Previous

NEXT

certificate

A digitally signed representation of information that 1) identifies the authority issuing it, 2) identifies the subscriber, 3) identifies its valid operational period (date issued / expiration date). In the information assurance (IA) community, certificate usually implies public key certificate and can have the following types:
A digital representation of information which at least (1) identifies the certification authority (CA) issuing it, (2) names or identifies its subscriber, (3) contains the subscriber’s public key, (4) identifies its operational period, and (5) is digitally signed by the certification authority issuing it.
Source: NIST SP 800-32; CNSSI No. 1300
See cross certificate, encryption certificate, and identity certificate.

certificate authority workstation
(CAW)

The computer system or systems that process certification authority (CA) software and/or have access to the CA private keys, end entity keys, or end entity public keys prior to certification.
Source: NIST CP-1

certificate management

Process whereby certificates (as defined above) are generated, stored, protected, transferred, loaded, used, and destroyed.

certificate policy (CP)

1. A specialized form of administrative policy tuned to electronic transactions performed during certificate management. A certificate policy addresses all aspects associated with the generation, production, distribution, accounting, compromise recovery, and administration of digital certificates. Indirectly, a certificate policy can also govern the transactions conducted using a communications system protected by a certificate-based security system. By controlling critical certificate extensions, such policies and associated enforcement technology can support provision of the security services required by particular applications.
Source: NIST SP 800-32
2. A named set of rules that indicates the applicability of a certificate to a particular community and/or class of application with common security requirements. For example, a particular CP might indicate applicability of a type of certificate to the authentication of parties engaging in business-to-business transactions for the trading of goods or services within a given price range.
Source: CNSSI No. 1300

certificate revocation list (CRL)

1. A list of revoked public key certificates created and digitally signed by a Certificate Authority.
Source: NIST SP 800-63-2; FIPS PUB 201-1
2. These are digitally signed “blacklists” of revoked certificates. Certification authorities (CAs) periodically issue certificate revocation lists (CRLs), and users can retrieve them on demand via repositories.

certificate status authority (CSA)

A trusted entity that provides on-line verification to a relying party of a subject certificate's trustworthiness, and may also provide additional attribute information for the subject certificate.
Source: NIST SP 800-32

certificate status server (CSS)

An authority that provides status information about certificates on behalf of the CA through online transactions (e.g., an online certificate status protocol (OCSP) responder).
Source: CNSSI No. 1300

certificate-related information

Information, such as subscriber’s postal address, that is not included in a certificate. May be used by a certification authority (CA) managing certificates.
Source: NIST SP 800-32

certification

Comprehensive evaluation of an information system component that establishes the extent to which a particular design and implementation meets a set of specified security requirements.

certification analyst (C.F.D.)

The independent technical liaison for all stakeholders involved in the certification and accreditation (C&A) process responsible for objectively and independently evaluating a system as part of the risk management process. Based on the security requirements documented in the security plan, performs a technical and non-technical review of potential vulnerabilities in the system and determines if the security controls (management, operational, and technical) are correctly implemented and effective.

certification authority (CA)

An entity authorized to create, sign, issue, and revoke public key certificates.
Source: CNSSI No. 1300 (adapted)

certification authority workstation (CAW) (C.F.D.)

Commercial-off-the-shelf (COTS) workstation with a trusted operating system and special purpose application software that is used to issue certificates.
Rationale: Term has been replaced by the term “certificate authority workstation (CAW)”.

certification package (C.F.D.)

Product of the certification effort documenting the detailed results of the certification activities.
Rationale: The Risk Management Framework uses a new term to refer to this concept, and it is called security assessment report (SAR).

certification practice statement (CPS)

A statement of the practices that a certification authority (CA) employs in issuing, suspending, revoking, and renewing certificates and providing access to them, in accordance with specific requirements (i.e., requirements specified in this Certificate Policy, or requirements specified in a contract for services).
Source: NIST SP 800-32

certification test and evaluation
(CT&E)

Software and hardware security tests conducted during development of an information system component.