Junio 2015 Version 1.0

Transcription

1 WEBSITE CERTIFICATE POLICY Juni 2015 IZENPE This dcument is the prperty f IZENPE and may nly be reprduced in its entirety.

2 INDEX 1 INTRODUCTION DESCRIPTION OF CERTIFIC 2 IDENTIFICATION... 3 COMMUNITY AND SCOPE 4 GENERAL PROVISIONS... ATES OF USE OPERATIONAL REQUIREMENTS LIST OF REQUIRED DOCUMENTATION PROCEDURE REQUEST ISSUE AND DELIVERY OF THE CERTIFICATE FEE VERIFICATION OF CERTIFICATE REVOCATION OF CERTIFICATES RENEWAL OF THE CERTIFICATE AUDITS AND INCIDENTS MANAGEMENT OF CHANGES CERTIFICATE PROFILES AND REVOKED CERTIFICATE LISTS DV SSL CERTIFICATE OV SSL CERTIFICATE SITE CERTIFICATE SITE EV CERTIFICATE EV SSL CERTIFICATE CHANGE CONTROL FROM VERSION 0 TO VERSION Additinal requirements Clarificatins Editrial changes Requirements eliminated / 19

3 1 Intrductin This dcument includes the Specific Dcumentatin fr certificates issued by Ziurtapen eta Zerbitzu Enpresa Empresa de Certificación y Servicis, Izenpe, S.A. (hencefrth Izenpe) frr different types f websites. The purpse f this dcument is t detail and cmpletee fr this typee f certificates the infrmatin prvided in a mre generic frm f in the Izenpe Certificatin Practice Statement, in the specific dcuments f the CA/Brwser Frum (Baseline Requirements and a EV guidelines fr issuing certificates fr websites) and in the ETSI specificatins ( Thus, Izenpe adheres t the fllwing certificatin plicies established by ETSI: DVCP (Dmain Validatin Certificates Plicy): in the DV SSL certificates.. OVCP (Organizatinal Validatin Certificates Plicy): in the OV SSL and Site certificates. EVCP (Extended Validatin Certificates Plicy): in the Site EV and EV SSL certificates. In the scpe f the Ggle Certificate Transparency prject, the EV E SSL and Site EV certificates issued will be published in the Izenpe CT Lg service and that f ther lg server prviders with whichh Izenpe has signed agreements in rder t cmply with Ggle requirements. 1.1 Descriptin f certificates Izenpe issues these certificatess t enable subscribers t ffer added security t their web services. As fr the type f certificate issued by Izenpe, SSL DV SSL OV SSL EV SSL ELECTRONICC SITE Site Site EV The purpse f this type f certificate c is t establish data cmmunicatins in web servers with SSL/TLS. They enable the exchange f encrypted cmmunicatinn between the user and website, facilitating the keys needed t encrypt the infrmatinn sent ver the Internet. SSL CERTIFICATES, Depending n the validatin the certificate can be, DOMAIN VALIDATED SSL (DVV SSL), This certificate, cnsideredd a nn qualified certificate, is used t verify the wnership f the dmain that hsts the website, prviding a reasnable guarantee t the Internet brwser user. These certificates remain valid fr 1, 2, r 3 years. ORGANIZATIONN VALIDATED SSL (OV SSL),, 3 / 19

