VTCA CP Update February 14, 2011

X.509 Certificate Policy
For The
Virginia Polytechnic Institute and State University
Certification Authorities
May 13, 2004
Amended July 7, 2009
OBJECT IDENTIFIER 1.3.6.1.4.1.6760.5.2.1.1.1
Release 1.0 Version 2.0

X.509 Certificate Policy
For The
Virginia Polytechnic Institute and State University
Certification Authorities
May 13, 2004
Amended March 16, 2011
OBJECT IDENTIFIER 1.3.6.1.4.1.6760.5.2.1.1.1
Release 1.0 Version 3.0

The VTCAs that comprise the VTPKI are part of a Public Key Infrastructure (PKI) hierarchy consisting of a Root CA and one or more Subordinate CA(s). This CP applies to the Virginia Tech Root CA and all of the Subordinate CAs within the VTPKI hierarchy. Any VTCA for which the Virginia Tech Root CA signs an authority certificate MUST adopt this CP or one that is consistent with all of the requirements of this CP as determined by the Policy Management Authority for the VTPKI.

The VTCAs that comprise the VTPKI are defined by independant Self Signed Root and Global Root CA hierarchies. Each Root CA hierarchy consists of one or more Subordinate CA(s). This CP applies to both Virginia Tech Root CA hierachies and all of the Subordinate CAs within each hierarchy. Any VTCA for which the Virginia Tech Self Signed Root or Global Root CA signs an authority certificate MUST adopt this CP or one that is consistent with all of the requirements of this CP as determined by the Policy Management Authority for the VTPKI.

The Virginia Tech Root CA MAY issue a PKC with certificate issuance rights (“authority PKC”) to another VTCA and in that case the Authorized Subordinate VTCA assumes the role of a CA under this CP. For all purposes under this CP, the Authorized Subordinate CA SHALL conform to, and operate under, this CP.

A Virginia Tech Root CA MAY issue a PKC with certificate issuance rights (“authority PKC”) to another VTCA and in that case the Authorized Subordinate VTCA assumes the role of a CA under this CP. For all purposes under this CP, the Authorized Subordinate CA SHALL conform to, and operate under, this CP.

In the case where the Virginia Tech Root CA certifies another Authorized Subordinate CA within its policy domain, the Virginia Tech Root Authorizing CA MUST impose restrictions on the name space that MAY be used by the Authorized Subordinate CA that are at least as restrictive as its own name constraints.

In the case where a Virginia Tech Root CA certifies another Authorized Subordinate CA within its policy domain, the Virginia Tech Root Authorizing CA MUST impose restrictions on the name space that MAY be used by the Authorized Subordinate CA that are at least as restrictive as its own name constraints.

The Virginia Tech Root CA and Authorized Subordinate CAs SHALL document in their respective CPSs:
• What name forms will be used.
• How the Virginia Tech Root CA and Authorized Subordinate CAs will interact to ensure this is accomplished.
• How the Virginia Tech Root CA and Authorized Subordinate CAs will allocate names within the Community to guarantee name uniqueness among current and past Subscribers (e.g., if "Joe Smith" leaves a Community, and a new, different "Joe Smith" enters the Community, how these two people will be provided unique Subject names).

A Virginia Tech Root CA and Authorized Subordinate CAs SHALL document in their respective CPSs:
• What name forms will be used.
• How a Virginia Tech Root CA and Authorized Subordinate CAs will interact to ensure this is accomplished.
• How a Virginia Tech Root CA and Authorized Subordinate CAs will allocate names within the Community to guarantee name uniqueness among current and past Subscribers (e.g., if "Joe Smith" leaves a Community, and a new, different "Joe Smith" enters the Community, how these two people will be provided unique Subject names).

When the Virginia Tech Root CA updates its private signature key and thus generates a new public key, the Virginia Tech Root CA SHALL notify all Authorized Subordinate or cross certified CAs, and SHOULD make a best effort to notify any Subscribers that rely on the VTCA's PKC, that it has been changed. For self signed ("root") PKCs, such PKCs SHALL be made available online along with separately retrievable verification information to enable a relying party to verify that it has received a valid copy of the new “root” PKC.

When a Virginia Tech Root CA updates its private signature key and thus generates a new public key, the Virginia Tech Root CA SHALL notify all Authorized Subordinate or cross certified CAs, and SHOULD make a best effort to notify any Subscribers that rely on the VTCA's PKC, that it has been changed. For self signed or globally trusted ("root") PKCs, such PKCs SHALL be made available online along with separately retrievable verification information to enable a relying party to verify that it has received a valid copy of the new “root” PKC.

If the VTCA is the Virginia Tech Root CA, the trusted self signed certificate MUST be removed from each Relying Party application, and a new one distributed via secure out of band mechanisms. The Virginia Tech Root CA SHALL describe its approach to reacting to a Root CA key compromise in their CPSs.

If the VTCA is a Virginia Tech Root CA, the trusted self signed certificate MUST be removed from each Relying Party application, and a new one distributed via secure out of band mechanisms. A Virginia Tech Root CA SHALL describe its approach to reacting to a Root CA key compromise in their CPSs.

The Virginia Tech Root CA of the VTPKI SHALL implement M of N authentication.( M number of persons from N total number of persons).

A Virginia Tech Root CA of the VTPKI SHALL implement M of N authentication.( M number of persons from N total number of persons).

The Virginia Tech Root CA equipment SHALL be implemented using a stand-alone (offline) configuration.

The equipment of a Virginia Tech Root CA SHALL be implemented using a stand-alone (offline) configuration.

VTPKI: Virginia Tech Public Key Infrastructure refers to the Virginia Tech Root CA and all of the Subordinate CAs within the PKI hierarchy.

VTPKI: Virginia Tech Public Key Infrastructure refers collectively to the Self Signed Root and Global Virginia Tech Root CAs and all of the Subordinate CAs within each PKI hierarchy.