisCPusingTLSoranotherprotocolthatprovidessimilarsecurity,providedtheprotocolrequiresatleastAES128

Page 44: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

38

bitsorequivalentforthesymmetrickeyandatleast2048‐bitRSAorequivalentfortheasymmetrickeys(andatleast3072‐bitRSAorequivalentforasymmetrickeysafter12/31/2030).

6.1.6. PublicKeyParametersGenerationandQualityCheckingTheIssuerCAshallgeneratePublicKeyparametersforsignaturealgorithms(thevalueofthispublicexponentshallbeanoddnumberequaltothreeormore)andperformparameterqualitycheckinginaccordancewithFIPS186.

6.1.7. KeyUsagePurposes(asperX.509v3keyusagefield)TheIssuerCAshallincludekeyusageextensionfieldsthatspecifytheintendeduseoftheCertificateandtechnicallylimittheCertificate’sfunctionalityinX.509v3‐compliantsoftware.TheuseofaspecifickeyisdeterminedbythekeyusageextensionintheX.509Certificate.PrivateKeyscorrespondingtoRootCACertificatesmustnotbeusedtosignCertificatesexceptinthefollowingcases:1.Self‐signedCertificatestorepresenttheRootCAitself;2.CertificatesforSubordinateCAsandCrossCertificates;3.Certificatesforinfrastructurepurposes(e.g.administrativerolecertificates,internalCAoperationaldevicecertificates;and4.CertificatesforOCSPResponseverificationCACertificatesshallhavetwokeyusagebitsset:keyCertSignandcRLSign,andforsigningOCSPresponses,theCertificateshallalsosetthedigitalSignaturebit.TheIssuerCAshallnotissueLevel4Certificatesthatarecertifiedforbothsigningandencryption.Theuseofasinglekeyforencryptionandsignatureisdiscouraged,andIssuerCAsshouldissueSubscriberstwoKeyPairs—oneforkeymanagementandonefordigitalsignatureandauthentication.However,forsupportoflegacyapplications,otherCertificates,includingthoseatLevels1,2and3,mayincludeasinglekeyforusewithencryptionandsignature.Suchdual‐useCertificatesmust:

1. begeneratedandmanagedinaccordancewiththeirrespectivesignaturecertificaterequirements,exceptwhereotherwisenotedinthisCP,

2. neverassertthenon‐repudiationkeyusagebit,and3. notbeusedforauthenticatingdatathatwillbeverifiedonthebasisofthedual‐use

Certificateatafuturetime.SubscriberCertificatesassertkeyusagesbasedontheintendedapplicationoftheKeyPair.Inparticular,Certificatestobeusedfordigitalsignatures(includingauthentication)setthedigitalSignatureand/ornonRepudiationbits.CertificatestobeusedforkeyordataencryptionshallsetthekeyEnciphermentand/ordataEnciphermentbits.CertificatestobeusedforkeyagreementshallsetthekeyAgreementbit.

6.2. PRIVATEKEYPROTECTIONANDCRYPTOGRAPHICMODULEENGINEERINGCONTROLS

6.2.1. CryptographicModuleStandardsandControlsTheIssuerCAandallsystemsthatsignOCSPresponsesorCRLsinordertoprovidecertificatestatusservicesshallusecryptographichardwaremodulesvalidatedtoFIPS140‐2Level3andInternationalCommonCriteria(CC)InformationTechnologySecurityEvaluationAssuranceLevel(EAL)14169EAL4+Type3(EAL4AugmentedbyAVA_VLA.4andAVA_MSU.3)intheEuropeanUnion(EU).

Page 45: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

39

Cryptographicmodulerequirementsforsubscribersandregistrationauthoritiesareshowninthetablebelow.

AssuranceLevel Subscriber RegistrationAuthority

EVCodeSigningFIPS140Level2(Hardware)

FIPS140Level2(Hardware)

AdobeSigningCertificates

FIPS140Level2(Hardware)

FIPS140Level3(Hardware)

Level1‐Rudimentary N/A FIPS140Level1(HardwareorSoftware)

Level2–Basic FIPS140Level1(HardwareorSoftware)

FIPS140Level1(HardwareorSoftware)

Level3‐MediumFIPS140Level1(Software)FIPS140Level2(Hardware)

FIPS140Level2(Hardware)

Level4,MediumHardware,Biometric,

FIPS140Level2(Hardware)

FIPS140Level2(Hardware)

EUQConSSCDEAL4Augmented

(Hardware)EAL4Augmented

(Hardware)

ForEVCodeSigningCertificates,theIssuerCAshallensurethatthePrivateKeyisproperlygenerated,stored,andusedinacryptomodulethatmeetsorexceedstherequirementsofFIPS140level2.

6.2.1.1. Custodial Subscriber Key Stores CustodialSubscriberKeyStoresholdkeysforanumberofSubscribercertificatesinonelocation.EffectiveJanuary1,2017,allcryptographicmodulesforCustodialSubscriberKeyStoresforcertificatesissuedatLevels2,3‐US,3‐CBP,4‐US,and4‐CBPshallbenolessthanFIPS140Level2Hardwareandauthenticationtoactivatetheprivatekeyassociatedwithagivencertificateshallrequireauthenticationcommensuratewiththeassurancelevelofthecertificate.

6.2.2. PrivateKey(noutofm)Multi‐personControlTheIssuerCAshallensurethatmultipletrustedpersonnelarerequiredtoactinordertoaccessanduseanIssuerCA’sPrivateKeys,includinganyPrivateKeybackups.

6.2.3. PrivateKeyEscrowTheIssuerCAshallnotescrowitssignaturekeys.Subscribersmaynotescrowtheirprivatesignaturekeys.TheIssuerCAmayescrowSubscriberPrivateKeysusedforencryptioninordertoprovidekeyrecoveryasdescribedinsection4.12.1.

