BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

5.2.1 X.509 Certificate Contents

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 5 PIV Key Management Requirements part of 5.2

Title

X.509 Certificate Contents

Control changed

Before · FIPS 201-2

The required contents of X.509 certificates associated with PIV private keys are based on [PROF]. The relationship is described below:

• Certificates containing the public key associated with an asymmetric Card Authentication private key shall conform to Worksheet 8: Card Authentication Certificate Profile in [PROF].

• Certificates containing the public key associated with a digital signature private key shall conform to Worksheet 5: End Entity Signature Certificate Profile in [PROF] and shall specify either the id-fpki- common-hardware or id-fpki-common-High policy of [COMMON] in the certificate policies extension.

• Certificates containing the public key associated with a PIV Authentication private key shall conform to Worksheet 9: PIV Authentication Certificate Profile in [PROF].

• Certificates containing the public key associated with a key management private key shall conform to Worksheet 6: Key Management Certificate Profile in [PROF]. 30

• Requirements for algorithms and key sizes for each type of PIV asymmetric key are given in [SP 800-78].

30 Note that key management certificates may assert the id-fpki-common-policy, id-fpki-common-hardware, or id-fpki-common- High policy of [COMMON] in the certificate policies extension. Applications / relying systems sensitive to the assurance level may choose not to accept certificates that only assert id-fpki-common-policy.

After · FIPS 201-3

The required contents of X.509 certificates associated with PIV private keys are based on [PROF]. The relationship is described below:

• Certificates containingthat contain the public key associated with an asymmetrica CardPIV Authenticationauthentication private key shallSHALL conform to Worksheet 8:the CardPIV Authentication Certificate Profile in [PROF] and SHALL specify the id-fpki-common-authentication policy of [COMMON] in the certificate policies extension (Section 4.

2.2.1).
• Certificates containingthat contain the public key associated with aan digitalasymmetric signaturecard authentication private key shallSHALL conform to Worksheet 5: Endthe EntityCard SignatureAuthentication Certificate Profile in [PROF] and shallSHALL specify either the id-fpki- common-hardware or id-fpki-common-Highid-fpki-common-cardAuth policy of [COMMON] in the certificate policies extension (Section 4.

2.2.2).
• Certificates containingthat contain the public key associated with a PIVdigital Authenticationsignature private key shallSHALL conform to Worksheetthe 9:End PIVEntity AuthenticationSignature Certificate Profile in [PROF] and SHALL specify the id-fpki-common-hardware policy of [COMMON] in the certificate policies extension (Section 4.

2.2.4), except as provided below.
• Certificates containing the public key associated with a key management private key shallSHALL conform to Worksheet 6:the Key Management Certificate Profile in [PROF] and SHALL specify the id-fpki-common-policy or id-fpki-common-hardware policy of [COMMON] in the certificate policies extension (Section 4.2.2.5), 30

except as provided below.
• Requirements for algorithms and key sizes for each type of PIV asymmetric key are given in [SP 800-78].

30
• NoteDepartments and agencies that keyoperate managementtheir certificatesown mayPKI assertthat is cross-certified with the id-fpki-common-policy,Federal id-fpki-common-hardware,Bridge CA or id-fpki-common-Federal HighCommon policyPolicy ofCA MAY specify and assert certificate policies that have been mapped to the respective aforementioned policies in [COMMON] in thelieu certificateof or in addition to those policies. extensionThis allowance is considered deprecated and will be removed in subsequent revisions of this Standard.

The Applicationsexpiration /date relyingof systemsthe sensitivePIV toauthentication and card authentication certificates SHALL NOT be after the assuranceexpiration leveldate mayof choosethe notPIV toCard. acceptThe expiration date of the PIV Card is printed on the card in Zone 14F (see Section 4.1.4) and is contained in the CHUID data object (see Section 4.2.1). If the card is revoked, the PIV authentication and card authentication certificates SHALL be revoked in cases where the card cannot be collected and destroyed. However, a PIV authentication or card authentication certificate MAY be revoked and subsequently replaced without revoking the PIV Card. The presence of a valid, unexpired, and unrevoked authentication certificate on a card is sufficient proof that onlythe assertcard id-fpki-common-policywas issued and is not revoked.