ACP 185

UNCLASSIFIED
ANNEX A TO
ACP 185
components. In addition, the distribution of CA responsibilities between the CA itself and
Registration Authorities (RA) may vary in the implementation of the PKI.
If the NDPKI operates Certificate Status Authorities (CSA) or Key Escrow Servers (KES), all
requirements that apply to a CA apply equally to these entities unless specifically excluded.
Collectively the hardware, software, and operating personnel that create, sign, and issue public
key certificates to Subscribers is a Certificate Authority System (CAS).
1.3.3 Registration Authority
An RA is an entity authorized by the CAS to collect, verify, and submit information provided by
potential Subscribers which is to be entered into public key certificates. The term RA refers to
hardware, software, and individuals that collectively perform this function. Unless expressly
stated otherwise, RA requirements are imposed on all RA components of the NDPKI. RA
operations shall be performed in accordance with a CPS approved by the NDPKI PMA. RA
functions may be included in a single CPS, which also governs CAS operations, or may be
defined in a separate CPS. The RA is responsible for the following:
• Control over the registration process
• Identification and authentication process
1.3.4 Subscribers
A Subscriber is the entity whose name appears in the Subject field of a certificate, and who
asserts that the use of its public key and certificate is in accordance with the NDPKI CP. The
Subscriber is sometimes also called an “applicant” after applying to a CAS for a certificate, but
before the certificate issuance procedure is completed. Subscribers include entities that have
been approved in the NDPKI CP, such as but not limited to:
• Personnel
• Devices (e.g. Workstations, Firewalls, Routers, Trusted Servers, applications, systems
and other infrastructure components)
• Organisational roles associated with individuals, groups of individuals or
organisational entities
A Subscriber with a certificate issued under a NDPKI does not automatically receive access,
authority or privilege to the Defence assets or systems of the cross-certified NDPKI.
Uncontrolled copy when printed
1.3.5 Relying Parties
A Relying Party is the entity that relies on the validity of the binding of the Subscriber’s name to
a public key. A Relying Party is responsible for deciding whether or how to check the validity of
the certificate by checking the appropriate certificate status information. A Relying Party may
A-3
UNCLASSIFIED