specific documentation for website certificates june … · depending on the validation the...

SPECIFIC DOCUMENTATION FOR WEBSITE CERTIFICATES

June 2015

Version 1.0

IZENPE

This document is the property of IZENPE and may only be reproduced in its entirety.

June 2015 of 19 Version 1.0

ÍNDICE

1 INTRODUCTION ............................................................................................................................. 3

1.1 DESCRIPTION OF CERTIFICATES ............................................................................................................ 3 1.2 IDENTIFICATION ............................................................................................................................... 5 1.3 COMMUNITY AND SCOPE OF USE ......................................................................................................... 5 1.4 GENERAL PROVISIONS ....................................................................................................................... 5

2 OPERATIONAL REQUIREMENTS ..................................................................................................... 6

2.1 LIST OF REQUIRED DOCUMENTATION .................................................................................................... 6 2.2 APPLICATION PROCEDURE .................................................................................................................. 6 2.3 ISSUE AND DELIVERY OF THE CERTIFICATE .............................................................................................. 9 2.4 FEE ............................................................................................................................................... 9 2.5 VERIFICATION OF CERTIFICATE .......................................................................................................... 10 2.6 REVOCATION OF CERTIFICATES .......................................................................................................... 10 2.7 RENEWAL OF THE CERTIFICATE .......................................................................................................... 11 2.8 AUDITS AND INCIDENTS ................................................................................................................... 11

3 MANAGEMENT OF CHANGES....................................................................................................... 13

4 CERTIFICATE PROFILES AND REVOKED CERTIFICATE LISTS ........................................................... 14

4.1 DV SSL CERTIFICATE ....................................................................................................................... 14 4.2 OV SSL CERTIFICATE ...................................................................................................................... 15 4.3 SITE CERTIFICATE ............................................................................................................................ 16 4.4 SITE EV CERTIFICATE ....................................................................................................................... 17 4.5 EV SSL CERTIFICATE ....................................................................................................................... 18

5 CHANGE CONTROL ...................................................................................................................... 19

5.1 FROM VERSION 0 TO VERSION 1.0 ..................................................................................................... 19 Additional requirements .................................................................................................................... 19 Clarifications ...................................................................................................................................... 19 Editorial changes ............................................................................................................................... 19 Requirements eliminated ................................................................................................................... 19

YEAR ELIMINATED ON COVER ......................................................................................................................... 19


1 Introduction

This document includes the Specific Documentation for certificates issued by Ziurtapen eta Zerbitzu Enpresa-Empresa de Certificación y Servicios, Izenpe, S.A. (henceforth Izenpe) for different types of websites.

The purpose of this document is to detail and complete for this type of certificates the information provided in a more generic form in the Izenpe Certification Practice Statement, in the specific documents of the CA/Browser Forum (Baseline Requirements and EV guidelines for issuing certificates for websites) and in the ETSI specifications (www.etsi.org).

Thus, Izenpe adheres to the following certification policies established by ETSI:

DVCP (Domain Validation Certificates Policy): in the “DV SSL” certificates.

OVCP (Organizational Validation Certificates Policy): in the “OV SSL” and “Site” certificates.

EVCP (Extended Validation Certificates Policy): in the “Site EV” and “EV SSL” certificates. In the scope of the Google Certificate Transparency project, the EV SSL and Site EV certificates issued will be published in the Izenpe CT Log service and that of other log server providers with which Izenpe has signed agreements in order to comply with Google requirements.

1.1 Description of certificates

Izenpe issues these certificates to enable subscribers to offer added security to their web services.

As for the type of certificate issued by Izenpe,

SSL

ELECTRONIC SITE

DV SSL Site

OV SSL Site EV

EV SSL

The purpose of this type of certificate is to establish data communications in web servers with SSL/TLS.

They enable the exchange of encrypted communication between the user and website, facilitating the keys needed to encrypt the information sent over the Internet.

SSL CERTIFICATES,

Depending on the validation the certificate can be,

DOMAIN VALIDATED SSL (DV SSL),

This certificate, considered a non-qualified certificate, is used to verify the ownership of the domain that hosts the website, providing a reasonable guarantee to the Internet browser user.

These certificates remain valid for 1, 2, or 3 years.

