DataTerminology.comNEW
Also known as: CP
A named set of rules indicating the applicability and assurance requirements for certificates issued within a PKI.
DESCRIPTION
A Certificate Policy (CP) defines the circumstances, assurance levels, and usage constraints under which certificates are issued and relied upon. It is typically identified by an OID and referenced in the certificate policies X.509 extension. CPs guide RAs/CAs, relying parties, and auditors about identity proofing, key management, and validation practices. They are complemented by a CPS that describes the issuing CA’s detailed procedures. Policy mapping enables interoperability across PKIs.
ALTERNATIVE DEFINITIONS
IETF (RFC 3647)
A named set of rules that indicates the applicability of a certificate to a particular community and/or class of application with common security requirements.
Canonical definition used across PKI specifications.
NIST Computer Security Resource Center
A named set of rules that indicates the applicability of a certificate to a particular community and/or class of application with common security requirements.
Adopts the RFC 3647 wording as a U.S. government reference.
RELATED TERMS
Public Key Infrastructure Certificate Authority X.509 Certificate Policies Extension Policy OID Relying Party Mozilla Root Store Policy CAB Forum Baseline Requirements Policy Mapping
COMPETING TERMS
Certification Practice Statement
RELATIONS
- Broader: Policy
KNOWLEDGE AREAS
Data Security Data Governance Data Privacy & Compliance
TARGET AUDIENCE
Security Architect Chief Information Security Officer Cybersecurity Engineer Data Governance Manager IT Auditor
EXTERNAL SOURCES
- Wikipedia - Public key infrastructure
- IETF - PKI CP/CPS framework
- IETF - X.509 certificate policies extension
- Mozilla - Root program policy expectations
TOP QUESTIONS
What is a Certificate Policy in PKI?
It is a named set of rules describing when and how certificates may be used and the assurance level they provide to relying parties.
Category: Overview
How does a Certificate Policy differ from a CPS?
A CP states what assurances and requirements apply; a CPS details how a specific CA implements procedures to meet the CP.
Category: Misunderstanding
Where is a Certificate Policy referenced in a certificate?
In the X.509 Certificate Policies extension, typically via OIDs that point to documented policies and optional CPS URIs.
Category: Technical
Why are Certificate Policies important for relying parties?
They communicate identity proofing and operational practices, allowing relying parties to judge whether the certificate suits their risk tolerance.
Category: Relevancy
What is policy mapping in PKI?
Policy mapping associates one PKI’s policy OID with another’s to enable cross-domain trust and interoperability.
Category: Concepts
Who authorizes and maintains a Certificate Policy?
Typically the CA or a governance body defines and maintains it, subject to audits and program requirements (e.g., browser root programs).
Category: Governance
How granular can Certificate Policies be?
They may define multiple assurance levels or application classes, each with specific identity verification and key management requirements.
Category: Design
What happens if a certificate’s policy is unacceptable to a relying party?
The party can reject the certificate or require different assurance levels, enforcing their policy via trust store settings or validation rules.
Category: Risk
What standards define Certificate Policies?
IETF RFC 3647 provides the CP/CPS framework; RFC 5280 specifies the certificate extension for policy OIDs.
Category: Standards