Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

For subscriber certificates, the prospective subscriber must perform the following steps when
the subscriber applies for a certificate:
� Obtain a public/private key pair for each certificate required, and;
� Provide a point of contact for verification of any roles or authorizations requested.
These steps may be performed in any order that is convenient for the CA, RAs, Trusted Agent
and Subscribers, and that do not defeat security, but all must be completed prior to certificate
issuance. All communications among CAs supporting the certificate application and issuance
process shall be authenticated and protected from modification using mechanisms
commensurate with the requirements of the data to be protected by the certificates being issued
(i.e., communications supporting the issuance of Medium Assurance certificates shall be
protected using Medium Assurance certificates, or some other mechanism of equivalent
strength). Any electronic transmission of shared secrets shall be protected (e.g., encrypted)
using means commensurate with the requirements of the data to be protected by the certificates
being issued.
4.1.1 Submission of Certificate Application
For certificate applications to a Raytheon CA, an authorized representative of the Subject CA
shall submit the application to the RPMA.
For subscriber certificates, the application shall be submitted by an authorized prospective
subscriber in the case of human subscribers, or an authorized PKI sponsor in the case of
components.
4.1.2 Enrollment Process and Responsibilities
CAs external to the Raytheon policy domain applying for cross certification with the Raytheon
PKI shall submit a request for cross-certification to the Raytheon PMA accompanied by their
CP. The Raytheon PMA shall require a CP/CPS compliance audit, from a third-party auditor, as
described in section 8. The Raytheon PMA shall perform a certificate policy mapping to validate
policy assurance levels are equivalent. Upon issuance, each cross-certificate issued by the
Raytheon PKI shall be manually checked to ensure each field and extension is properly
populated with the correct information, before the certificate is delivered to the Subject CA.
Raytheon CAs shall submit a request to the Raytheon PMA, accompanied by their CPS. The
Raytheon PMA shall evaluate the submitted CPS for acceptability. The Raytheon PMA may
require an initial compliance audit, performed by parties of the Raytheon PMA’s choosing, to
ensure that the CA is in compliance with this CP, prior to the PMA authorizing the Raytheon
Root CA to issue a certificate to the applying CA and authorizing the CA to issue and manage
certificates asserting a policy OID from this CP.
The RRCA shall only issue certificates to subordinate CAs upon receipt of written authorization
from the Raytheon PMA.
CAs shall issue certificates asserting a policy OID from this CP only upon receipt of written
authorization from the Raytheon PMA, and then may do so only within the constraints imposed
by the Raytheon PMA or its designated representatives.
For applications by end-entities, the Trusted Agent or Registration Authority must verify all
subscriber information, in accordance with section 3.2.3. In addition, the Trusted Agent or
Registration Authority shall sign the Subscriber Agreement. Subscribers are expected to
31 7/25/2011