Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

10.4 High Assurance Subscriber Signature Certificate
Note: These certificates are only issued to Trusted PKI Operators.
Field Value
Version V3
Serial Number Must be unique
Issuer Signature Algorithm sha-1WithRSAEncryption {1 2 840 113549 1 1 5} or
sha256 WithRSAEncryption {1 2 840 113549 1 1 11}
Issuer Distinguished Name ou=RaytheonRoot, o=CAs, dc=raytheon, dc=com
Validity Period No longer than 3 years from date of issue expressed in UTC Time until
2049
Subject Distinguished Name Unique X.500 subject DN within the namespace dc=raytheon, dc=com as
specified in Section 7.1.4 of the Raytheon CP
Subject Public Key Information 2048 bit RSA key modulus, rsaEncryption {1 2 840 113549 1 1 1}
Issuer’s Signature sha-1WithRSAEncryption {1 2 840 113549 1 1 5} or
sha256 WithRSAEncryption {1 2 840 113549 1 1 11}
Extension Value
Key Usage c=yes; digitalSignature,nonRepudiation
Private Key Usage Period c=no; 2 years for 2048 bit keys
Subject Alternative Name c=no; RFC822 email address (required); others optional
Subject Directory Attributes c=no; Entrust User Role= integer, where integer is a numeric role
identifier
CRL Distribution Points 12 c=no
Authority Key Identifier c=no; Octet String (same as subject key identifier in the Issuing CA
certificate)
Subject Key Identifier c=no; Octet String (same as in PKCS#10 request or calculated by the
Signing CA per RFC 3280 method 1 or other method)
Certificate Policies c=no;
SHA-1: {1.3.6.1.4.1.1569.10.1.1} or
SHA-256: {1.3.6.1.4.1.1569.10.1.11}
Authority Information Access c=no; id-ad-caIssuers access method entry contains HTTP URL for .p7c
file containing certificates issued to Issuing CA or LDAP URL pointer to
the caCertificate attribute of the Issuing CA; id-ad-ocsp access method
entry contains HTTP URL for the Issuing CA OCSP Responder
Entrust Version Info c=no; Entrust Authority Security Manager = 7.1; Key Update Allowed =
Yes; Certificate Category = Enterprise
12 The CRL distribution point extension shall only populate the distributionPoint field. The
distributionPoint field shall contain HTTP (i.e., of the form http://…) URI. The distributionPoint
field may contain LDAP (i.e., of the form ldap://…) URI. The reasons and cRLIssuer fields shall
not be populated. The CRL shall point to a full and complete CRL or a Distribution Point based
partitioned CRL. The Distribution Point field shall contain a full name (i.e, the Distribution Point
field shall not contain nameRelativetoCRLIssuer).
90 7/25/2011