ORGANIZATION VALIDATED SSL (OV SSL),

http://www.etsi.org/


This certificate, considered non-qualified, is used to validate the domain ownership and the organization, providing the Internet browser user with a reasonable guarantee that the website being accessed belongs to the organization identified in the certificate.

These certificates remain valid for 1, 2, or 3 years.

VALIDATION EXTENDED SSL (EV SSL),

This certificate, considered non-qualified, is used to validate the domain ownership and the organization, providing the Internet browser user with a robust guarantee that the website being accessed belongs to the organization identified in the certificate.

These certificates remain valid for 1 or 2 years.

ELECTRONIC SITE CERTIFICATES

IZENPE, in accordance with Act 11/2007, of 22 June, on Electronic Access of Citizens to Public Services, issues the following types of certificates:

ELECTRONIC SITE,

This is a certificate issued with the authentication identifying the Public Administration, government agency or entity that owns the office.

According to the assurance levels defined in the Identification and digital signature scheme, the Electronic Site certificate issued by IZENPE holds an intermediate level.

These certificates remain valid for 1, 2, or 3 years

ELECTRONIC SITE WITH EXTENDED VALIDATION EV (Site EV),

In addition to the characteristics defined in the Electronic Site certificate, extended validation (EV) provides a higher level of authentication for Public Administration, government agency or administrative entity owing to a more exhaustive validation.

According to the assurance levels defined in the Identification and digital signature scheme, the Electronic Site certificate issued by IZENPE holds an intermediate level.

These certificates remain valid for 1 or 2 years.


1.2 Identification

In order to identify certificates, IZENPE has assigned them the following object identifiers (OID).

CERTIFICATE

OID

DV SSL 1.3.6.1.4.1.14777.1.2.4

OV SSL 1.3.6.1.4.1.14777.1.2.1

EV SSL 1.3.6.1.4.1.14777.6.1.1

Electronic Site 1.3.6.1.4.1.14777.1.1.3

EV Electronic Site 1.3.6.1.4.1.14777.6.1.2

1.3 Community and scope of use

The following will be considered users,

Certificate applicant, person applying for the certificate in the name of an organization.

Certificate subscriber, organization identified in the certificate.

Scope of use. The certificates will be used in the scope of the competences of the organization/Public Administration, government agency or entity holding the certificate.

1.4 General provisions

Identification obligations

IZENPE, either directly or through the User Entities with which it has signed the corresponding legal agreement, checks the identity and any other personal information concerning certificate applicants and subscribers.

The legal instrument between the parties will include compliance with the indications in the CA/Browser Forum documents.

Certificate subscriber obligations

The subscriber's obligations are specified in the Certification Practice Statement in the section on Obligations of the Subscriber.


2 Operational Requirements

2.1 List of required documentation

Issue application duly completed and signed with:

o Handwritten signature

o Electronic signature: with qualified certificate of Izenpe or national ID that identifies the applicant

The applicant shall accept the applicable Terms of Use and Subscriber Contract on the date of signing the Application published on www.izenpe.com.

Organization tax code TIN.

Authentication and validity of the applicant entity (see section 2.2 Application Procedure)

Verification of the Applicant’s authority to use the name of the entity (see section 2.2 Application Procedure)

2.2 Application procedure

The APPLICANT shall submit the Issue Application and required documentation to,

o By post to: IZENPE, S.A., C/ BEATO TOMAS DE ZUMARRAGA, 71 -1ª PLANTA – 01008

VITORIA-GASTEIZ.

o By email to: [email protected].

o Or by completing the application provided for this purpose on the Izenpe website.

By signing the Issue Application, the applicant agrees to the Terms of Use and the Subscriber

Contract.

Validation of documentation,

DV SSL

OV SSL

EV SSL

Site

Site EV

The registrant should coincide with the applicant organization. If not, the applicant must provide proof of the subscriber's right to use the domains. Verification that the applicant is entitled to use the domain or subdomain:

.es domains: www.nic.es

.eu domains: www.eurid.eu

.eus domains: whois.nic.eus

Any other domain: whois.icann.org

Verification by the CAA if they are registered and in all cases compliance with RFC 6844 guidelines.

In the case of DV SSL, OV SSL and Site certificates wildcards will be allowed in subdomains or

host names, provided the applicant entity can prove its legitimate control of the complete domain name. Otherwise the request will be rejected.