6.2.4. PrivateKeyBackupTheIssuerCAshallbackupitsCA,CRL,andcertificatestatusPrivateKeysundermulti‐personcontrolandshallstoreatleastonebackupatasecure,offsitelocation.TheIssuerCAshallprotectallcopiesofitsCA,CRL,andcertificatestatusPrivateKeysinthesamemannerastheoriginals.

Page 46: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

40

TheIssuerCAmayprovidebackupservicesforPrivateKeysthatarenotrequiredtobemaintainedincryptographichardware.AccesstoPrivateKeybackupsshallbesecuredinamannerthatonlytheSubscribercancontrolthePrivateKey.TheIssuerCAmaynotbackupLevel4subscriberprivatesignaturekeys.TheIssuerCAmaynotstorebackupkeysinaplaintextformoutsideofthecryptographicmodule.StoragethatcontainsbackupkeysshallprovidesecuritycontrolsthatareconsistentwiththeprotectionprovidedbytheSubscriber’scryptographicmodule.

6.2.5. PrivateKeyArchivalTheIssuerCAshallnotarchiveitsPrivateKeysandshallnotallowthearchivalofanyPrivateKeysassociatedwithEUQualifiedCertificates.

6.2.6. PrivateKeyTransferintoorfromaCryptographicModuleAllkeysmustbegeneratedbyandinacryptographicmodule.TheIssuerCAandRAshallneverallowtheirPrivateKeystoexistinplaintextoutsideofthecryptographicmodule.TheIssuerCAshallonlyexportitsPrivateKeysfromthecryptographicmoduletoperformCAkeybackupprocedures.Whentransportedbetweencryptographicmodules,theIssuerCAshallencryptthePrivateKeyandprotectthekeysusedforencryptionfromdisclosure.IftheIssuerCAbecomesawarethataSubordinateCA’sPrivateKeyhasbeencommunicatedtoanunauthorizedpersonoranorganizationnotaffiliatedwiththeSubordinatedCA,thentheIssuerCAwillrevokeallcertificatesthatincludethePublicKeycorrespondingtothecommunicatedPrivateKey.

6.2.7. PrivateKeyStorageonCryptographicModuleTheIssuerCAshallstoreitsCAPrivateKeysonacryptographicmodulewhichhasbeenevaluatedtoatleastFIPS140Level3andEAL4+.

6.2.8. MethodofActivatingPrivateKeyTheIssuerCAshallactivateitsPrivateKeysinaccordancewiththespecificationsofthecryptographicmodulemanufacturer.SubscribersaresolelyresponsibleforprotectingtheirPrivateKeys.Ataminimum,SubscribersmustauthenticatethemselvestothecryptographicmodulebeforeactivatingtheirPrivateKeys.Entryofactivationdatashallbeprotectedfromdisclosure.

6.2.9. MethodofDeactivatingPrivateKeyTheIssuerCAshalldeactivateitsPrivateKeysandstoreitscryptographicmodulesinsecurecontainerswhennotinuse.TheIssuerCAshallpreventunauthorizedaccesstoanyactivatedcryptographicmodules.

6.2.10. MethodofDestroyingPrivateKeyTheIssuerCAshalluseindividualsintrustedrolestodestroyCA,RA,andstatusserverPrivateKeyswhentheyarenolongerneeded.SubscribersshalldestroytheirPrivateKeyswhenthecorrespondingCertificateisrevokedorexpiredorifthePrivateKeyisnolongerneeded.Forsoftwarecryptographicmodules,theIssuerCAmaydestroythePrivateKeysbyoverwritingthedata.Forhardwarecryptographicmodules,theIssuerCAmaydestroythePrivateKeysbyexecutinga“zeroize”command.Physicaldestructionofhardwareisnotrequired.

6.2.11. CryptographicModuleRatingSeeSection6.2.1.

6.3. OTHERASPECTSOFKEYPAIRMANAGEMENT

6.3.1. PublicKeyArchivalTheIssuerCAshallarchiveacopyofeachPublicKey.

Page 47: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

41

6.3.2. CertificateOperationalPeriodsandKeyPairUsagePeriodsAllCertificates,includingrenewedCertificates,havemaximumvalidityperiodsof:

Type PrivateKeyUse CertificateTermRootCA 20years 25yearsSubCA 12years 15yearsFBCA‐Cross‐certifiedSubCAs 6years (periodof

keyuseforsigningcertificates)

10years(keystillsignsCRLs,OCSPresponses,andOCSPresponder

certificates)IGTFCross‐certifiedSubCA* 6years 15yearsCRLandOCSPrespondersigning 3years 31daysOVSSL/TLS Nostipulation asspecifiedinsection

6.3.2oftheBaselineRequirements(i.e.825daysafter1March

2018)EVSSL/TLS Nostipulation 825daysCodeSigningCertificateissuedtoSubscriberundertheMinimumRequirementsforCodeSigningCertificatesortheEVCodeSigningGuidelines

Nostipulation 39months

EVCodeSigningCertificateissuedtoSigningAuthority

Nostipulation 123months

TimeStampingAuthority 15months 135monthsObjectSigningCertificateandDocumentSigning

Nostipulation‡ 123months

FBCAandIGTFClientusedforsignatures(includingEUQualifiedCertificates)

36months 36months

FBCAandIGTFClientusedforkeymanagement

36months 36months

Clientforallotherpurposes(FBCAorIGTFcompliant)

36months 36months

Clientforallotherpurposes(nonFBCAandIGTFcerts)

Nostipulation 60months

IGTFonhardware 60months 13months

*IGTFsigningCertificatesmusthavealifetimethatisatleasttwicethemaximumlifetimeofanendentityCertificate.‡Codeandcontentsignerscross‐certifiedwithFBCAmayusetheirPrivateKeysforthreeyears;thelifetimeoftheassociatedPublicKeysshallnotexceedeightyears.RelyingpartiesmaystillvalidatesignaturesgeneratedwiththesekeysafterexpirationoftheCertificate.Privatekeysassociatedwithself‐signedrootCertificatesthataredistributedastrustanchorsareusedforamaximumof20years.TheIssuerCAmayretireitsCAPrivateKeysbeforetheperiodslistedabovetoaccommodatekeychangeoverprocesses.TheIssuerCAshallnotissueaSubscriberCertificatewithanexpirationdatethatispasttheIssuerCA’spublickeyexpirationdateorthatexceedstheroutinere‐keyidentificationrequirementsspecifiedinSection3.1.1.

