Digicert Certification Practices Statement for Symantec Trust Network (STN)
Total Page：16
File Type：pdf, Size：1020Kb
DigiCert Certification Practices Statement for Symantec Trust Network (STN) Version 3.13 June 25, 2019 DigiCert, Inc. 2801 N. Thanksgiving Way Suite 500 Lehi, UT 84043 USA Tel: 1‐801‐877‐2100 Fax: 1‐801‐705‐0481 www.digicert.com - i - DigiCert Certification Practices Statement for Symantec Trust Network (STN) © 2017-2019 DigiCert, Inc. All rights reserved. Printed in the United States of America. Published date: June 25, 2019 Important – Acquisition Notice On October 31, 2017, DigiCert, Inc. completed the acquisition of Symantec Corporation’s Website Security business unit. As a result, DigiCert is now the registered owner of this Certification Practices Statement document and the PKI Services described within this document. However, a hybrid of references to “VeriSign,” “Symantec” and “DigiCert” shall be evident within this document for a period of time until it is operationally practical to complete the re-branding of the Certification Authorities and services. Any references to VeriSign or Symantec as a corporate entity should be strictly considered to be legacy language that solely reflects the history of ownership. Trademark Notices Symantec, the Symantec logo, and related marks are the registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. The VeriSign logo, VeriSign Trust and other related marks are the trademarks or registered marks of VeriSign, Inc. or its affiliates or subsidiaries in the U.S. and other countries. Other names may be trademarks of their respective owners. Without limiting the rights reserved above, and except as licensed below, no part of this publication may be reproduced, stored in or introduced into a retrieval system, or transmitted, in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), without prior written permission of DigiCert, Inc. Notwithstanding the above, permission is granted to reproduce and distribute this DigiCert Certification Practices Statement for Symantec Trust Network (STN) on a nonexclusive, royalty- free basis, provided that (i) the foregoing copyright notice and the beginning paragraphs are prominently displayed at the beginning of each copy, and (ii) this document is accurately reproduced in full, complete with attribution of the document to DigiCert, Inc. Requests for any other permission to reproduce this DigiCert Certification Practices Statement for Symantec Trust Network (STN) (as well as requests for copies from DigiCert) must be addressed to DigiCert, Inc., 2801 N. Thanksgiving Way, Suite 500, Lehi, UT 84043 USA Tel 1-801-877-2100 Fax 1-801-705-0481 Email: [email protected]. - ii - Table of Contents Who Can Submit a Certificate Application? . 19 4.1.2 Enrollment Process and Responsibilities..... 19 1. INTRODUCTION .................................................... 1 4.2 CERTIFICATE APPLICATION PROCESSING ................. 19 4.2.1 Performing Identification and Authentication 1.1 OVERVIEW ..................................................................... 2 Functions .............................................................. 19 1.2 DOCUMENT NAME AND IDENTIFICATION ...................... 4 4.2.2 Approval or Rejection of Certificate 1.3 PKI PARTICIPANTS ........................................................ 4 Applications .......................................................... 20 1.3.1 Certification Authorities ............................... 4 4.2.3 Time to Process Certificate Applications ..... 20 1.3.2 Registration Authorities ............................... 4 4.2.4 Certificate Authority Authorization (CAA) ..... 20 1.3.3 Subscribers................................................ 5 4.3 CERTIFICATE ISSUANCE ............................................. 20 1.3.4 Relying Parties ........................................... 5 4.3.1 CA Actions during Certificate Issuance ....... 20 1.3.5 Other Participants....................................... 5 4.3.2 Notifications to Subscriber by the CA of 1.4 CERTIFICATE USAGE .................................................... 5 Issuance of Certificate ........................................... 21 1.4.1 Appropriate Certificate Usages .................... 5 4.3.3 CABF Requirement for Certificate Issuance by 1.4.2 Prohibited Certificate Uses .......................... 7 a Root CA ............................................................. 21 1.5 POLICY ADMINISTRA TION .............................................. 7 4.4 CERTIFICATE ACCEPTANCE ........................................ 21 1.5.1 Organization Administering the Document .... 7 4.4.1 Conduct Constituting Certificate Acceptance 1.5.2 Contact Person........................................... 