Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

10.8 Medium Assurance Subscriber Encryption Certificate
Field Value
Version V3 (2)
Serial Number Must be unique
Issuer Signature Algorithm sha-1WithRSAEncryption {1 2 840 113549 1 1 5} or
sha256 WithRSAEncryption {1 2 840 113549 1 1 11}
Issuer Distinguished Name ou=class3, o=CAs, dc=raytheon, dc=com
Validity Period No longer than 3 years from date of issue expressed in UTCTime until
2049
Subject Unique X.500 subject DN within the namespace dc=raytheon, dc=com
as specified in Section 7.1.4 of the Raytheon CP
Public Key 2048 bit RSA key modulus, rsaEncryption
Issuer’s Signature sha-1WithRSAEncryption {1 2 840 113549 1 1 5} or
sha256 WithRSAEncryption {1 2 840 113549 1 1 11}
Extension Value
Authority Key Identifier c=no; Octet String (same as subject key identifier in MASCA certificate)
Subject Key Identifier c=no; Octet String (same as in PKCS#10 request or calculated by the
MASCA )
Key Usage c=yes; keyEncipherment
Certificate Policies 20 c=no;
SHA-1: {1.3.6.1.4.1.1569.10.1.2} or {1.3.6.1.4.1.1569.10.1.3} or
{1.3.6.1.4.1.1569.10.1.4} or {1.3.6.1.4.1.1569.10.1.5} or
SHA-256: {1.3.6.1.4.1.1569.10.1.12} or {1.3.6.1.4.1.1569.10.1.13} or
{1.3.6.1.4.1.1569.10.1.14} or {1.3.6.1.4.1.1569.10.1.15}
Subject Alternative Name c=no; RFC822 email address (required); others optional
Subject Directory Attributes c=no; Entrust User Role= integer, where integer is a numeric role
identifier
Authority Information Access c=no; id-ad-caIssuers access method entry contains HTTP URL for .p7c
file containing certificates issued to MASCA or LDAP URL pointer to the
caCertificate attribute of the MASCA; id-ad-ocsp access method entry
contains HTTP URL for the MASCA OCSP Responder
CRL Distribution Points 21 c=no
Entrust Version Info Entrust Authority Security Manager = 7.1; Key Update Allowed = Yes;
Certificate Category = Enterprise
20
Certificate Policies will be asserted such that all lower assurance policies will also be asserted. (For
example if 10.4 is asserted 10.5 will also be asserted).
21
The CRL distribution point extension shall only populate the distributionPoint field. The
distributionPoint field shall contain HTTP (i.e., of the form http://…) URI. The distributionPoint field may
contain LDAP (i.e., of the form ldap://…) URI. The reasons and cRLIssuer fields shall not be populated.
The CRL shall point to a full and complete CRL or a Distribution Point based partitioned CRL. The
Distribution Point field shall contain a full name (i.e, the Distribution Point field shall not contain
nameRelativetoCRLIssuer).
96 7/25/2011