A Certification Practice Statement (CPS) is a document from a certificate authority or a member of a web of trust which describes their practice for issuing and managing public key certificates.[1]
Some elements of a CPS include documenting practices of:
By detailing the practice of issuance, revocation and renewal, a CPS aids entities in judging the relative reliability of a given certificate authority.[2]
Main article: Certificate authority |
In a certificate authority, the CPS should derive from the organization's certificate policy and may be referenced in issued certificates.[3]
Main article: Web of trust |
Because individuals act as certifiers in a web of trust, individual CPS documents are sometimes used. For example, in a PGP WoT, the CPS might state that the certifying entity checked two forms of legal government ID before signing the person's public key.
Main article: Digital signature |
When verifying digital signatures, it's necessary to review the CPS so as to determine the meaning of the issuance of the certificate by the certifying entity.[4]