IETF RFC 3647

Title: Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework

Category: Identity Provider Policy

Date: 11/1/2003

Creator: IETF

URL: http://www.ietf.org/rfc/rfc3647.txt

Description: A standard framework for Certificate Policies (CPs) and Certification Practice Statements (CPSs). The document is intended to provide a structure but not the requirements for what the policies should be. A Certificate Policy is defined as "a named set of rules that indicates the applicability of a certificate to a particular community and/or class of applications with common security requirements." The intention is for the CP to provide enough information for a Relying Party to be able to make a determination whether the operations are trustworthy. The Certification Practice Statement is a document detailing the practices employed by the CA in issuing certificates. The CPS is not typically publically available but is used by operators, system adminsitrators, policy management authorities and compliance auditors. IETF RFC 3647 is an update of IETF RFC 2527.

Privacy: The framework specifies where issuers document their privacy policy, what information is considered private within the PKI, responsibilities regarding protection of PII, requirements for consent and/or notification when PII is used or disclosed, and when participants may release PII during legal or administrative proceedings.

Security: The document is an information security standard.

Interoperability: The document supports an interoperable policy framework by providing a common framework for specifying an organization's policies for certificate issuance.

Terms: Activation Data, Authentication, Ca-certificate, Certificate Policy, Certification Path, Certification Practice Statement, CPS Summary (or CPS Abstract), Identification, Issuing Certification Authority (issuing CA), Participant, PKI Disclosure Statement, Policy Qualifier, Registration Authority, Relying Party, Relying Party Agreement, Set Of Provisions, Subject Certification Authority (subject CA), Subscriber, Subscriber Agreement