4 This certificate, cnsidered nn qualified, is used t validate v the dmain wnership and the rganizatin, prviding the Internet brwser user with a reasnable guarantee that the website being accessed belngs t the rganizatin identified in the certificate. These certificates remain valid fr 1, 2, r 3 years. VALIDATION EXTENDED SSL (EV SSL), This certificate, cnsidered nn qualified, is used t validate thee dmain wnership and the rganizatin, prviding the Internett brwser user with a rbust guarantee that the website being accessed belngs t the rganizatin identified in the certificate. These certificates remain valid fr 2 years. ELECTRONIC SITE CERTIFICATES IZENPE, in accrdance with Act 11/ /2007, f 222 June, n Electrnic Access f Citizens t Public Services, issues the fllwing types f certificates: ELECTRONIC SITE, This is a certificate issued with the authenticatin identifying i the Public Administratin, gvernment agency r entityy that wns the ffice. Accrding t the assurance levels defined in the Identificatin and digital signature scheme, the Electrnic Site certificate issued by IZENPE hlds an intermediate level. These certificates remain valid fr 3 years ELECTRONIC SITE WITH EXTENDED VALIDATION EV (Site EV), In additin t the characteristics defined in the Electrnic Site certificate, extendedd validatin (EV) prvides a higher level f authenticatin fr Public Administratin, gvernment agency r administrative entity wing t a mre exhaustive validatin. Accrding t the assurance levels defined in the Identificatin and digital signature scheme, the Electrnic Site certificate issued by IZENPE hlds an intermediate level. l These certificates remain valid fr 2 years. 4 / 19

5 1.2 Identificatin In rder t identify certificates, IZENPE has assigned them the fllwing bject identifiers (OID). DV SSL OV SSL EV SSL CERTIFICATE OID Electrnic Site EV Electrnic Site Cmmunity and scpe f use The fllwing will be cnsidered users, Certificate applicant, persn applyingg fr the certificate in the name f an rganizatin.. Certificate subscriber, rganizatin identified in the certificate. Scpe f use. The certificates will be usedd in the scpe f the cmpetences ff the rganizatin/public Administratin, gvernment agency r entity hlding the certificate. 1.4 General prvisins Identificatin bligatins IZENPE, either directly r thrugh the User Entities with which itt has signed the crrespnding legall agreement, checks the identityy and any ther persnal infrmatin cncerning certificate applicants and subscribers. The legal instrument between the parties will include cmpliance with w the indicatins in the CA/Brwserr Frum dcuments. Certificate subscriber bligatins The subscriber's bligatins are specifiedd in the Certificatin Practice Statement in the sectin n Obligatins f the Subscriber. 5 / 19

6 2 Operatinal Requirements 2.1 List f required dcumentatin Issue applicatin dulyy cmpleted and signed with: Handwritten signature s Electrnic signature: with qualified certificate f Izenpe r natinal ID that identifies the applicant The applicant shall accept the applicable Terms f Use and Subscriberr Cntract n the date f signing the Applicatin published n Organizatin tax cde TIN. Authenticatin and Prcedure) validity ff the applicant entity (see sectinn 2.2 Applicatin Verificatin f the Applicant s authrity t use the namee f the entity (see sectin 2.2 Applicatin Prcedure) 2.2 Prceduree Request The APPLICANT shall submit the Issue Applicatin and required dcumentatin t, By pst t: IZENPE, S.A., C/ BEATO TOMAS DE ZUMARRAGA, 71 1ª PLANTA VITORIA GASTEIZ. By t: certservidr@izenpe.net. Or by cmpleting the t applicatin prvided fr this purpse n the Izenpe website. By signing the Issue Applicatin, the applicant agrees t the Terms f Use and the Subscriber Cntract. Validatin f dcumentatin, DV SSL OV SSL EV SSL Site Site EV The registrantt shuld cincide with the applicant rganizatin. If nt, the applicant must prvide prff f the subscriber's right t use the dmains. Verificatin that the t applicant is entitled t use the dmain r subdmain:.es dmains: dmains: dmains: whis.nic.eus Any ther dmain: : whis.icann. rg Verificatin by the CAA iff they are egistered and in all cases cmpliance with RFC 6844 guidelines. In the case f DV SSL, OV SSL and Site certificates wildcards will be allwed in subdmains r hst names, prvided the applicant entity can prve its legitimate cntrl f the cmplete dmain name. Otherwise the request will be rejected.. Fr example, *.c.uk r *.lcal cannt be issued, but b *.example.cm can be issued t the cmpany Example, Inc. 6 / 19