Page 48: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

42

6.4. ACTIVATIONDATA

6.4.1. ActivationDataGenerationandInstallationTheIssuerCAshallgenerateactivationdatathathassufficientstrengthtoprotectitsPrivateKeys.IftheIssuerCAusespasswordsasactivationdataforasigningkey,theIssuerCAshallchangetheactivationdatauponrekeyoftheCACertificate.TheIssuerCAmayonlytransmitactivationdataviaanappropriatelyprotectedchannelandatatimeandplacethatisdistinctfromthedeliveryoftheassociatedcryptographicmodule.

6.4.2. ActivationDataProtectionTheIssuerCAshallprotectdatausedtounlockPrivateKeysfromdisclosureusingacombinationofcryptographicandphysicalaccesscontrolmechanisms.Activationdatashallbe:

memorized biometricinnature,or recordedandsecuredatthelevelofassuranceassociatedwiththeactivationofthe

cryptographicmodule,andshallnotbestoredwiththecryptographicmodule.

TheIssuerCAshallrequirepersonneltomemorizeandnotwritedowntheirpasswordorsharetheirpasswordswithotherindividuals.TheIssuerCAshallimplementprocessestotemporarilylockaccesstosecureCAprocessesifacertainnumberoffailedlog‐inattemptsoccurassetforthintheapplicableCPS.

6.5. COMPUTERSECURITYCONTROLS

6.5.1. SpecificComputerSecurityTechnicalRequirementsTheIssuerCAshallconfigureitssystems,includinganyremoteworkstations,to:

1. authenticatetheidentityofusersbeforepermittingaccesstothesystemorapplications,2. managetheprivilegesofusersandlimituserstotheirassignedroles,3. generateandarchiveauditrecordsforalltransactions,4. enforcedomainintegrityboundariesforsecuritycriticalprocesses,and5. supportrecoveryfromkeyorsystemfailure.

TheIssuerCAshallauthenticateandprotectallcommunicationsbetweenatrustedroleanditsCAsystem.AllCertificateStatusServersinteroperatingwithcross‐certifiedenvironmentsmust:

1. authenticatetheidentityofusersbeforepermittingaccesstothesystemorapplications,2. manageprivilegestolimituserstotheirassignedroles,3. enforcedomainintegrityboundariesforsecuritycriticalprocesses,and4. supportrecoveryfromkeyorsystemfailure.

ACMSmusthavethefollowingcomputersecurityfunctions:

1. authenticatetheidentityofusersbeforepermittingaccesstothesystemorapplications,2. manageprivilegesofuserstolimituserstotheirassignedroles,3. generateandarchiveauditrecordsforalltransactions,(seeSection5.4)4. enforcedomainintegrityboundariesforsecuritycriticalprocesses,and5. supportrecoveryfromkeyorsystemfailure.

IssuerCAsshallenforcemulti‐factorauthenticationonanyaccountcapableofdirectlycausingCertificateissuance.

6.5.2. ComputerSecurityRatingNostipulation.

Page 49: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

43

6.6. LIFECYCLETECHNICALCONTROLS

6.6.1. SystemDevelopmentControlsInoperatingitsCA,theIssuerCAshalluseonly:

1. Commercialoff‐the‐shelfsoftwarethatwasdesignedanddevelopedunderaformalanddocumenteddevelopmentmethodology,

2. HardwareandsoftwaredevelopedspecificallyfortheIssuerCAbyverifiedpersonnel,usingastructureddevelopmentapproachandacontrolleddevelopmentenvironment,

3. Opensourcesoftwarethatmeetssecurityrequirementsthroughsoftwareverification&validationandstructureddevelopment/life‐cyclemanagement,

4. Hardwareandsoftwarepurchasedandshippedinafashionthatreducesthelikelihoodoftampering,and

5. ForCAoperations,hardwareandsoftwarethatisdedicatedonlytoperformingtheCAfunctions.

TheIssuerCAshalltakepropercaretopreventmalicioussoftwarefrombeingloadedontotheCAequipment.TheIssuerCAshallscanallhardwareandsoftwareformaliciouscodeonfirstuseandperiodicallythereafter.TheIssuerCAshallpurchaseordevelopupdatesinthesamemannerasoriginalequipment,andshallusetrustedtrainedpersonneltoinstallthesoftwareandequipment.TheIssuerCAshallnotinstallanysoftwareonitsCAsystemsthatarenotpartoftheCA’soperations.

TheIssuerCAshalluseaformalconfigurationmanagementmethodologyforinstallationandongoingmaintenanceofanyCMS.AnymodificationsandupgradestoaCMSshallbedocumentedandcontrolled.TheIssuerCAshallimplementamechanismfordetectingunauthorizedmodificationtoaCMS.

6.6.2. SecurityManagementControlsTheIssuerCAshallestablishformalmechanismstodocument,control,monitor,andmaintaintheinstallationandconfigurationofitsCAsystems,includinganymodificationsorupgrades.TheIssuerCA’schangecontrolprocessesshallincludeprocedurestodetectunauthorizedmodificationtotheIssuerCA’ssystemsanddataentriesthatareprocessed,loggedandtrackedforanysecurity‐relatedchangestoCAsystems,firewalls,routers,softwareandotheraccesscontrols.WhenloadingsoftwareontoaCAsystem,theIssuerCAshallverifythatthesoftwareisthecorrectversionandissuppliedbythevendorfreeofanymodifications.TheIssuerCAshallverifytheintegrityofsoftwareusedwithitsCAprocessesatleastonceaweek.

