Digicert Shared Service Provider Non-Federal Certification Practice Statement Version
Total Page:16
File Type:pdf, Size:1020Kb
DigiCert Non-Federal Shared Service Provider PKI Certification Practice Statement Version 2.3 April 30, 2020 DigiCert, Inc. 2801 N. Thanksgiving Way Suite 500 Lehi, UT 84043 USA Tel: 1‐801‐877‐2100 Fax: 1‐801‐705‐0481 www.digicert.com DigiCert Public Copy - i - DigiCert Non-Federal Shared Service Provider (SSP) Certification Practice Statement © 2017-2020 DigiCert, Inc. All rights reserved. Printed in the United States of America. Revision Date: [April 30, 2020] Important – Acquisition Notice On October 31, 2017, DigiCert, Inc completed the acquisition of Symantec Corporation’s Website Security business unit. As a result, DigiCert is now the registered owner of this CPS document and the PKI Services described within this document. However, a hybrid of references to both “VeriSign” and “Symantec” and “DigiCert” shall be evident within this document for a period of time until it is operationally practical to complete the re-branding of the Certification Authorities and services. Any references to VeriSign or Symantec as a corporate entity should be strictly considered to be legacy language that solely reflects the history of ownership. Trademark Notices Symantec, the Symantec Logo, and the Checkmark Logo are the registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. The VeriSign logo, VeriSign Trust and other related marks are the trademarks or registered marks of VeriSign, Inc. or its affiliates or subsidiaries in the U.S. and other countries and licensed by Symantec Corporation. Other names may be trademarks of their respective owners. Without limiting the rights reserved above, and except as licensed below, no part of this certification practices statement may be reproduced, stored in or introduced into a retrieval system, or transmitted, in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), without prior written permission of DigiCert, Inc. Notwithstanding the above, permission is granted to reproduce and distribute this DigiCert CPS on a nonexclusive, royalty-free basis, provided that (i) the foregoing copyright notice and the beginning paragraphs are prominently displayed at the beginning of each copy, and (ii) this document is accurately reproduced in full, complete with attribution of the document to DigiCert. Requests for any other permission to reproduce this Certification Practices Statement (as well as requests for copies from DigiCert) must be addressed to: DigiCert, Inc. 2801 N. Thanksgiving Way Suite 500 Lehi, UT 84043 USA Tel: 1‐801‐877‐2100 Fax: 1‐801‐705‐0481 www.digicert.com Email: [email protected] DigiCert Public Copy - ii - TABLE OF CONTENTS 1. INTRODUCTION ........................................................ 1 3.3.1 Identification and Authentication for Routine 1.1 Overview ................................................................ 1 Re-Key ................................................................... 20 1.1.1 Certification Practices Statement (CPS) .......... 2 3.3.2 Identification and Authentication for Re-Key 1.2 Document Name and Identification ........................ 2 After Revocation.................................................... 20 1.3 PKI Participants ...................................................... 4 3.4 Identification and Authentication for Revocation 1.3.1 PKI Authorities ................................................ 4 Request ...................................................................... 20 1.3.2 Registration ..................................................... 6 4. CERTIFICATE LIFE-CYCLE OPERATIONAL 1.3.3 Card Management System (CMS) ................... 6 REQUIREMENTS ........................................................ 22 1.3.4 Subscribers ...................................................... 6 4.1 Certificate Application ........................................ 22 1.3.5 Affiliated Organization .................................... 7 4.1.1 Submission of Certificate Application .......... 22 1.3.6 Relying Parties ................................................ 7 4.1.2 Enrolment Process and Responsibilities ....... 22 1.3.7 Other Related Participants ............................... 7 4.2 Certificate Application Processing ...................... 22 1.4 Certificate Usage .................................................... 7 4.2.1 Performing Identification and Authentication 1.4.1 Appropriate Certificate Uses ........................... 7 Functions ............................................................... 22 1.4.2 Prohibited Certificate Uses .............................. 8 4.2.2 Approval or Rejection of Certificate 1.5 Policy Administration ................................................. 