Certification Practice Statement (CPS)

A CPS is the operational counterpart of a certificate policy: where the CP states requirements, the CPS explains the specific procedures one CA follows to meet them. Publicly trusted CAs publish their CP and CPS, often combined into one document, in the structure of RFC 3647. It covers domain and organization validation methods, physical and personnel security, key generation and storage, certificate profiles, revocation handling and audits.

Why it matters

The CPS is what auditors check a CA against and what root programs read when deciding whether to trust it. The Baseline Requirements require CAs to keep their CP and CPS current and to update them at least annually. A CA that issues certificates in a way its CPS does not allow has committed misissuance, even if the certificate is otherwise harmless, and is expected to file a public incident report. For subscribers, the CPS answers practical questions such as which validation methods the CA accepts and how quickly it acts on a revocation request.

Example

X509v3 Certificate Policies:
    Policy: 2.23.140.1.2.1
    Policy: 1.3.6.1.4.1.32473.1
      CPS: http://ca.example.com/cps

The CPS qualifier points relying parties to the document; ca.example.com stands in for a real CA repository.

Common misconceptions

• Only lawyers need the CPS. It is a technical document; it tells you, for example, which domain validation methods a CA uses and how it handles revocation.
• The CPS is the subscriber agreement. The subscriber agreement is the contract you accept; the CPS describes the CA's own practices.