6.6.3. LifeCycleSecurityControlsNostipulation.

6.7. NETWORKSECURITYCONTROLSTheIssuerCAshalldocumentandcontroltheconfigurationsofitssystems,includinganyupgradesormodificationsmade.TheIssuerCAshallimplementaprocessfordetectingunauthorizedmodificationstoitshardwareorsoftwareandforinstallingandmaintainingitssystems.TheIssuerCAanditsRAsshallimplementappropriatenetworksecuritycontrols,includingturningoffanyunusednetworkportsandservicesandonlyusingnetworksoftwarethatisnecessaryfortheproperfunctioningoftheCAsystems.TheIssuerCAshallimplementthesamenetworksecuritycontrolstoprotectaCMSasusedtoprotectitsotherCAequipment.

6.8. TIME‐STAMPINGIssuerCAsshallensurethattheaccuracyofclocksusedfortime‐stampingarewithinthreeminutes.Electronicormanualproceduresmaybeusedtomaintainsystemtime.Clockadjustmentsareauditableevents,seeSection5.4.1.

Page 50: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

44

7. CERTIFICATE,CRL,ANDOCSPPROFILES

7.1. CERTIFICATEPROFILEIssuerCAsshallgeneratenon‐sequentialCertificateserialnumbersgreaterthanzero(0)containingatleast64bitsofoutputfromaCSPRNG.

7.1.1. VersionNumber(s)IssuerCAsshallissueX.509version3Certificates.

7.1.2. CertificateExtensionsIssuerCAsshallusecertificateextensionsinaccordancewithapplicableindustrystandards,includingRFC3280/5280.IssuerCAsshallnotissueCertificateswithacriticalprivateextension.IGTFCertificatesmustcomplywiththeGridCertificateProfileasdefinedbytheOpenGridForumGFD.125.

7.1.3. AlgorithmObjectIdentifiersIssuerCAsshallsignCertificatesusingoneofthefollowingalgorithms:id‐dsa‐with‐sha1* {iso(1)member‐body(2)us(840)x9‐57(10040)x9cm(4)3}sha‐1WithRSAEncryption* {iso(1)member‐body(2)us(840)rsadsi(113549)pkcs(1)

pkcs‐1(1)5}sha256WithRSAEncryption {iso(1)member‐body(2)us(840)rsadsi(113549)pkcs(1)

pkcs‐1(1)11}id‐RSASSA‐PSS {iso(1)member‐body(2)us(840)rsadsi(113549)pkcs(1)

pkcs‐1(1)10}ecdsa‐with‐SHA1* {iso(1)member‐body(2)us(840)ansi‐X9‐62(10045)

signatures(4)1}ecdsa‐with‐SHA224 {iso(1)member‐body(2)us(840)ansi‐X9‐62(10045)

signatures(4)ecdsa‐with‐SHA2(3)1}ecdsa‐with‐SH256 {iso(1)member‐body(2)us(840)ansi‐X9‐62(10045)

signatures(4)ecdsa‐with‐SHA2(3)2}ecdsa‐with‐SHA384 {iso(1)member‐body(2)us(840)ansi‐X9‐62(10045)

signatures(4)ecdsa‐with‐SHA2(3)3}ecdsa‐with‐SHA512 {iso(1)member‐body(2)us(840)ansi‐X9‐62(10045)

signatures(4)ecdsa‐with‐SHA2(3)4}IfanIssuerCAsignsCertificatesusingRSAwithPSSpadding,theIssuerCAmayuseanRSAsignaturewithPSSpaddingwiththefollowingalgorithmsandOIDs:id‐sha256 {joint‐iso‐itu‐t(2)country(16)us(840)organization(1)

gov(101)csor(3)nistalgorithm(4)hashalgs(2)1}id‐sha512 {joint‐iso‐itu‐t(2)country(16)us(840)organization(1)

gov(101)csor(3)nistalgorithm(4)hashalgs(2)3}IssuerCAsandSubscribersmaygenerateKeyPairsusingthefollowing:id‐dsa {iso(1)member‐body(2)us(840)x9‐57(10040)x9cm(4)1}

RsaEncryption{iso(1)member‐body(2)us(840)rsadsi(113549)pkcs(1)pkcs‐1(1)1}

Dhpublicnumber{iso(1)member‐body(2)us(840)ansi‐x942(10046)number‐type(2)1}

id‐ecPublicKey{iso(1)member‐body(2)us(840)ansi‐X9‐62(10045)id‐publicKeyType(2)1}

id‐keyExchangeAlgorithm[joint‐iso‐ccitt(2)country(16)us(840)organization(1)gov(101)dod(2)infosec(1)algorithms(1)22]

Page 51: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

45

IfanIssuerCAissuesanon‐CACertificateforafederalagencyandtheCertificatecontainsanellipticcurvePublicKey,theIssuerCAshallspecifyoneofthefollowingnamedcurves:ansip192r1 {iso(1)member‐body(2)us(840)10045curves(3)prime(1)1}ansit163k1 {iso(1)identified‐organization(3)certicom(132)curve(0)1}ansit163r2 {iso(1)identified‐organization(3)certicom(132)curve(0)15}ansip224r1 {iso(1)identified‐organization(3)certicom(132)curve(0)33}ansit233k1 {iso(1)identified‐organization(3)certicom(132)curve(0)26}ansit233r1 {iso(1)identified‐organization(3)certicom(132)curve(0)27}ansip256r1 {iso(1)member‐body(2)us(840)10045curves(3)prime(1)7}ansit283k1 {iso(1)identified‐organization(3)certicom(132)curve(0)16}ansit283r1 {iso(1)identified‐organization(3)certicom(132)curve(0)17}ansip384r1 {iso(1)identified‐organization(3)certicom(132)curve(0)34}ansit409k1 {iso(1)identified‐organization(3)certicom(132)curve(0)36}ansit409r1 {iso(1)identified‐organization(3)certicom(132)curve(0)37}ansip521r1 {iso(1)identified‐organization(3)certicom(132)curve(0)35}ansit571k1 {iso(1)identified‐organization(3)certicom(132)curve(0)38}ansit571r1 {iso(1)identified‐organization(3)certicom(132)curve(0)39}IssuerCAsshallnotissueSSLCertificateswithaReservedIPAddressorInternalName.*IssuerCAsshallnotissueSubCA,OCSP,orSubscriberSSLCertificatesutilizingtheSHA‐1algorithm.