8 21 1.5.3 Person Determining CP Suitability for the 4.4.2 Publication of the Certificate by the CA........ 21 Policy 8 4.4.3 Notification of Certificate Issuance by the CA 1.5.4 CPS Approval Procedure ............................ 8 to Other Entities .................................................... 21 1.6 DEFINITIONS AND ACRONYMS ...................................... 9 4.5 KEY PAIR AND CERTIFICATE USAGE ......................... 21 1.6.1 References ................................................ 9 4.5.1 Subscriber Private Key and Certificate Usage 2. PUBLICATION AND REPOSITORY 21 RESPONSIBILITIES ....................................................... 9 4.5.2 Relying Party Public Key and Certificate Usage 21 2.1 REPOSITORIES ............................................................... 9 4.6 CERTIFICATE RENEWAL.............................................. 22 2.2 PUBLICATION OF CERTIFICATE INFORMATION............. 9 4.6.1 Circumstances for Certificate Renewal ........ 22 2.3 TIME OR FREQUENCY OF PUBLICATION ....................... 9 4.6.2 Who May Request Renewal ....................... 22 2.4 ACCESS CONTROLS ON REPOSITORIES .................... 10 4.6.3 Processing Certificate Renewal Requests ... 22 3. IDENTIFICATION AND AUTHENTICATION ............10 4.6.4 Notification of New Certificate Issuance to Subscriber ............................................................ 22 3.1 NAMING ........................................................................ 10 4.6.5 Conduct Constituting Acceptance of a 3.1.1 Type of Names ..........................................10 Renewal Certificate ............................................... 23 3.1.2 Need for Names to be Meaningful ...............12 4.6.6 Publication of the Renewal Certificate by the 3.1.3 Anonymity or Pseudonymity of Subscribers. 13 CA 23 3.1.4 Rules for Interpreting Various Name Forms. 13 4.6.7 Notification of Certificate Issuance by the CA 3.1.5 Uniqueness of Names ................................13 to Other Entities .................................................... 23 3.1.6 Recognition, Authentication, and Role of 4.7 CERTIFICATE RE-KEY................................................. 23 Trademarks...........................................................13 4.7.1 Circumstances for Certificate Re-Key ......... 23 3.2 INITIAL IDENTITY VALIDATION...................................... 13 4.7.2 Who May Request Certification of a New 3.2.1 Method to Prove Possession of Private Key 13 Public Key............................................................. 23 3.2.2 Authentication of Organization Identity and 4.7.3 Processing Certificate Re-Keying Requests 23 Domain Control .....................................................13 4.7.4 Notification of New Certificate Issuance to 3.2.3 Authentication of Individual Identity .............15 Subscriber ............................................................ 23 3.2.4 Non-Verified Subscriber information ............16 4.7.5 Conduct Constituting Acceptance of a Re- 3.2.5 Validation of Authority ................................17 Keyed Certificate................................................... 23 3.2.6 Criteria for Interoperation............................17 4.7.6 Publication of the Re-Keyed Certificate by the 3.3 IDENTIFICATION AND AUTHENTICA TION FOR RE-KEY CA 23 REQUESTS .................................................................................. 17 4.7.7 Notification of Certificate Issuance by the CA 3.3.1 Identification and Authentication for Routine to Other Entities .................................................... 23 Re-key 17 4.8 CERTIFICATE MODIFICATION....................................... 24 3.3.2 Identification and Authentication for Re-key 4.8.1 Circumstances for Certificate Modification... 24 After Revocation ....................................................18 4.8.2 Who May Request Certificate Modification .. 24 3.4 IDENTIFICATION AND AUTHENTICA TION FOR 4.8.3 Processing Certificate Modification Requests REVOCATION REQUEST ............................................................. 18 24 4. CERTIFICATE LIFE-CYCLE OPERATIONAL 4.8.4 Notification of New Certificate Issuance to REQUIREMENTS ..........................................................19 Subscriber ............................................................ 24 4.1 CERTIFICATE APPLICATION ......................................... 19 - iii - 4.1.1 4.8.5 Conduct Constituting Acceptance of Modified Background Check Procedures .................. 36 Certificate .............................................................24 5.3.3 Training Requirements............................... 37 4.8.6 Publication of the Modified Certificate by the 5.3.4 Retraining Frequency and Requirements .... 37 CA 24 5.3.5 Job Rotation Frequency and Sequence ....... 38 4.8.7 Notification of Certificate Issuance