Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

Any CA may unilaterally revoke another CA certificate it has issued. However, the ROA for a
Raytheon CA shall revoke a Subject CA certificate only in the case of an emergency.
Generally, the certificate shall be revoked based on the subject request, authorized
representative of subject request, or RPMA request.
Upon receipt of a revocation request, a CA shall authenticate the request and then revoke the
certificate. In the case of a CA certificate issued by a Raytheon CA, the ROA shall seek
guidance from the RPMA before revocation of the certificate except when the RPMA is not
available and there is an emergency situation such as:
� Request from the Signing CA for reason of key compromise;
� Determination by the Raytheon Operational Authority that a Subject CA key is
compromised; or
� Determination by the Raytheon Operational Authority that a Subject CA is in violation
of the CP or CPS to a degree that threatens the integrity of the Raytheon PKI.
At the medium-hardware, medium-CBP-hardware, and high-hardware assurance levels, a
Subscriber ceasing its relationship with an organization that sponsored the certificate shall, prior
to departure, surrender to the organization (through any accountable mechanism) all
cryptographic hardware tokens that were issued by or on behalf of the sponsoring organization.
The token shall be zeroized or destroyed promptly upon surrender and shall be protected from
malicious use between surrender and zeroization or destruction.
If a Subscriber leaves an organization and the hardware tokens cannot be obtained from the
Subscriber, then all Subscriber certificates associated with the unretrieved tokens shall be
immediately revoked for the reason of key compromise.
4.9.4 Revocation Request Grace Period
There is no revocation grace period. Responsible parties must request revocation as soon as
they identify the need for revocation.
4.9.5 Time within which CA must Process the Revocation Request
RRCA shall process all revocation requests within six hours of receipt of request.
For Signing CAs, revocation request processing time shall be as specified below:
Assurance Level Processing Time for Revocation Requests
Medium Software and
Medium CBP Software
Medium Hardware and
Medium CBP Hardware
Within 18 hours of receipt of request
Within 18 hours of receipt of request
High Hardware Within six hours of receipt of request
4.9.6 Revocation Checking Requirements for Relying Parties
Use of revoked certificates could have damaging or catastrophic consequences in certain
applications. The matter of how often new revocation data should be obtained is a
determination to be made by the Relying Party and the system accreditor. If it is temporarily
infeasible to obtain revocation information, then the Relying Party must either reject use of the
37 7/25/2011