7.1.4. NameFormsIssuerCAsshallusedistinguishednamesthatarecomposedofstandardattributetypes,suchasthoseidentifiedinRFC3280/5280.IssuerCAsshallincludeauniqueserialnumberineachCertificate.ThecontentoftheCertificateIssuerDistinguishedNamefieldmustmatchtheSubjectDNoftheIssuerCAtosupportnamechainingasspecifiedinRFC5280,section4.1.2.4. TheIssuerCAshallrestrictOUfieldsfromcontainingSubscriberinformationthatisnotverifiedinaccordancewithSection3.ThecommonNameattributemustbepresentandthecontentsshouldbeanidentifierforthecertificatesuchthatthecertificate’sNameisuniqueacrossallcertificatesissuedbytheissuingcertificate. 

7.1.5. NameConstraintsIssuerCAsmayincludenameconstraintsinthenameConstraintsfieldwhenappropriate.TechnicallyConstrainedSubordinateCACertificatesshallincludeanExtendedKeyUsage(EKU)extensionspecifyingallextendedkeyusagesforwhichtheSubordinateCACertificateisauthorizedtoissuecertificates.TheanyExtendedKeyUsageKeyPurposeIdshallnotappearintheEKUextension.

7.1.5.1. Name‐Constrained serverAuth CAs IftheSubordinateCACertificateincludestheid‐kp‐serverAuthextendedkeyusage,thenatechnicallyconstrainedSubordinateCACertificateshallincludetheNameConstraintsX.509v3extensionwithconstraintsondNSName,iPAddressandDirectoryNameasfollows:

(a)ForeachdNSNameinpermittedSubtrees,theIssuerCAshallconfirmthattheApplicanthasregisteredthedNSNameorhasbeenauthorizedbythedomainregistranttoactontheregistrant'sbehalfinlinewiththeverificationpracticesofBaselineRequirementssection3.2.2.4.(b)ForeachiPAddressrangeinpermittedSubtrees,theIssuerCAshallconfirmthattheApplicanthasbeenassignedtheiPAddressrangeorhasbeenauthorizedbytheassignertoactontheassignee'sbehalf.

Page 52: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

46

(c)ForeachDirectoryNameinpermittedSubtreestheIssuerCAshallconfirmtheApplicant’sand/orSubsidiary’sOrganizationalname(s)andlocation(s)suchthatendentitycertificatesissuedfromthesubordinateCACertificatewillcomplywithsection7.1.2.4and7.1.2.5oftheBaselineRequirements.

IftheSubordinateCACertificateisnotallowedtoissuecertificateswithaniPAddress,thentheSubordinateCACertificateshallspecifytheentireIPv4andIPv6addressrangesinexcludedSubtrees.TheSubordinateCACertificateshallincludewithinexcludedSubtreesaniPAddressGeneralNameof8zerooctets(coveringtheIPv4addressrangeof0.0.0.0/0).TheSubordinateCACertificateshallalsoincludewithinexcludedSubtreesaniPAddressGeneralNameof32zerooctets(coveringtheIPv6addressrangeof::0/0).Otherwise,theSubordinateCACertificateshallincludeatleastoneiPAddressinpermittedSubtrees.

IftheSubordinateCAisnotallowedtoissuecertificateswithdNSNames,thentheSubordinateCACertificateshallincludeazero‐lengthdNSNameinexcludedSubtrees.Otherwise,theSubordinateCACertificateshallincludeatleastonedNSNameinpermittedSubtrees.

7.1.5.2. Name‐Constrained emailProtection CAs IfthetechnicallyconstrainedSubordinateCAcertificateincludestheid‐kp‐emailProtectionextendedkeyusage,itshallincludetheNameConstraintsX.509v3extensionwithconstraintsonrfc822Name,withatleastonenameinpermittedSubtrees,eachsuchnamehavingitsownershipvalidatedaccordingtosection3.2.2.4oftheBaselineRequirements.

7.1.6. CertificatePolicyObjectIdentifierWhenanIssuerCAissuesaCertificatecontainingoneofthepolicyidentifierssetforthinSection1.2,itassertsthattheCertificateismanagedinaccordancewiththepolicythatisidentifiedherein.

7.1.7. UsageofPolicyConstraintsExtensionNotapplicable.

7.1.8. PolicyQualifiersSyntaxandSemanticsIssuerCAsmayincludebriefstatementsinthePolicyQualifierfieldoftheCertificatePolicyextension.

