Certificate Practice Statement
1. Purpose
This CPS defines the practices followed by The Gnou Community for issuing, managing, and revoking digital certificates within internal systems. It ensures trust and security for internal communications and authentication.
2. Scope
- Applies to all internal PKI operations.
- Covers certificates issued for users, servers, and internal applications.
- Not intended for external/public use.
3. Roles and Responsibilities
- PKI Administrator: Manages certificate lifecycle.
- System Owners: Ensure proper use of certificates.
- End Users: Protect private keys and report compromises.
4. Certificate Types
- User Certificates: For authentication and email signing.
- Server Certificates: For internal HTTPS/TLS.
- Application Certificates: For secure service-to-service communication.
5. Issuance Policy
- Certificates issued only after identity verification via internal directory.
- Key length: Minimum 2048-bit RSA or equivalent.
- Validity period: 2 years.
6. Revocation Policy
- Immediate revocation upon key compromise or system decommissioning.
- CRL available internally and externally.
7. Security Requirements
- Private keys must be stored securely (e.g., encrypted, hardware token if applicable).
- No sharing of private keys.
8. Audit and Compliance
- Regular audits of certificate usage.
- Logs retained for 1 month.
9. Contact
For questions or incidents: contact@the-gnou-community.net