# What Is Certificate Policy (CP)? Definition and Examples

> Certificate Policy (CP) is a named set of rules for issuing and using a class of certificates, referenced by OID in the certificatePolicies extension.

Source: https://ssl.sh/glossary/certificate-policy/
Last updated: 2026-11-10

The term has two related meanings. As a document, a certificate policy states the requirements a CA must meet for a type of certificate, usually organized according to the RFC 3647 framework; it is the "what", while the [CPS](https://ssl.sh/glossary/cps/) describes the "how". Inside a certificate, the Certificate Policies extension lists policy OIDs, optionally with a qualifier pointing to the CPS, telling relying parties which rules governed issuance.

## Why it matters
Policy OIDs are the reliable way to tell a certificate's validation level. The CA/Browser Forum reserves 2.23.140.1.2.1 for domain-validated, 2.23.140.1.2.2 for organization-validated, 2.23.140.1.2.3 for individual-validated and 2.23.140.1.1 for EV certificates, tied to the [Baseline Requirements](https://ssl.sh/glossary/baseline-requirements/) or the EV Guidelines. Browsers once used the EV OID to show the company name in the address bar; Chrome removed that in Chrome 77, but the OIDs still identify DV, OV and EV for tools, audits and buyers checking what they received.

## Example
```bash
openssl x509 -in cert.pem -noout -ext certificatePolicies
```

```text
X509v3 Certificate Policies:
    Policy: 2.23.140.1.2.1
```

This output identifies a [domain-validated](https://ssl.sh/glossary/dv-certificate/) certificate.

## Common misconceptions
- **The CP and the CPS are the same document.** The CP sets requirements; the CPS describes one CA's actual practices. Many CAs publish them combined, which adds to the confusion.
- **Policy OIDs change the encryption.** They only state which rules the CA followed; the cryptography is unaffected.

## Related terms

- [CPS](https://ssl.sh/zh/glossary/cps/): CPS 即电子认证业务规则，是 CA 公开发布的文件，说明它如何验证申请者、签发和吊销证书以及保护密钥。
- [DV 证书](https://ssl.sh/zh/glossary/dv-certificate/): DV 证书是 CA 只验证申请者对域名的控制权、不核实申请者身份的 TLS 证书，签发快且可以完全自动化。
- [OV 证书](https://ssl.sh/zh/glossary/ov-certificate/): OV 证书是 CA 在验证域名控制权之外，还核实了证书中所写组织真实合法存在的 TLS 证书。
- [EV 证书](https://ssl.sh/zh/glossary/ev-certificate/): EV 证书是按照 CA/浏览器论坛《EV 指南》完成最严格身份审核后签发的 TLS 证书。
- [Baseline Requirements](https://ssl.sh/zh/glossary/baseline-requirements/): Baseline Requirements 是 CA/B 论坛制定的基线要求，规定公开信任的 CA 在验证、签发和吊销 TLS 服务器证书时必须遵守的规则。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。