7.1.9. ProcessingSemanticsfortheCriticalCertificatePoliciesExtensionNostipulation.

7.2. CRLPROFILE

7.2.1. Versionnumber(s)IssuerCAsshallissueversion2CRLsthatconformtoRFC3280/5280.

7.2.2. CRLandCRLEntryExtensionsIssuerCAsshalluseCRLextensionsthatconformwiththeFederalPKIX.509CRLExtensionsProfile.

7.3. OCSPPROFILEIssuerCAsshalloperateanOCSPserviceinaccordancewithRFC2560.

7.3.1. VersionNumber(s)IssuerCAsshallsupportversion1OCSPrequestsandresponses.

Page 53: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

47

7.3.2. OCSPExtensionsNostipulation.

8. COMPLIANCEAUDITANDOTHERASSESSMENTSThepoliciesinthisCParedesignedtomeetorexceedtherequirementsofgenerallyacceptedanddevelopingindustrystandards,includingtheWebTrustProgramforCertificationAuthorities.ForIssuerCAschainedtotheFBCA,theauditorletterofcomplianceshallmeetFPKIPAAuditRequirements.AllIssuerCAsshallensurethatauditsareconductedforallPKIfunctionsregardlessofhoworbywhomthePKIcomponentsaremanagedandoperated.

8.1. FREQUENCYORCIRCUMSTANCESOFASSESSMENTOnatleastanannualbasis,IssuerCAsshallretainanindependentauditorforaperiodintimeauditwhoshallassesstheIssuerCA’scompliancewiththisCPanditsCPS.ThisauditmustcoverCMSs,SubCAs,RAs,andeachstatusserverthatisspecifiedinacertificateissuedbytheIssuerCA.AnyindependententityinteroperatingwithintheDigiCertPKIshallsubmititspracticesstatementandtheresultsofitscomplianceaudittotheDCMAonanannualbasisforreviewandapproval.

8.2. IDENTITY/QUALIFICATIONSOFASSESSOR

TheIssuerCAshalluseanauditorthatmeetsSection8.2oftheBaselineRequirements(forWebTrust)andSection8.2oftheFederalBridgeCP(forcertificatescross‐certifiedundertheFederalBridgeCA).

8.3. ASSESSOR'SRELATIONSHIPTOASSESSEDENTITYTheIssuerCAshallutilizeindependentauditorsthatdonothaveafinancialinterest,businessrelationship,orcourseofdealingthatcouldforeseeablycreateasignificantbiasfororagainsttheIssuerCA.

8.4. TOPICSCOVEREDBYASSESSMENTTheauditmustconformtoindustrystandards,covertheIssuerCA'scompliancewithitsbusinesspracticesdisclosure,andevaluatetheintegrityoftheIssuerCA’sPKIoperations.TheauditmustverifythateachIssuerCAiscompliantwiththisCPandanyMOAbetweenitandanyotherPKI.

8.5. ACTIONSTAKENASARESULTOFDEFICIENCYIfanauditreportsamaterialnoncompliancewithapplicablelaw,thisCP,theCPS,oranyothercontractualobligationsrelatedtotheIssuerCA’sservices,then(1)theauditorshalldocumentthediscrepancy,(2)theauditorshallpromptlynotifytheIssuerCAandtheDCPA,and(3)theIssuerCAandtheDCPAshalldevelopaplantocurethenoncompliance.TheDCPAshallalsonotifyanyaffectedcross‐certifyingentityandanyrelevantgovernmentaccreditingbody.TheIssuerCAshallsubmittheplantotheDCPAforapprovalandtoanythirdpartythattheIssuerCAislegallyobligatedtosatisfy.TheDCPAmayrequireadditionalactionifnecessarytorectifyanysignificantissuescreatedbythenon‐compliance,includingrequiringrevocationofaffectedCertificates.

8.6. COMMUNICATIONOFRESULTSTheresultsofeachauditshallbereportedtotheDCPAforreviewandapproval.Theresultsshallalsobecommunicatedtoanythirdpartyentitiesentitledbylaw,regulation,oragreementtoreceiveacopyoftheauditresults.Onanannualbasis,theDCPAshallsubmitanauditcompliancepackagetotheFederalPKIPolicyAuthoritypreparedinaccordancewiththe“ComplianceAuditRequirements”document,whichshallincludeanassertionthatallPKIcomponentshavebeenaudited,includinganycomponentsthatmaybeseparatelymanagedandoperated.ThepackageshallidentifytheversionsoftheCPandCPSusedintheassessment.

Page 54: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

48

8.7. SELF‐AUDITSTheIssuerCAshallperformregularinternalauditsofitsoperations,personnel,andcompliancewiththisCPusingarandomlyselectedsampleofCertificatesissuedsincethelastinternalaudit.TheIssuerCAshallself‐auditatleastthreepercentofSSL/TLSCertificatesandEVCodeSigningCertificates.

9. OTHERBUSINESSANDLEGALMATTERS

9.1. FEES

9.1.1. CertificateIssuanceorRenewalFeesIssuerCAsmaychargefeesforcertificateissuanceandrenewal.

9.1.2. CertificateAccessFeesIssuerCAsmaychargefeesforaccesstotheirdatabasesofCertificates.

9.1.3. RevocationorStatusInformationAccessFeesNostipulation.

9.1.4. FeesforOtherServicesNostipulation.

9.1.5. RefundPolicyNostipulation.

9.2. FINANCIALRESPONSIBILITY

9.2.1. InsuranceCoverageIssuerCAsshallmaintainErrorsandOmissions/ProfessionalLiabilityInsuranceofatleast$1millionperoccurrencefromaninsurancecompanyratednolessthanA‐astoPolicyHolder’sRatinginthecurrenteditionofBest’sInsuranceGuide(orwithanassociationofcompanies,eachofthemembersofwhicharesorated).

9.2.2. OtherAssetsNostipulation.

9.2.3. InsuranceorWarrantyCoverageforEnd‐EntitiesNostipulation.

9.3. CONFIDENTIALITYOFBUSINESSINFORMATION

9.3.1. ScopeofConfidentialInformationIssuerCAsshallspecifywhatconstitutesconfidentialinformationinitsCPS.

9.3.2. InformationNotWithintheScopeofConfidentialInformationIssuerCAsmaytreatanyinformationnotlistedasconfidentialintheCPSaspublicinformation.

