Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

10 CERTIFICATE, CRL, AND OCSP FORMATS
This section contains the formats for the various PKI objects such as certificates, CRLs, and
OCSP requests and responses. The section only contains certificate profiles based on RSA.
For algorithm identifiers, parameter encoding, public key encoding, and signature encoding for
ECDSA and ECDH, RFC3279 shall be used.
Certificates and CRLs issued under a policy OID of this CP shall not contain any critical
extensions not listed in the profiles in this section. Certificates and CRLs issued under a policy
OID of this CP may contain non-critical extensions not listed in the profiles in this section only
upon RPMA approval.
First entries in the caIssuers field of the AIA extension and CRL DP shall point to a resource
that is publicly available using HTTP. If LDAP pointers are used, they shall appear only after
the HTTP pointers.
For attribute values other than dc: All CA Distinguished Names (in various fields such as Issuer,
Subject, Subject Alternative Name, Name constraints, etc.) shall be encoded as printable string.
All subscriber DN portions that name constraints apply to, shall be encoded as printable string.
Other portions of the subscriber DN shall be encoded as printable string if possible. If a portion
cannot be encoded as printable string, then and only then shall it be encoded using a different
format and that format shall be UTF8.
For dc and email address attribute values: All dc attribute values shall be encoded as IA5
string.
CAs may issue partitioned CRL as long as the CRLs are not indirect CRL, are not partitioned by
reason code, and CRL DP and Issuing Distribution Point do not assert name relative to issuer.
If the Entity PKI provides OCSP services for a CA, that CA must also issue a full and complete
CRL (i.e., a CRL without Issuing Distribution Point extension) for the use by the OCSP
Responder.
85 7/25/2011