For example, *.co.uk or *.local cannot be issued, but *.example.com can be issued to the company Example, Inc.

http://www.izenpe.com/

http://www.nic.es/


OV SSL

EV SSL

Site

Site EV

Verification of the applicant entity’s identity and validity: o Public entity:

Name*: Official Gazette, certificate from secretary or o Commercial Registry CIF*: AGPD, Official Gazette or Commercial Registry

o Private entity: Name*: original certification from the corresponding registry or simple notice CIF*: AGPD, original certification from the corresponding registry or simple

notice

Verification of the Applicant’s authority to use the name of the entity: o Public entity*: Certification issued by Secretary/Lawyer, simple notice or reference in

the Official Gazette withing 13 months prior to application for issuance o Private entity*: original certification from the corresponding registry or simple notice

* Not required for valid recognized corporate or entity certificates issued to the applicant by Izenpe,

provided the certificate has been issued in the previous 39 months (13 months for EVs)

Email verification of the applicant's knowledge that the certificate is being processed.

Verification of postal address at, o Data Protection Agencies. o Telephone operator pages. o Eudel, for towns in the Basque Country. o Commercial Registry

In the event of discrepancy between the documentation provided and the check run, Izenpe will verify that the address given on the Application is a stable location of the applicant organization's operations.

Verification of country: o Data Protection Agencies, Eudel, Telephone operator pages or Commercial Registry

Verification of denial list in Izenpe internal databases.

Verification of high-risk requests in Mcafee TrustedSource

EV SSL

Site EV

Check that the landline (not mobile) number is relevant to the applicant entity.

Sources of verification:

Telephone operator pages, Data Protection Agencies or Eudel for municipalities in the Basque Country.

Subsequent verification by phone.

Double signature for documentation verification by,

The Legal Office

and the Technical Department

Validation of the verifications made by the Chief Technical Officer.

NOTE.


Izenpe may perform additional verifications such as: confirmation of the request by the

organization or authorisation for the applicant to process the certificate in the name of the

organization and the annual review of its compliance by means of external audit.

In cases where the validation cannot be carried out as determined, this will be justified in

the documentation verification document.

Once the documentation has been checked, Izenpe will report the verifications it has made

by way of a documentation verification document.

Only on EV certificates is validation dual.

It will not be necessary to make the above verifications if the information has already been

validated within the previous 13 months for EVs and 39 months for the rest.

Izenpe DOES NOT issue to IP addresses (ex: 1.2.3.4)

PROCESO DE SOLICITUD Y EMISIÓN DE

CERTIFICADOS SSL DV, SSL OV Y SEDE

So

licitu

dV

alid

acio

ne

sG

en

era

ció

n

y e

ntr

eg

a

IZENPE Solicitante

Telemática

o presencial

NO

SI

Solicitud

petición técnica

Envío a Izenpe

documentación

Contacto con entidad para

subsanación de errores

Envío

certificado

Prueba certificado y envío de

hoja de entrega

¿OK?

Emisión

Completar

formulario

solicitud

Formulario de

solicitud

Contacto por email

Generación

petición técnica

Validaciones


PROCESO DE SOLICITUD Y EMISIÓN DE

CERTIFICADOS SSL EV Y SEDE EV

So

licitu

dV

alid

ació

n

jurí

dic

a

Va

lida

ció

n

técn

ica

Ge

ne

ració

n

y e

ntr

eg

a

Responsable de

Área TécnicaÁrea JurídicaSolicitante

Responsable de

Seguridad

Telemática

o presencial

Formulario

de solicitud

Completar

formulario

solicitud

Envío a Izenpe

documentación

¿Necesari

o

identificar

?

Acreditación

solicitante

¿Docume

ntación

OK?

NO

Acreditación

organizaciónContacto con la

entidad para la

subsanación de

errores

Personación en RA

NO

SI

Comprobaciones

técnicas

SI

¿OK?Contacto con entidad

para subsanación de

erroresNO

Firma acta

jurídica

Firma acta

técnica

SI

Validación

expediente

completo

Sslicitud

petición

técnica

Generación

petición

técnica

¿OK?Contacto con entidad

para subsanación de

erroresNO

Emisión

SI

Envío

certificado y

contrato

Prueba certificado y

envío de hoja de

entrega

Archivo hoja

entrega

2.3 Issue and delivery of the certificate

Izenpe will ask the Technical Manager indicated on the Issue Application to generate the technical request and submit it by e-mail to Izenpe.

