This document defines the Certification Policies and Practices in accordance with the X.509 standard under which the State of Maine will operate its Certification Authorities in support of the PKI project.

 

 

 

 

 

 

 

 

State of Maine

Office of Information Technology

 

This page intentionally left blank.

Certification Policies and Practices Statement 1

1. Introduction. 2

1.1 Overview.. 2

1.1.1 Roles and Responsibilities. 2

1.2 Identification. 2

1.3 Community and Applicability. 2

1.3.1 Certification Authorities. 2

1.3.2 Registration Authorities. 2

1.3.3 End-entities. 2

1.3.4 Applicability. 2

1.3.4.1  Level of Assurance. 2

1.3.4.2  General Usage. 2

1.3.4.3 Suitable Applications. 2

1.3.4.4 Approved Applications. 2

1.3.4.3 Prohibited Applications. 2

1.4 Contact Details. 2

2. General Provisions. 2

2.1 Liability. 2

2.1.1 Warranties and Limitations. 2

2.1.2 Disclaimers. 2

2.1.3 Loss Limitations. 2

2.1.4 Other Exclusions. 2

2.2 Obligations. 2

2.2.1 CA Obligations. 2

2.2.2 RA Obligations. 2

2.2.3 Subscriber Obligations. 2

2.2.4 Relying Party Obligations. 2

2.3 Financial Responsibility. 2

2.3.1 Indemnification by Relying Parties. 2

2.3.2 Fiduciary Relationships. 2

2.4 Interpretations and Enforcement 2

2.4.1 Governing Law.. 2

2.4.2 Severability, Survival, Merger, Notice. 2

2.4.3 Dispute Resolution Procedures. 2

2.5 Fees. 2

2.5.1 Certificate Issuance or Renewal Fees. 2

2.5.2 Certificate Access Fees. 2

2.5.3 Revocation or Status Information Access Fees. 2

2.5.4 Fees for Other Services such as Policy Information. 2

2.5.5 Refund Policy. 2

2.6 Publication and Repositories. 2

2.6.1 Publication of CA Information. 2

2.6.2 Frequency of Publication. 2

2.6.3 Access Controls. 2

2.6.4 Repositories. 2

2.7 Compliance Audit 2

2.7.1 Frequency of Entity Compliance Audit 2

2.7.2 Identity/Qualifications of Auditor 2

2.7.3 Auditor’s Relationship to Audited Party. 2

2.7.4 Topics Covered by Audit 2

2.7.5 Actions Taken as a Result of Deficiency. 2

2.7.6 Communication of Results. 2

2.8 Confidentiality. 2

2.8.1 Types of Information to be Kept Confidential 2

2.8.2 Types of Information not Considered Confidential 2

2.8.3 Disclosure of Certificate Revocation/Suspension Information. 2

2.8.4 Release to Law Enforcement Officials. 2

2.8.5 Release as Part of Civil Discovery. 2

2.9 Intellectual Property Rights. 2

3. Identification and Authentication. 2

3.1 Initial Registration. 2

3.1.1 Types of Names 2

3.1.2 Need for Names to be Meaningful 2

3.1.3 Rules for Interpreting Various Name Forms. 2

3.1.4 Uniqueness of Names. 2

3.1.5 Name Claim Dispute Resolution Procedure. 2

3.1.6 Recognition, Authentication and Role of Trademarks. 2

3.1.7 Method to Prove Possession of Private Key. 2

3.1.8 Authentication of Organization Identity. 2

3.1.9 Authentication of Individual Identity. 2

3.2 Routine Rekey. 2

3.3 Rekey After Revocation. 2

3.4 Revocation Request 2

4. Operational Requirements. 2

4.1 Certificate Application. 2

4.1.1 Delivery of Subscriber's public key to certificate issuer 2

4.2 Certificate Issuance. 2

4.2.2 CA public key delivery to users. 2

4.3 Certificate Acceptance. 2

4.4 Revocation. 2

4.4.1 Circumstances for revocation. 2

4.4.1.1 Who can request a revocation. 2

4.4.1.2 Procedure for Revocation Request 2

4.4.1.3 Revocation Grace Period. 2

4.4.2 Certificate Revocation Lists. 2

4.4.2.1 CRL issuance frequency. 2

4.4.2.2 CRL checking requirements. 2

4.5 Security Audit Procedures. 2

4.5.1 Types of events recorded. 2

4.5.2 Frequency of processing data. 2

4.5.3 Retention period for security audit data. 2

4.5.4 Protection of security audit data. 2

4.5.5 Security audit data backup procedures. 2

4.5.6 Security audit collection system.. 2

4.5.7 Notification to event-causing subject 2

4.5.8 Vulnerability assessments. 2

4.6 Records Archival 2

4.6.1 Types of data archived. 2

4.6.3 Protection of archive. 2

4.6.4 Archive backup procedures. 2

4.6.5 Archive collection system.. 2

4.6.6 Procedures to obtain archive information. 2

4.7 CA Key Changeover 2

4.8 Compromise and Disaster Recovery. 2

4.8.1 Compromise recovery. 2

4.8.2 Disaster recovery. 2

4.8.3 Lease Hold Replacement 2

4.9 CA Termination. 2

5. Physical, Procedural, and Personnel Security Controls. 2

5.1 Physical Controls. 2

5.2 Procedural Controls. 2

5.2.1 Trusted Roles. 2

5.2.2 Number of Persons Required per Task. 2

5.2.3 Identification and Authentication for Each Role. 2

5.2.4 Separation of Roles. 2

5.3 Personnel Security Controls. 2

5.3.1 Personnel Security Controls for Certification Authority. 2

5.3.2 Personnel Security Controls for Registration Authority 2

5.3.3 Personnel Security Controls for End-Entities. 2

6. Technical Security Controls. 2

6.1 Key Pair Generation and Installation. 2

6.1.1 Key Pair Generation. 2

6.1.2 Private and Public Key Delivery to Entity. 2

6.1.3 CA Public Key Delivery to Users. 2

6.1.5 Key Sizes. 2

6.1.8 Software Key Generation. 2

6.1.9 Key Usage Purposes. 2

6.2 Private Key Protection. 2

6.2.1 Standards for Cryptographic Module. 2

6.2.2 Private Key Multi-person Control 2

6.2.3 Private Key Escrow, Backup and Recovery. 2

6.2.4 Private Key Activation and Entry into Cryptographic Module. 2

6.2.5 Method of Deactivating Private Key. 2

6.2.6 Method of Destroying Private Key. 2

6.3 Other Aspects of Key Pair Management 2

6.3.1 Public Key Archival 2

6.3.2 Usage Periods for the Public and Private Keys. 2

6.4 Activation Data. 2

6.5 Computer Security Controls. 2

6.6 Lifecycle Security Controls. 2

6.7 Network Security Controls. 2

7. Certificate and CRL Profile. 2

7.1 Certificate Profile. 2

7.1.1 Version numbers. 2

7.1.2 Certificate extensions. 2

7.1.3 Name forms. 2

7.1.4 Name constraints. 2

7.2 CRL Profile. 2

8. Specification Administration. 2

8.1 SPECIFICATION CHANGE PROCEDURES. 2

8.2 Publication And Notification Policies. 2

8.3 CPS and External Policy Approval Procedures. 2

8.4 WAIVERS. 2

 

Version Information