Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

More documents

Recommendations

Info

Field Value Subject Directory Attributes c=no; Entrust User Role= integer, where integer is a numeric role identifier Certificate Template Name c=no; DomainController {1.3.6.1.4.1.311.20.2} 102 7/25/2011
10.13 Medium Assurance Role Signature Certificate Field Value Version V3 (2) Serial Number Must be unique Issuer Signature Algorithm sha-1WithRSAEncryption {1 2 840 113549 1 1 5} or sha256 WithRSAEncryption {1 2 840 113549 1 1 11} Issuer Distinguished Name ou=class3, o=CAs, dc=raytheon, dc=com Validity Period No longer than 3 years from date of issue expressed in UTC Time until 2049 Subject Distinguished Name Unique X.500 subject DN for role within the namespace dc=raytheon, dc=com as specified in Section 7.1.4 of the Raytheon CP Subject Public Key Information 2048 bit RSA key modulus, rsaEncryption Issuer’s Signature sha-1WithRSAEncryption {1 2 840 113549 1 1 5} or sha256 WithRSAEncryption {1 2 840 113549 1 1 11} Extension Value Authority Key Identifier c=no; Octet String (same as subject key identifier in MASCA certificate ) Subject Key Identifier c=no; Octet String (same as in PKCS-10 request or calculated by the MASCA) Key Usage c=yes; nonRepudiation, digitalSignature Certificate Policies c=no; SHA-1: {1.3.6.1.4.1.1569.10.1.2} or {1.3.6.1.4.1.1569.10.1.4} or SHA-256: {1.3.6.1.4.1.1569.10.1.12} or {1.3.6.1.4.1.1569.10.1.14} Subject Alternative Name c = no; DN of the person controlling the role signing private key; RFC822 email address of role (optional) Subject Directory Attributes c=no; Entrust User Role= integer, where integer is a numeric role identifier CRL Distribution Points 30 c = no; Authority Information Access c=no; id-ad-caIssuers access method entry contains HTTP URL for .p7c file containing certificates issued to MASCA or LDAP URL pointer to the caCertificate attribute of the MASCA; id-ad-ocsp access method entry contains HTTP URL for the MASCA OCSP Responder Entrust Version Info Entrust Authority Security Manager = 7.1; Key Update Allowed = Yes; Certificate Category = Enterprise 30 The CRL distribution point extension shall only populate the distributionPoint field. The distributionPoint field shall contain HTTP (i.e., of the form http://…) URI. The distributionPoint field may contain LDAP (i.e., of the form ldap://…) URI. The reasons and cRLIssuer fields shall not be populated. The CRL shall point to a full and complete CRL or a Distribution Point based partitioned CRL. The Distribution Point field shall contain a full name (i.e., the Distribution Point field shall not contain nameRelativetoCRLIssuer). 103 7/25/2011
Page 1 and 2:
Raytheon Company Public Key Infrast
Page 3 and 4:
Table of Contents 1 INTRODUCTION ..
Page 5 and 6:
4.6.7 Notification of Certificate I
Page 7 and 8:
5.4.8 Vulnerability Assessments ...
Page 9 and 10:
9 OTHER BUSINESS AND LEGAL MATTERS
Page 11 and 12:
1 INTRODUCTION This Certificate Pol
Page 13 and 14:
1.1.3 Scope The following diagram r
Page 15 and 16:
1. The CAs asserting id-raytheon-SH
Page 17 and 18:
approval of the PMA. The ROA activi
Page 19 and 20:
� Raytheon employees and eligible
Page 21 and 22:
1.5 Policy Administration 1.5.1 Org
Page 23 and 24:
3.1 Naming 3 IDENTIFICATION & AUTHE
Page 25 and 26:
establishing how the applicant is k
Page 27 and 28:
4. The Identity Verifier shall reco
Page 29 and 30:
3.3.1 Identification and Authentica
Page 31 and 32:
For subscriber certificates, the pr
Page 33 and 34:
4.3.1 CA Actions during Certificate
Page 35 and 36:
4.7.4 Notification of New Certifica
Page 37 and 38:
Any CA may unilaterally revoke anot
Page 39 and 40:
4.9.8 Maximum Latency for CRLs The
Page 41 and 42:
4.12.2 Session Key Encapsulation an
Page 43 and 44:
depart shall initial a sign-out she
Page 45 and 46:
� Performing or overseeing intern
Page 47 and 48:
� Be trustworthy; � Have no oth
Page 49 and 50:
administrative documents (e.g., Adm
Page 51 and 52: REVOCATION PROFILE MANAGEMENT Audit
Page 53 and 54: It is acceptable for the system to
Page 55 and 56: 5.6 Key Changeover A CA uses a sign
Page 57 and 58: If a RA signature keys are compromi
Page 59 and 60: show that appropriate role separati
Page 61 and 62: Hashing: Cryptographic Function Has
Page 63 and 64: 6.2 Private Key Protection and Cryp
Page 65 and 66: 6.3 Other Aspects of Key Management
Page 67 and 68: � All hardware must be shipped or
Page 69 and 70: 7 CERTIFICATE, CRL AND OCSP PROFILE
Page 71 and 72: When multiple values exist for an a
Page 73 and 74: 8 COMPLIANCE AUDIT AND OTHER ASSESS
Page 75 and 76: 9.1 Fees 9 OTHER BUSINESS AND LEGAL
Page 77 and 78: � There are no material misrepres
Page 79 and 80: � Ensure that certificate and rev
Page 81 and 82: as a termination of this CP unless
Page 83 and 84: enforce the agreement to arbitrate,
Page 85 and 86: 10 CERTIFICATE, CRL, AND OCSP FORMA
Page 87 and 88: Field Value Policy Mapping For SHA-
Page 89 and 90: 10.3 Raytheon Root CA Certificate (
Page 91 and 92: 91 7/25/2011
Page 93 and 94: 10.6 Medium Assurance Signing CA Ce
Page 95 and 96: Field Value Entrust Version Info c=
Page 97 and 98: 10.9 Medium Assurance Code Signing
Page 99 and 100: Field Value Entrust Version Info En
Page 101: 10.12 Medium Assurance Domain Contr
Page 105 and 106: 10.15 OCSP Responder Certificate Th
Page 107 and 108: 10.17 Medium Assurance CA CRL Forma
Page 109 and 110: 11 PKI REPOSITORY INTEROPERABILITY
Page 111 and 112: BIBLIOGRAPHY The following document
Page 113 and 114: HTTP Hypertext Transfer Protocol IA
Page 115 and 116: 13 GLOSSARY Access Ability to make
Page 117 and 118: Client (application) A system entit
Page 119 and 120: Non-Repudiation Assurance that the
Page 121 and 122: other CA. (See superior CA). Subscr
show all

Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

Create successful ePaper yourself

Delete template?

Save as template?