If the Izenpe application is used, the Technical Manager will enter the technical request.

Izenpe will send the certificate to the Technical Manager by email or via the application.

The applicant must sign and return to Izenpe the Delivery and Acceptance Sheet.

2.4 Fee

Once the certificate is issued, the applicable fee is due.

The applicable fees are posted every year on the Izenpe website at www.izenpe.com and on the application provided for this purpose.



2.5 Verification of certificate

The signatory will have 15 working days from the date of issuance to make sure the certificate works properly; if operational defects are detected, Izenpe must be notified.

Only if operational defects are due to technical reasons, or to errors made by Izenpe in the data contained in the certificate, will Izenpe revoke the certificate and issue a new one at its own expense.

2.6 Revocation of Certificates

Revocation request

The revocation of a certificate can be requested by:

- The subscriber. The following individuals are authorized to request the revocation of a certificate: The legal representative of the subscriber entity, the personnel manager or a third party authorized or either of the two.

- The applicant. - Izenpe is authorized to request the revocation of end-entity subscriber certificates for technical

reasons, as provided in the CPS.

Procedure

The person requesting revocation will process the Revocation Application through Izenpe. The certificate can be revoked at any time. The applicant can revoke the certificate through the following channels:

- In person: o After scheduling an appointment with Izenpe at www.izenpe.com o Or at the subscriber organization with whom Izenpe has subscribed the relevant legal

instrument. - Over the phone, by calling 902 542 542.

The following are required for identification: o Applicant ID o Technical contact ID o Applicant email o Fully qualified domain name (FQDN)



- Online at www.izenpe.com

- Or by post, submitting a signed and notarized revocation request.

Causes for revocation

Causes can be found in the Certification Practice Statement available at www.izenpe.com

In addition, in the case of certificates regulated in this specific documentation Izenpe,

1. Will present the subscriber, third parties and Internet browsers with clear instructions on how to report complaints or suspicions of private key compromise, certificate misuse or other kinds of fraud, compromise, misuse or improper behaviour related to certificates.

2. Will investigate problem reports within the 24 hours of their receipt and will decide whether or not to revoke them, considering at least the following criteria:

- The nature of the case at hand; - The number of problem reports received for a certificate or web page. - The identity of those making the complaint. - Current legislation.

2.7 Renewal of the Certificate

To renew a certificate the applicant must follow the certificate issuance process established, taking into account that the verifications are valid for 13 months.

2.8 Audits and incidents

Criteria referring to audits and analysis of incidents,

Ways in which to present complaints or suggestions,

- By phone: 902 542 542 - E-mail: [email protected] - A complaint and suggestion form is available atwww.izenpe.com - Completing the complaints or claims forms available at the registration points.



mailto:[email protected]



Internal registry of incidents.

Security incidents are managed by the Izenpe Security Committee.

The annual auditing plan is performed in accordance with ETSI criteria.

IZENPE reports cases it considers as incidents (cases of fraud, phishing, etc.) on the Anti-PhisingWorkGroup website (www.apwg.org and makes sure prior to issuance that the applicant or representative does not appear in the Izenpe internal security incident database. In any case, Izenpe reserves the right to deny issuance of certificates in suspicious situations.

http://www.apwg.org/


3 Management of Changes

The modifications made to this document will be approved by the IZENPE Security Committee.

These modifications will be included in a Specific Documentation Update Document whose maintenance is guaranteed by Izenpe.

The updated versions of the specific documentation can be consulted at www.izenpe.com.



4 Certificate profiles and revoked certificate lists

4.1 DV SSL certificate


4.2 OV SSL certificate


4.3 Site certificate


4.4 Site EV certificate


4.5 EV SSL certificate


5 Change control

5.1 From version 0 to version 1.0

Additional requirements

Requirements added in section 2.2

Updated requirements

Requirements updated in sections 2.1 and 2.2

Clarifications

Requirements updated in section 2.2

Editorial changes

Index added

Footnoted added

Requirements eliminated

Requirements eliminated in sections 2.1 and 2.2

Year eliminated on cover

specific documentation for website certificates june … · depending on the validation the...

Documents