9.3.3. ResponsibilitytoProtectConfidentialInformationIssuerCAsshallcontractuallyobligateemployees,agents,andcontractorstoprotectconfidentialinformation.IssuerCAsshallprovidetrainingtoemployeesonhowtohandleconfidentialinformation.

Page 55: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

49

9.4. PRIVACYOFPERSONALINFORMATION

9.4.1. PrivacyPlanIssuerCAsshallcreateandfollowapubliclypostedprivacypolicythatspecifieshowtheIssuerCAhandlespersonalinformation.

9.4.2. InformationTreatedasPrivateIssuerCAsshalltreatallpersonalinformationaboutanindividualthatisnotpubliclyavailableinthecontentsofaCertificateorCRLasprivateinformation.TheIssuerCAshallprotectprivateinformationinitspossessionusingareasonabledegreeofcareandappropriatesafeguards.TheIssuerCAshallnotdistributeCertificatesthatcontaintheUUIDinthesubjectalternativenameextensionviapubliclyaccessiblerepositories(e.g.,LDAP,HTTP).

9.4.3. InformationNotDeemedPrivatePrivateinformationdoesnotincludeCertificates,CRLs,ortheircontents.

9.4.4. ResponsibilitytoProtectPrivateInformationIssuerCAsareresponsibleforsecurelystoringandprotectingprivateinformation.

9.4.5. NoticeandConsenttoUsePrivateInformationSubscribersmustconsenttotheglobaltransferandpublicationofanypersonaldatacontainedinCertificates.

9.4.6. DisclosurePursuanttoJudicialorAdministrativeProcessIssuerCAsmaydiscloseprivateinformation,withoutnotice,whenrequiredtodosobylaworregulation.

9.4.7. OtherInformationDisclosureCircumstancesNostipulation.

9.5. INTELLECTUALPROPERTYRIGHTSIssuerCAsshallnotknowinglyviolatetheintellectualpropertyrightsofanythirdparty.

9.6. REPRESENTATIONSANDWARRANTIES

9.6.1. CARepresentationsandWarrantiesIssuerCAsmustrepresenttoDigiCert,Subscribers,andRelyingPartiesthattheycomply,inallmaterialaspects,withthisCP,theirCPS,andallapplicablelawsandregulations.

9.6.2. RARepresentationsandWarrantiesAtaminimum,IssuerCAsshallrequireRAsoperatingontheirbehalftorepresentthattheyhavefollowedthisCPandtherelevantCPSwhenparticipatingintheissuanceandmanagementofCertificates.

9.6.3. SubscriberRepresentationsandWarrantiesDigiCertrequires,aspartoftheSubscriberAgreementorTermsofUse,thattheApplicantmakethecommitmentsandwarrantiesinthissectionforthebenefitofDigiCertandtheCertificateBeneficiaries.PriortotheissuanceofaCertificate,DigiCertwillobtain,fortheexpressbenefitofDigiCertandtheCertificateBeneficiaries,either:

1.TheApplicant’sagreementtotheSubscriberAgreementwithDigiCert,or2.TheApplicant’sacknowledgementoftheTermsofUse.

PriortobeingissuedandreceivingaCertificate,eachSubscribershallrepresenttoDigiCertandtheIssuerCAthattheSubscriberwill:

Page 56: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

50

1. SecurelygenerateitsPrivateKeysandprotectitsPrivateKeysfromcompromise,2. ProvideaccurateandcompleteinformationandcommunicationtotheIssuerCAandRA,3. ConfirmtheaccuracyofCertificatedatapriortousingtheCertificate,4. Promptly(i)requestrevocationofaCertificate,ceaseusingitanditsassociatedPrivate

Key,andnotifytheIssuerCAifthereisanyactualorsuspectedmisuseorcompromiseofthePrivateKeyassociatedwiththePublicKeyincludedintheCertificate,and(ii)requestrevocationoftheCertificate,andceaseusingit,ifanyinformationintheCertificateisorbecomesincorrectorinaccurate,

5. EnsurethatindividualsusingCertificatesonbehalfofanorganizationhavereceivedsecuritytrainingappropriatetotheCertificate,

6. UsetheCertificateonlyforauthorizedandlegalpurposes,consistentwiththerelevantCPSandSubscriberAgreement,includingonlyinstallingSSL/TLSServerCertificatesonserversaccessibleatthedomainlistedintheCertificateandnotusingcodesigningCertificatestosignmaliciouscodeoranycodethatisdownloadedwithoutauser’sconsent,and

7. PromptlyceaseusingtheCertificateandrelatedPrivateKeyaftertheCertificate’sexpiration.

9.6.4. RelyingPartyRepresentationsandWarrantiesRelyingPartiesmustfollowtheproceduresandmaketherepresentationsrequiredbytherelevantCPSandintheapplicableRelyingPartyAgreementpriortorelyingonorusingaCertificate.

9.6.5. RepresentationsandWarrantiesofOtherParticipantsNostipulation.

9.7. DISCLAIMERSOFWARRANTIESExceptasexpresslystatedotherwisehereinoraslimitedbylaw,DigiCertdisclaimsallwarrantiesandobligationsrelatedtothisCP.AfiduciarydutyisnotcreatedsimplybecauseanentityusesservicesofferedwithintheDigiCertPKI.

9.8. LIMITATIONSOFLIABILITYIssuerCAsmaylimittheirliabilitytoanyextentnototherwiseprohibitedbythisCP,providedthattheIssuerCAremainsresponsibleforcomplyingwiththisCPandtheIssuerCA’sCPS.

9.9. INDEMNITIES

9.9.1. IndemnificationbyanIssuerCAIssuerCAsarerequiredtoindemnifyDigiCertforanyviolationofthisCP.

9.9.2. IndemnificationbySubscribersIssuerCAsshallincludeanyindemnificationrequirementsforSubscribersintheirCPSandintheirSubscriberAgreements.