7 OV SSL EV SSL Site Site EV Verificatin ff the applicantt entity s identity and validity: Publicc entity: Name*: Official Gazette, certificate frm f secretaryry r Cmmercial Registry CIF*: AGPD, Official Gazette r Cmmercial Registry Private entity: Name*: riginal certificatin frm the crrespnding registry r simple ntice CIF*: AGPD, riginal certificatin frm the crrespnding registry r simple ntice Verificatin ff the Applicant s authrity t use the name f the entity: Publicc entity*: Certificatin issued by Secretary/Lawyer, simple ntice r reference in the Official Gazettee withing 13 mnths prir t t applicatinn fr issuance Private entity*: riginal certificatin frm thee crrespnding registry r simple ntice * Nt required fr valid recgnized crprate, entity r electrnic seal certificates issued t the applicant by Izenpe, prvided the certificate has been issued in the previus 39 mnths (13 mnths fr EVs) verificatin f the applicant's knwledge that the certificate is being prcessed. Verificatin ff pstal address at, Data Prtectin Agencies. Telephne peratr pages. Eudel, fr twns inn the Basque Cuntry. Cmmercial Registry In the event ff discrepancy between the dcumentatin prvided and the check run, Izenpe will verify that the address givenn n the Applicatin is stable lcatin ff the applicant rganizatin's peratins. Verificatin ff cuntry: Data Prtectin Agencies, Eudel, Telephne peratr pages r Cmmercial Registry Verificatin ff denial list in Izenpe internal databases. Verificatin ff high risk requests in Mcafee TrustedSurce EV SSL Site EV Check that the landline (ntt mbile) number is relevant t the applicant entity. Surces f verificatin: Telephne peratr pages, Dataa Prtectin Agencies A r Eudel fr municipalities in the Basque Cuntry. Subsequent verificatin by phne. Verify peratinal existence. Private entities must prve that perfrm bank transactins with a regulated financial institutin. Duble signature fr dcumentatin verificatin by, The Legal L Office and the Technical Department Validatin f the t verificatins made by the Chief Technical Officer. 7 / 19

8 NOTE. Izenpe may perfrm additinal verificatins such as: cnfirmatin f the request by the rganizatin r authrisatin fr the applicant t prcess the certificate in the name f the rganizatin and the annual revieww f its cmpliance by means f external audit. In cases where the validatin cannt be carried ut as determined, thiss will be justified in the dcumentatin verificatin dcument. Once the dcumentatin has been checked, Izenpe will reprt the verificatins it has made by way f a dcumentatin verificatin dcument. Only n EV certificatess is validatinn dual. It will nt be necessaryy t make thee abve verificatins if the infrmatinn has alreadyy been validated within the previus 13 mnths fr EVs and 39 mnths fr the rest. Izenpe DOES NOT issue t IP addresses (ex: ) 8 / 19

9 j PROCESO DE SOLICITUD Y EMISIÓN DE CERTIFICADOS SSLL EV Y SEDE EVV Slicitud Slicitante Frmulari Cmpletar de slicitud frmular ri slicitudd Telemática Enví a Izenpe presencial dcumentación Área Jurídica Respnsable de Seguridad Respnsable de Área TécnicaT Persnación en RA SI Necesari identificar? Acreditación slicitante Validación jurídica Cntact cn la entidad para la subsanación de errres NO NO Dcume ntación OK? SI Acreditación rganización Firma acta jjurídica Cmprbacines técnicas s Validación técnica Cntact cn entidad para subsanación de errres NO OK? SI Firma acta técnica Valida ción expediente cmplet Generación petición técnica Sslicitud petición técn ca Generación y entrega Cntact cn entidad para subsanación de errres Prueba certificad y enví de hja de entrega NO OK? Emisión Enví certificad y cntrat SI Archiv hja entrega 2.3 Issue and delivery ff the certificate Izenpe will ask the Technical Manager indicated n the Issue Applicatin t generate the technical request and submit it by e mail t Izenpe. If the Izenpe applicatin is used, the Technical Manager will enter the technical request. Izenpe will send the certificate t the Technical Manager by r via the applicatin. The applicant must sign and return t Izenpe the Delivery and Acceptance Sheet. 2.4 Fee Once the certificate is issued, the t applicablee fee is due. The applicable fees are psted every year n the Izenpe website at applicatin prvided fr this purpse. and n the 9 / 19

