Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

present proof of identity to Trusted Agents or Registration Authorities, to agree to the Subscriber
Agreement, and to sign it with a handwritten signature.
4.2 Certificate Application Processing
It is the responsibility of the CA and RA to verify that the information in certificate applications is
accurate. The CPS shall specify procedures to verify information in certificate applications.
4.2.1 Performing Identification and Authentication Functions
For the cross-certificate issued by the RRCA, the identification and authentication of the
applicant representing the Entity CA shall be performed by the Raytheon Operational Authority.
For the Raytheon CAs, the identification and authentication of the applicant representing the
Raytheon CA shall be performed by the Raytheon Operational Authority.
For end entity certificates issued by the Raytheon Signing CA, the identification and
authentication of the Subscriber must meet the requirements specified for Subscriber
authentication as specified in Sections 3.2 and 3.3 of this CP.
Prior to certificate issuance, a Subscriber shall be required to sign a document containing the
requirements the Subscriber shall protect the private key and use the certificate and private key
for authorized purposes only.
4.2.2 Approval or Rejection of Certificate Applications
For a CA certificate application, the RPMA may approve or reject a certificate application.
For subscriber certificates, the Trusted Agent, RA or CA may approve or reject a certificate
application.
4.2.3 Time to Process Certificate Applications
The entire subscriber registration process (i.e., from initial application to identity proofing to
certificate issuance) shall take no more than 30 days.
No stipulation for the CA application registration process.
4.3 Certificate Issuance
Upon receiving a request for a certificate, the CA or RA shall respond in accordance with the
requirements set forth in this CP and the applicable CPS.
The certificate request may contain an already built ("to-be-signed") certificate. This certificate
shall not be signed until the process set forth in this CP and the applicable CPS has been met.
While the Subscriber may do most of the data entry, it is still the responsibility of the CA and the
RA to verify that the information is correct and accurate. This may be accomplished through a
system approach linking trusted databases containing personnel information, other equivalent
authenticated mechanisms, or through personal contact with the Subscriber’s sponsoring
organization. If databases are used to confirm Subscriber information, then these databases
must be protected from unauthorized modification to a level commensurate with the level of
assurance of the certificate being sought. Specifically, the databases shall be protected using
physical security controls, personnel security controls, cryptographic security controls, computer
security controls, and network security controls specified for the RA elsewhere in this CP.
32 7/25/2011