9.9.3. IndemnificationbyRelyingPartiesIssuerCAsshallincludeanyindemnificationrequirementsforRelyingPartiesintheirCPS.

9.10. TERMANDTERMINATION

9.10.1. TermThisCPandanyamendmentsareeffectivewhenpublishedtoDigiCert’sonlinerepositoryandremainineffectuntilreplacedwithanewerversion.

9.10.2. TerminationThisCPandanyamendmentsremainineffectuntilreplacedbyanewerversion.

Page 57: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

51

9.10.3. EffectofTerminationandSurvivalDigiCertwillcommunicatetheconditionsandeffectofthisCP’sterminationviatheDigiCertRepository.Thecommunicationwillspecifywhichprovisionssurvivetermination.Ataminimum,responsibilitiesrelatedtoprotectingconfidentialinformationwillsurvivetermination.

9.11. INDIVIDUALNOTICESANDCOMMUNICATIONSWITHPARTICIPANTSDigiCertacceptsdigitallysignedorpapernoticesrelatedtothisCPthatareaddressedtothelocationsspecifiedinSection2.2ofthisCP.NoticesaredeemedeffectiveafterthesenderreceivesavalidanddigitallysignedacknowledgmentofreceiptfromDigiCert.Ifanacknowledgementofreceiptisnotreceivedwithinfivedays,thesendermustresendthenoticeinpaperformtothestreetaddressspecifiedinSection2.2usingeitheracourierservicethatconfirmsdeliveryorviacertifiedorregisteredmailwithpostageprepaidandreturnreceiptrequested.

9.12. AMENDMENTS

9.12.1. ProcedureforAmendmentTheDCPAdetermineswhatamendmentsshouldbemadetothisCP.AmendmentsaremadebypostinganupdatedversionoftheCPtotheonlinerepository.ControlsareinplacetoreasonablyensurethatthisCPisnotamendedandpublishedwithoutthepriorauthorizationoftheDCPA.TheDCPAreviewsthisCPannually.

9.12.2. NotificationMechanismandPeriodDigiCertwillpostnoticeonitswebsiteofanyproposedsignificantrevisionstothisCP.AlthoughDigiCertmayincludeafinaldateforreceiptofcommentsandtheproposedeffectivedate,DigiCertisnotrequiredtohaveafixednotice‐and‐commentperiod.

9.12.3. CircumstancesunderwhichOIDMustBeChangedIftheDCPAdeterminesanamendmentnecessitatesachangeinanOID,thentherevisedversionofthisCPwillalsocontainarevisedOID.Otherwise,amendmentsdonotrequireanOIDchange.

9.13. DISPUTERESOLUTIONPROVISIONSBeforeresortingtoanydisputeresolutionmechanism,includingadjudicationoranytypeofalternativedisputeresolution,apartymustnotifyDigiCertofthedisputewithaviewtoseekdisputeresolution.

9.14. GOVERNINGLAWFordisputesinvolvingQualifiedCertificates,thenationallawoftherelevantMemberStateshallgovern.Forallothercertificates,thelawsofthestateofUtahshallgoverntheinterpretation,construction,andenforcementofthisCPandallproceedingsrelatedhereunder,includingtortclaims,withoutregardtoanyconflictsoflawprinciples,andUtahshallbethenon‐exclusivevenueandshallhavejurisdictionoversuchproceedings.

9.15. COMPLIANCEWITHAPPLICABLELAWThisCPissubjecttoallapplicablelawsandregulations,includingUnitedStatesrestrictionsontheexportofsoftwareandcryptographyproducts.Subjecttosection9.4.5’sNoticeandConsenttoUsePrivateInformationcontainedinCertificates,eachIssuerCAshallmeettherequirementsofEuropeandataprotectionlawsandshallestablishandmaintainappropriatetechnicalandorganizationmeasuresagainstunauthorizedorunlawfulprocessingofpersonaldataandagainsttheloss,damage,ordestructionofpersonaldata.

Page 58: DigiCert Certificate Policy, version 4 - SSL Digital Certificate … · 2018-01-29 · DigiCert Certificate Policy DigiCert, Inc. Version 4.14 January 25 ... Conduct Constituting

52

9.16. MISCELLANEOUSPROVISIONS

9.16.1. EntireAgreementIssuerCAsshallcontractuallyobligateeachRAinvolvedinCertificateissuancetocomplywiththisCPandapplicableindustryguidelines.IssuerCAsshallcontractuallyobligatepartiesusingproductsandservicesissuedunderthisCP,suchasSubscribersandRelyingParties,totherelevantprovisionsherein.ThisCPdoesnotgiveanythirdpartyrightsundersuchagreements.

9.16.2. AssignmentEntitiesoperatingunderthisCPmaynotassigntheirrightsorobligationswithoutthepriorwrittenconsentofDigiCert.

9.16.3. SeverabilityIfaprovisionofthisCPisheldinvalidorunenforceablebyacompetentcourtortribunal,theremainderoftheCPwillremainvalidandenforceable.

9.16.4. Enforcement(attorneys'feesandwaiverofrights)DigiCertmayseekindemnificationandattorneys'feesfromapartyfordamages,losses,andexpensesrelatedtothatparty'sconduct.DigiCert’sfailuretoenforceaprovisionofthisCPdoesnotwaiveDigiCert’srighttoenforcethesameprovisionlaterorrighttoenforceanyotherprovisionofthisCP.Tobeeffective,waiversmustbeinwritingandsignedbyDigiCert.

9.16.5. ForceMajeureDigiCertisnotliableforadelayorfailuretoperformanobligationunderthisCPtotheextentthatthedelayorfailureiscausedbyanoccurrencebeyondDigiCert’sreasonablecontrol.TheoperationoftheInternetisbeyondDigiCert’sreasonablecontrol.

9.17. OTHERPROVISIONSNostipulation.


Recommended