X-Git-Url: https://code.wpia.club/?a=blobdiff_plain;ds=sidebyside;f=static%2Fpolicy%2FCertificationPracticeStatement.html;h=78f28cc0eee55dd0ecde4ef80c04ed71b45ea1f2;hb=11fbfe265f754c7b5b3e591b0c3b934bca627d93;hp=b18273c8b8eb7b5161861f396fe65a0a2ebc4b89;hpb=f92f284f3a80e1f8fd87d2cc63288e1f1bbfeb9d;p=gigi.git diff --git a/static/policy/CertificationPracticeStatement.html b/static/policy/CertificationPracticeStatement.html index b18273c8..78f28cc0 100644 --- a/static/policy/CertificationPracticeStatement.html +++ b/static/policy/CertificationPracticeStatement.html @@ -69,7 +69,7 @@ a:hover { CAcert Policy Status
Creation date: 20060726
Status: DRAFT p20091108
- + @@ -278,7 +278,7 @@ for each class of certificate. Some content is incorporated under - 198 177 515 + @@ -302,7 +302,7 @@ The Association details are at the

CAcert is a Community formed of Members who agree to the - + CAcert Community Agreement. The CA is technically operated by the Community, under the direction of the Board of CAcert Incorporated. @@ -320,7 +320,7 @@ intermediate CAs under the present CPS.

1.3.2. Registration authorities

Registration Authorities (RAs) are controlled under Assurance Policy -(COD13). +(COD13).

1.3.3. Subscribers

@@ -337,7 +337,7 @@ Such Members then become Subscribers. A relying party is a Member, having agreed to the CAcert Community Agreement -(COD9), +(COD9), who, in the act of using a CAcert certificate, makes a decision on the basis of that certificate.

@@ -347,7 +347,7 @@ makes a decision on the basis of that certificate.

Member. Membership of the Community is as defined in the -COD9. +COD9. Only Members may RELY or may become Subscribers. Membership is free.

@@ -358,7 +358,7 @@ A senior and experienced Member of the CAcert Community who resolves disputes between Members, including ones of certificate reliance, under Dispute Resolution Policy -(COD7). +(COD7).

@@ -381,7 +381,7 @@ are unaware of the ramifications of usage. Their relationship with CAcert is described by the Non-related Persons - Disclaimer and Licence -(COD4). +(COD4). No other rights nor relationship is implied or offered.

@@ -416,8 +416,8 @@ and risks, liabilities and obligations in
- - + @@ -674,7 +674,7 @@ and will be submitted to vendors via the (Top-level) Root.
Type
Appropriate Certificate uses
+
Type
Appropriate Certificate uses
General
- + @@ -691,12 +691,12 @@ and will be submitted to vendors via the (Top-level) Root. - + - + @@ -705,7 +705,7 @@ and will be submitted to vendors via the (Top-level) Root. - @@ -713,8 +713,8 @@ and will be submitted to vendors via the (Top-level) Root. - + @@ -722,8 +722,8 @@ and will be submitted to vendors via the (Top-level) Root. - + @@ -731,14 +731,14 @@ and will be submitted to vendors via the (Top-level) Root. - + - + +
Level of Assurance
Level of Assurance
Anon Name Name+Anon
Remarks
Remarks
Top level
Root
•
-
•
+
•
•
•
•
•
Member
SubRoot
✔
✘
+
✘
✔
✔
✔
Assured
SubRoot
✘
-
✘
+
✘
✘
✔
✔
✔
Organisation
SubRoot
✘
-
✘
+
✘
✘
✔
✔
✔
Expiry of Certificates
6 months
-
24 months
+
6 months
24 months
Types
client, server
-
wildcard, subjectAltName
-
code-signing
+
client, server
wildcard, subjectAltName
code-signing
 (Inclusive to the left.)
@@ -763,7 +763,7 @@ look at the CPS to figure it out. - + @@ -778,7 +778,7 @@ look at the CPS to figure it out. - + @@ -790,21 +790,21 @@ look at the CPS to figure it out. - + - + - + - +
Level of Assurance
Level of Assurance
Named Anonymous Named
Remarks
Remarks
Class
1
Class
3
✘
-
✘
+
✘
✘
✔
✔
Assured Members only.
Intended for Reliance. 		Assured Members only.
Intended for Reliance.
Expiry of Certificates
6 months
-
24 months
+
6 months
24 months
Types available
simple only
-
wildcard, subjectAltName
+
simple only
wildcard, subjectAltName
@@ -848,7 +848,7 @@ and will only be used where new roots do not serve:

This document is administered by the policy group of -the CAcert Community under Policy on Policy (COD1). +the CAcert Community under Policy on Policy (COD1).

1.5.2. Contact person

@@ -875,7 +875,7 @@ Community found at policy forum. See discussion forums above.

CPS is controlled and updated according to the Policy on Policy -(COD1) +(COD1) which is part of Configuration-Control Specification (COD2).