10 2.5 Verificatin f certificate The signatry willl have 15 wrking days frm the date f issuance t make sure the certificate wrks prperly; if peratinal defectss are detected, Izenpe must be ntified. Only if peratinal defects are due t technical reasns, r t errrs made by Izenpe in the data cntained in the certificate, will Izenpe revke the certificate and issue a new ne at its wnn expense. 2.6 Revcatin f Certificates Revcatin request The revcatin f a certificate can be requested by: The subscriber. The fllwing individuals are authrized t request the revcatin r f a certificate: The legall representative f the subscriber entity, the persnnel manager r a third party authrized r either f the tw. The applicant. Izenpe is authrized t request the revcatin f end entity subscriberr certificates fr technical reasns, as prvided in the CPS. Prcedure The persn requesting revcatin will prcess the Revcatin Applicatin thrughh Izenpe. The certificate can be revked at any time. The applicant can revke the certificate thrugh the fllwing channels: In persn: After scheduling an appintment with Izenpe at Or at the subscriber rganizatin with whm Izenpe has subscribed the relevant legall instrument. Over the phne, by calling The fllwing are required fr identificatin: Applicant ID Technical cntact ID Applicant Fully qualified dmain name (FQDN) 10 / 19

11 Online at - Or by pst, submitting a signed andd ntarized revcatin request. Causes fr revcatin Causes can be fund in the Certificatin Practice Statement availablee at In additin, in the case f certificates regulated in this specific dcumentatin Izenpe, 1. Will present the subscriber, third parties and Internet brwsers with clear instructins n hw t reprt cmplaints r suspicins s ff private key cmprmise, certificate misuse r ther kinds f fraud, cmprmise, misuse r imprper behaviur related t certificates. 2. Will investigate prblem reprts within the 24 hurs f their receipt and will decidee whether r nt t revke them, cnsidering at least the fllwing criteria: - The nature f the case at hand; - The number f prblem reprts received fr a certificate r web page. - The identity f thse making the cmplaint. - Current legislatin. 2.7 Renewal f the Certificate T renew a certificate the applicant must fllw the certificate issuance prcess established, taking int accunt that the verificatins are valid fr 13 mnths. 2.8 Audits and incidents Criteria referring t audits and analysis f incidents, Ways in which t present cmplaints r suggestins, - By phne: E mail: inf@ izenpe.cm - A cmplaint and suggestin frm is available atwww.izenpe.cmm - Cmpleting the cmplaintss r claims frms availablee at the registratin pints. 11 / 19

12 Internal registry f incidents. Security incidents are managed by the Izenpe Security Cmmittee. The annual auditing plan is perfrmed in accrdance with ETSI criteria. IZENPE reprts casess it cnsiders as incidents (cases ff fraud, phishing, etc.) n the Anti the t applicant r representative des nt appearr in the Izenpe internal security incident database.. In any case, Izenpe reserves the right t deny issuance f certificates in suspicius s situatins. PhisingWrkGrup website ( and makes sure prir t issuance that 12 / 19

13 3 Management f Changes The mdificatins made t thiss dcument will be apprved by the IZENPE Security Cmmittee. Thesee mdificatins will be included in a Specific Dcumentatin Update Dcument whse maintenance is guaranteed by Izenpe. The updated versins f the specific dcumentatin can be cnsulted at 13 / 19

14 4 Certificatee prfiles and revked certificate lists 4.1 DV SSL certificate 14 / 19

15 4.2 OV SSL certificate 15 / 19

16 4.3 Site certificate 16 / 19

17 4.4 Site EV certificate 17 / 19

18 4.5 EV SSL certificate 18 / 19

19 5 Change cntrl 5.1 Frm versin 0 t versin 1.0 Additinal requirements Requirements added in sectin 2.2 Updated requirements Requirements updated in sectins 2.1 and 2.2 Clarificatins Requirements updated in sectin 2.2 Editrial changes Index added Ftnted added Requirements eliminated Requirements eliminated in sectins 2.1 and 2.2 Year eliminated n cver 19 / 19