A Certification Practice Statement (CPS) is a document from a certificate authority or a member of a web of trust which describes their practice for issuing and managing public key certificates.
Some elements of a CPS include documenting practices of:
- issuance
- publication
- archiving
- revocation
- renewal
By detailing the practice of issuance, revocation and renewal, a CPS aids entities in judging the relative reliability of a given certificate authority.
Certificate authorities
Main article: Certificate authority
In a certificate authority, the CPS should derive from the organization's certificate policy and may be referenced in issued certificates.3
Web of trust
Main article: Web of trust
Because individuals act as certifiers in a web of trust, individual CPS documents are sometimes used. For example, in a PGP WoT, the CPS might state that the certifying entity checked two forms of legal government ID before signing the person's public key.
Digital signatures
Main article: Digital signature
When verifying digital signatures, it's necessary to review the CPS so as to determine the meaning of the issuance of the certificate by the certifying entity.4
External links
- Microsoft.com "Creating Certificate Policies and Certificate Practice Statements"
- Security policy
- Example of a CPS for a Web of Trust: http://www.grep.be/gpg/cert-policy-v2
References
"Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework". IETF. November 2003. p. 15. RFC 3647. http://tools.ietf.org/html/rfc3647#page-15 ↩
American Bar Association Digital Signature Guidelines 1996, ISBN 1-57073-250-7 (section 1.8.1) /wiki/ISBN_(identifier) ↩
"Creating Certificate Policies and Certificate Practice Statements". https://technet.microsoft.com/en-us/library/cc780454(v=ws.10).aspx ↩
American Bar Association Digital Signature Guidelines 1996, ISBN 1-57073-250-7 /wiki/ISBN_(identifier) ↩