9.2.2 Certificate Inventories

Before · SP 800-57 Part 1 Rev. 4

After · SP 800-57 Part 1 Rev. 5

Certificate Inventories

Before · SP 800-57 Part 1 Rev. 4

After · SP 800-57 Part 1 Rev. 5

Over the years, the use of public-key certificates has grown; certificates are used by communication servers (e.g., TLS and SSH), for providing web applications and services (e.g., government services, online banking, flight operations, mission-critical services within an organization), by devices (e.g., routers), and by the client applications (e.g., browsers) used by the humans who use those communications and services. The certificates are used to establish identity, provide public keys for verification of the signatures on documents and the integrity of communicated information, and to establish keys to protect communications.

105 See Section 2 for a discussion about owners and sponsors. In many cases, certificates have been created and installed without recording the details associated with them (e.g., who or what device or process is associated with a certificate, what device or process has the private key, the location of the device or process, the certificate’s validity period, etc.). As a result, significant outages occur when 1) the certificate expires and needs to be replaced before business operations can continue, or 2) the private key is compromised, and the certificate needs to be revoked and replaced before secure operations can be assured. In order to facilitate recovery operations and avoid outages in the case of expired certificates, a certificate shall be inventoried upon creation. A certificate inventory includes the latest certificates for each entity and information about each certificate, including the identity of the certificate owner and contact information for the owner. The private keys associated with the public keys in the certificates shall not be included in the inventory unless the inventory is also used for key backup or archiving, and the backup or archiving of the private key is permitted (see Sections 8.2.2.1 an 8.3.1 ). Certificate inventories should be maintained in a central repository or network of mutually trusted repositories and operated in accordance with a certificate policy. See SP 800-57, Part 2 for additional information. A certificate inventory application shall be used to enter a certificate into the inventory, monitor certificate validity periods for proactive certificate replacement, detect the use of algorithms and key lengths that are no longer secure, respond to cryptographic incidents (e.g., CA compromise), and modify who should be contacted for certificate maintenance.