BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

5.5 PKI Repository and Online Certificate Status Protocol (OCSP) (was: PKI Repository and OCSP Responder(s))

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 5 PIV Key Management Requirements part of 5

Title changed

Before · FIPS 201-2

PKI Repository and OCSP Responder(s)

After · FIPS 201-3

PKI Repository and OCSPOnline ResponderCertificate Status Protocol (sOCSP)

Control changed

Before · FIPS 201-2

CAs that issue certificates to support PIV Card authentication shall operate repositories and Online Certificate Status Protocol (OCSP) responders that provide certificate status information for the certificates they issue to support high-assurance interagency PIV Card interoperation. Departments and agencies will be responsible for notifying CAs when certificates need to be revoked. CAs shall maintain the status of servers and responders needed for PIV Card and certificate status checking.

The expiration date of the authentication certificates (PIV Authentication certificate and Card Authentication certificate) shall not be after the expiration date of the PIV Card. If the card is revoked, the authentication certificates shall be revoked in cases where the card cannot be collected and destroyed. However, an authentication certificate (and its associated key pair) may be revoked without revoking the PIV Card and may then be replaced. The presence of a valid, unexpired, and unrevoked authentication certificate on a card is proof that the card was issued and is not revoked.

Because an X.509 certificate typically is valid several years, a mechanism to distribute certificate status information is necessary. CRL and OCSP are the two commonly used mechanisms. CAs that issue PIV Authentication, Card Authentication, digital signature, or key management certificates shall maintain a Hypertext Transfer Protocol (HTTP) accessible web server that holds the CRLs for the certificates it issues, as well as any CA certificates issued to or by it, as specified in [PROF]. In addition, every CA that issues PIV Authentication or Card Authentication certificates shall operate an OCSP server that provides certificate status for every authentication certificate the CA issues.

PIV Authentication, Card Authentication, digital signature, and key management certificates shall contain the crlDistributionPoints extension needed to locate CRLs. PIV Authentication certificates and Card Authentication certificates shall also contain the authorityInfoAccess extension needed to locate the authoritative OCSP responder.

After · FIPS 201-3

Responders

CAs that issue certificates to support PIV Card authentication shall operate repositories and Online Certificate Status Protocol (OCSP) responders that provide certificate status information for the certificates they issue to support high-assurance interagency PIV Card interoperation. Departments and agencies will be responsible for notifying CAs when certificates needcorresponding to be revoked. CAs shall maintain the status of servers and responders needed for PIV Card and certificate status checking.

The expiration date of the authenticationprivate certificateskeys (PIV Authentication certificate and Card Authentication certificate) shall not be after the expiration date of the PIV Cardi. If the card is revoked, the authentication certificates shall be revoked in cases where the card cannot be collected and destroyede. However, an authentication certificate (and its associated key pair) may be revoked without revoking the PIV Card and may then be replaced. The presence of a valid, unexpired, and unrevoked authentication certificate on a card is proof that the card was issued and is not revoked.

Because an X.509 certificate typically is valid several years, a mechanism to distribute certificate status information is necessary. CRL and OCSP are the two commonly used mechanisms. CAs that issue PIV Authentication, Cardcard Authenticationauthentication, digital signature, or key management certificates) shallSHALL

• maintain a Hypertext Transfer Protocol (HTTP) accessible web serverservice that holdspublishes the CRLs for the PIV certificates that it issues, as wellspecified asin [PROF];
• maintain an HTTP-accessible service that publishes any CA certificates issued to or by it, as specified in [PROF]. In; addition,and
• everyoperate CAOnline thatCertificate issuesStatus PIVProtocol Authentication(OCSP, orspecified Cardin Authentication[RFC certificates6960]) shallservices operatefor anthe OCSPPIV servercertificates that provides certificate status for everyit authenticationissues, certificateas thespecified CAin issues[PROF].

PIV Authenticationauthentication, Cardcard Authenticationauthentication, digital signature, and key management certificates shallSHALL

• contain the crlDistributionPoints extension needed to locate CRLs. PIV Authentication certificates, and Card Authentication certificates shall also
• contain the authorityInfoAccess extension needed to locate the authoritative OCSP responder.

Departments and agencies SHALL notify CAs when certificates need to be revoked.