@@ -913,7 +913,7 @@ As per above. Member. Everyone who agrees to the CAcert Community Agreement - (COD9). + (COD9). This generally implies having an account registered at CAcert and making use of CAcert's data, programs or services. A Member may be an individual ("natural person") @@ -923,7 +923,7 @@ As per above. Community. The group of Members who agree to the CAcert Community Agreement - (COD9) + (COD9) or equivalent agreements.

@@ -938,7 +938,7 @@ As per above. Assured Member. A Member whose identity has been sufficiently verified by Assurers or other - approved methods under Assurance Policy.

+ approved methods under Assurance Policy.

Assurer. @@ -949,7 +949,7 @@ As per above. Name. As defined in the Assurance Policy - (COD13), + (COD13), to describe a name of a Member that is verified by the Assurance process.

@@ -972,7 +972,7 @@ As per above. CAcert or the certificates that they may use, and are unaware of the ramifications of usage. They are not permitted to RELY, but may USE, under the - Non-Related Persons - Disclaimer and Licence (COD4). + Non-Related Persons - Disclaimer and Licence (COD4).

Reliance. @@ -1058,7 +1058,7 @@ for the general public.

-Under the Assurance Policy (COD13), +Under the Assurance Policy (COD13), there are means for Members to search, retrieve and verify certain data about themselves and others.

@@ -1196,7 +1196,7 @@ does not go into the certificate.

Each Member's Name (CN= field) -is assured under the Assurance Policy (COD13) +is assured under the Assurance Policy (COD13) or subsidiary policies (such as Organisation Assurance Policy). Refer to those documents for meanings and variations.

@@ -1237,7 +1237,7 @@ Uniqueness of Names within certificates is not guaranteed. Each certificate has a unique serial number which maps to a unique account, and thus maps to a unique Member. See the Assurance Statement within Assurance Policy -(COD13). +(COD13).

@@ -1249,7 +1249,7 @@ can only be registered to one Member.

Organisation Assurance Policy -(COD11) +(COD11) controls issues such as trademarks where applicable. A trademark can be disputed by filing a dispute. See @@ -1263,6 +1263,7 @@ Certificates containing International Domain Names, being those containing a ACE prefix (RFC3490 Section 5), will only be issued to domains satisfying one or more of the following conditions: +

-

+

Email address containing International Domain Names in the domain portion of the email address will also be required to satisfy one of the above conditions.

-The following is a list of accepted TLD Registrars: +The following is a list of accepted TLD Registrars:

@@ -1479,7 +1480,7 @@ The following is a list of accepted TLD Registrars:
Policy (character list)
-

+

This criteria will apply to the email address and server host name fields for all certificate types. @@ -1494,7 +1495,7 @@ The CAcert Inc. Board has the authority to decide to add or remove accepted TLD

Identity verification is controlled by the -Assurance Policy (COD13). +Assurance Policy (COD13). The reader is refered to the Assurance Policy, the following is representative and brief only.

@@ -1524,7 +1525,7 @@ to check the private key dynamically. Agreement. An Internet user becomes a Member by agreeing to the CAcert Community Agreement -(COD9) +(COD9) and registering an account on the online website. During the registration process Members are asked to supply information about themselves: @@ -1546,7 +1547,7 @@ for all service requests such as certificates.

Assurance. Each Member is assured according to Assurance Policy -(COD13). +(COD13).

@@ -1617,7 +1618,7 @@ certificates that state their Assured Name(s). Verification of organisations is delegated by the Assurance Policy to the Organisation Assurance Policy -(COD11). +(COD11). The reader is refered to the Organisation Assurance Policy, the following is representative and brief only.

@@ -1645,7 +1646,7 @@ stated in the OAP, briefly presented here:
  • the organisation has agreed to the terms of the CAcert Community Agreement - (COD9), + (COD9), and is therefore subject to Arbitration.
    • @@ -1682,7 +1683,7 @@ when adding the address, §4.1.2. Individuals. The authority to participate as a Member is established by the CAcert Community Agreement -(COD9). +(COD9). Assurances are requested by means of the signed CAP form.

    @@ -1731,7 +1732,7 @@ process or file a dispute.

    The general life-cycle for a new certificate for an Individual Member is: - +

    1. Member adds claim to an address (domain/email).
    2. @@ -1751,7 +1752,7 @@ The general life-cycle for a new certificate for an Individual Member is: Member accepts certificate.
    -

    +

    (Some steps are not applicable, such as anonymous certificates.) @@ -1774,6 +1775,7 @@ The Member can claim ownership or authorised control of a domain or email address on the online system. This is a necessary step towards issuing a certificate. There are these controls: +

    -

    +

    4.1.3. Preparing CSR

    Members generate their own key-pairs. The CAcert Community Agreement -(COD9) +(COD9) obliges the Member as responsible for security. See CCA2.5, §9.6.

    @@ -1894,7 +1896,7 @@ following checks:

    -Notes. +Notes.

    -

    +