ACP 185

UNCLASSIFIED
ANNEX A TO
ACP 185
A request for re-key shall only be made by a Subscriber (or PKI sponsor acting on the
Subscriber’s behalf) in whose name the keys have been issued.
For certificates issued in hardware, the entity shall use the valid signature certificate and
associated private key stored on the hardware token to authenticate to the CA. The process shall
ensure that the signature keys are generated within the hardware token or, in the case of
externally generated keys, are inserted in the appropriate token, and the entity or PKI sponsor
shall provide proof of possession of its current private key.
Re-key requests for certificates shall be identified and authenticated on the basis of current valid
Subscriber certificates. The validity period of the new certificate shall not extend beyond the
periodic in-person authentication requirements listed in the table below.
Certificate Type
Software
Hard Token
Device
In Person Authentication Requirement
9 Years
6 Years
9 Years
For CA Key Changeover see 5.6 Key Changeover.
1.13.2 Identification and Authentication for Re-key after Revocation
Where the information in a certificate has changed or where the certificate is revoked the CA
shall authenticate a re-key in the same manner as in initial identity validation. Any change in the
information contained in the certificate shall be verified before the certificate is issued.
1.14 Identification and authentication for revocation request
Revocation requests shall be authenticated.
1.15 Identification and Authentication for Key Recovery Request
The identity of the requestor shall be authenticated either in a face to face authentication as
specified in Section 3.2.3 or using a digital signature based on a valid certificate with
cryptographic strength at least that of the certificate of the key to be recovered.
CERTIFICATE LIFE-CYCLE
Uncontrolled copy when printed
1.16 Certificate Application
The applicant and the CMA shall perform the following steps when an applicant applies for a
certificate:
• Establish and record the identity of the Subscriber (per Section 3.2);
A-9
UNCLASSIFIED