9 Applications ........................................................... 23 1.5.1 Organization Administering the Document ..... 9 4.2.3 Time to Process Certificate Applications ..... 23 1.5.2 Contact Person ................................................. 9 4.3 Certificate Issuance .............................................. 23 1.5.3 Person Determining CPS Suitability for the 4.3.1 CA Actions during Certificate Issuance ....... 23 Policy ........................................................................ 9 4.3.2 Notification to Subscriber by the CA of 1.5.4 CPS Approval Procedures ............................... 9 Issuance of Certificate ........................................... 24 1.6 Definitions and Acronyms ...................................... 9 4.4 Certificate Acceptance ......................................... 24 2. PUBLICATION AND REPOSITORY 4.4.1 Conduct Constituting Certificate Acceptance24 RESPONSIBILITIES ..................................................... 10 4.4.2 Publication of the Certificate by the CA ....... 24 2.1 Repositories .......................................................... 10 4.4.3 Notification of Certificate Issuance by the CA 2.1.1 Repository Obligations .................................. 10 to Other Entities ..................................................... 24 2.2 Publication of Certification Information .............. 10 4.5 Key Pair and Certificate Usage............................ 25 2.2.1 Publication of Certificates and Certificate 4.5.1 Subscriber Private Key and Certificate Usage Status ...................................................................... 10 ............................................................................... 25 2.2.2 Publication of CA Information ...................... 10 4.5.2 Relying Party Public Key and Certificate 2.2.3 Interoperability .............................................. 11 Usage ..................................................................... 25 2.3 Time or Frequency of Publication ........................ 11 4.6 Certificate Renewal ............................................. 25 2.4 Access Controls on Repositories .......................... 11 4.6.1 Circumstance for Certificate Renewal .... 25 3. IDENTIFICATION AND AUTHENTICATION ...... 12 4.6.2 Who May Request Renewal .................... 25 3.1 Naming ................................................................. 12 4.6.3 Processing Certificate Renewal Requests 25 3.1.1 Types of Names ............................................. 12 4.6.4 Notification of New Certificate Issuance to 3.1.2 Need for Names to be Meaningful ................ 13 Subscriber ............................................................. 25 3.1.3 Anonymity or Pseudonymity of Subscribers . 14 4.6.5 Conduct Constituting Acceptance of a 3.1.4 Rules for Interpreting Various Name Forms . 14 Renewal Certificate .............................................. 26 3.1.5 Uniqueness of Names .................................... 14 4.6.6 Publication of the Renewal Certificate by 3.1.6 Recognition, Authentication, and Role of the CA 26 Trademarks ............................................................. 15 4.6.7 Notification of Certificate Issuance by the 3.2 Initial Identity Validation ..................................... 15 CA to Other Entities ............................................. 26 3.2.1 Method to Prove Possession of Private Key .. 15 4.7 Certificate Re-Key ............................................... 26 3.2.2 Authentication of Organization Identity ........ 15 4.7.1 Circumstances for Certificate Re-Key .......... 26 3.2.3 Authentication of Identity .............................. 15 4.7.2 Who May Request Certification of a New 3.2.4 Non-Verified Subscriber Information ........... 19 Public Key ............................................................. 26 3.2.5 Validation of Authority ................................. 19 4.7.3 Processing Certificate Re-Keying Requests . 26 3.2.6 Criteria for Interoperation .............................. 19 4.7.4 Notification of New Certificate Issuance to 3.3 Identification and Authentication for Re-Key Subscriber .............................................................. 26 Requests ..................................................................... 20 DigiCert Public Copy - iii - 4.7.5 Conduct Constituting Acceptance of a Re- 5.1.1 Site Location and Construction .................... 33 Keyed Certificate .................................................... 26 5.1.2 Physical Access ............................................ 33 4.7.6 Publication of the Re-Keyed Certificate by the Physical access control requirements for CSS CA .......................................................................... 27 equipment, shall meet the CA physical access 4.7.7 Notification of Certificate