Certificate Practice Statement
A Certification Practice Statement (CPS) is the document that describes how a CA is run: how identities are checked, how certificates are issued and revoked, and how keys are protected. Relying parties and auditors use it to decide how much trust to place in the certificates.
EC maintains a CPS for each PKI-as-a-Service hierarchy, structured according to RFC 3647. A customer-specific CPS is agreed during the design phase and is referenced in each CA certificate through the Certificate Policies extension. The CPS is available on request through EC Support or the customer's EC engagement lead.
The CPS is organised in nine sections:
- Introduction: the hierarchy, the parties involved (EC, the customer, subscribers and relying parties) and the certificate uses allowed.
- Publication and repository: where the CPS, CA certificates and CRLs are published, which for PKI-as-a-Service is Azure Blob Storage reached through the customer's CNAME.
- Identification and authentication: how requesters are identified, through Active Directory, portal accounts, MDM challenges and approval workflows.
- Certificate life-cycle: how certificates are requested, issued, accepted, renewed, re-keyed and revoked, and how often CRLs are published.
- Facility, management and operational controls: the physical security of the EC datacenter, staff roles, audit logging, records retention and business continuity.
- Technical security controls: key generation in the HSM, key sizes and algorithms, key backup and the CA key life-time.
- Certificate and CRL profiles: the fields and extensions used in certificates and CRLs.
- Compliance audit: how and how often the CA operations are assessed.
- Other business and legal matters: liability, privacy, term and termination.