Certificate Policy (CP)

The term has two related meanings. As a document, a certificate policy states the requirements a CA must meet for a type of certificate, usually organized according to the RFC 3647 framework; it is the "what", while the CPS describes the "how". Inside a certificate, the Certificate Policies extension lists policy OIDs, optionally with a qualifier pointing to the CPS, telling relying parties which rules governed issuance.

Why it matters

Policy OIDs are the reliable way to tell a certificate's validation level. The CA/Browser Forum reserves 2.23.140.1.2.1 for domain-validated, 2.23.140.1.2.2 for organization-validated, 2.23.140.1.2.3 for individual-validated and 2.23.140.1.1 for EV certificates, tied to the Baseline Requirements or the EV Guidelines. Browsers once used the EV OID to show the company name in the address bar; Chrome removed that in Chrome 77, but the OIDs still identify DV, OV and EV for tools, audits and buyers checking what they received.

Example

openssl x509 -in cert.pem -noout -ext certificatePolicies

X509v3 Certificate Policies:
    Policy: 2.23.140.1.2.1

This output identifies a domain-validated certificate.

Common misconceptions

• The CP and the CPS are the same document. The CP sets requirements; the CPS describes one CA's actual practices. Many CAs publish them combined, which adds to the confusion.
• Policy OIDs change the encryption. They only state which rules the CA followed; the cryptography is unaffected.