ACP 185

UNCLASSIFIED
ACP 185
607. Generation and transport of the certificate signing request
• The NDPKI operating the CA to be cross-certified will arrange for the
generation of the principal cross-certificate request at a mutually agreed date
and time. At least two persons will act as witnesses of the generation of the
certificate request. The Nation that will sign the cross-certificate request may
have a representative at the generation
• The principal cross-certificate request will be generated in an agreed file
format
• Authorised witnesses will record the requesting CA’s thumbprint, e.g. a hash
of its public key
• The request is saved to a media or application suitable for transportation (e.g.
on a CD)
• The request is safe handed 4 to authorised national representatives of the other
CCEB Member Nation
• The request is delivered to the cross-certifying NDPKI environment
608. Signing and publishing the principal cross-certificate
• Prior to signing the request, the cross-certifying NDPKI CA checks that the
request has not been tampered with, by verifying the CAs thumbprint on the
request file
• After checking that the request has not been tampered with, the principal
cross-certificate is signed by the applicable cross-certifying CCEB Member
Nation CA
• The principal cross-certificate is returned to the originating CCEB Member
Nation by a mutually agreed secure mechanism (e.g. safe hand)
• The principal cross-certificate will be published to a location where it is
accessible by Relying Parties (i.e. Subscribers) of the cross-certified NDPKI
Note: The indicative process described above is a one way process, i.e. the trust is one
way. The process will need to be repeated with roles reversed for mutual trust.
Uncontrolled copy when printed
4 Alternatively by any mutually agreed secure method.
6-2
UNCLASSIFIED