BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

5.5.1 Certificate and CRL Distribution

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 5 PIV Key Management Requirements part of 5.5

Title

Certificate and CRL Distribution

Control changed

Before · FIPS 201-2

This Standard requires distribution of CA certificates and CRLs using HTTP. Specific requirements are found in the Shared Service Provider Repository Service Requirements [SSP REP]. Certificates that contain the FASC-N or UUID in the subject alternative name extension, such as PIV Authentication certificates and Card Authentication certificates, shall not be distributed publicly (e.g., via the Lightweight Directory Access Protocol (LDAP) or HTTP accessible from the public Internet). Individual departments and agencies can decide whether other user certificates (digital signature and key management) can be distributed via LDAP. When user certificates are distributed, the requirements in Table IV—End-Entity Certificate Repository Service Requirements of [SSP REP] shall be satisfied.

After · FIPS 201-3

This Standard requires the distribution of CA certificates and CRLs using HTTP. Specific requirements are found in the Shared Service Provider Repository Service Requirements [SSP REPPROF].

Certificates that contain the FASC-N or card UUID in the subject alternative nameSAN extension, such as PIV Authenticationauthentication certificates and Cardcard Authenticationauthentication certificates, shallSHALL notNOT be distributed publicly (e.g., via the Lightweight Directory Access Protocol (LDAP) or HTTP accessible from the public Internetinternet). Individual departments and agencies can decide whether other user certificates (digital signature and key management) certificates can be distributed via LDAP. When user certificates arepublicly distributed,by the requirements in Table IV—End-Entity Certificate Repository Service Requirements of [SSP REP] shall be satisfiedCA.