# What Is Certification Practice Statement (CPS)?

> Certification Practice Statement (CPS) is a CA's public description of how it validates applicants, issues and revokes certificates, and protects its keys.

Source: https://ssl.sh/glossary/cps/
Last updated: 2026-11-10

A CPS is the operational counterpart of a [certificate policy](https://ssl.sh/glossary/certificate-policy/): where the CP states requirements, the CPS explains the specific procedures one CA follows to meet them. Publicly trusted CAs publish their CP and CPS, often combined into one document, in the structure of RFC 3647. It covers domain and organization validation methods, physical and personnel security, key generation and storage, certificate profiles, revocation handling and audits.

## Why it matters
The CPS is what auditors check a CA against and what root programs read when deciding whether to trust it. The [Baseline Requirements](https://ssl.sh/glossary/baseline-requirements/) require CAs to keep their CP and CPS current and to update them at least annually. A CA that issues certificates in a way its CPS does not allow has committed [misissuance](https://ssl.sh/glossary/misissuance/), even if the certificate is otherwise harmless, and is expected to file a public incident report. For subscribers, the CPS answers practical questions such as which validation methods the CA accepts and how quickly it acts on a revocation request.

## Example
```text
X509v3 Certificate Policies:
    Policy: 2.23.140.1.2.1
    Policy: 1.3.6.1.4.1.32473.1
      CPS: http://ca.example.com/cps
```

The CPS qualifier points relying parties to the document; `ca.example.com` stands in for a real CA repository.

## Common misconceptions
- **Only lawyers need the CPS.** It is a technical document; it tells you, for example, which domain validation methods a CA uses and how it handles revocation.
- **The CPS is the subscriber agreement.** The subscriber agreement is the contract you accept; the CPS describes the CA's own practices.

## Related terms

- [证书策略](https://ssl.sh/zh/glossary/certificate-policy/): 证书策略（CP）是针对某类证书签发和使用制定的一套命名规则，在证书的证书策略扩展中以 OID 形式引用。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [Baseline Requirements](https://ssl.sh/zh/glossary/baseline-requirements/): Baseline Requirements 是 CA/B 论坛制定的基线要求，规定公开信任的 CA 在验证、签发和吊销 TLS 服务器证书时必须遵守的规则。
- [WebTrust 审计](https://ssl.sh/zh/glossary/webtrust/): WebTrust 审计是由持证审计师依据 CA/B 论坛和根证书计划要求检查 CA 内部控制的审计框架，全称 WebTrust for CAs。
- [错误签发](https://ssl.sh/zh/glossary/misissuance/): 错误签发是指 CA 违反 Baseline Requirements 或根证书计划政策签发证书，从验证缺陷到字段格式错误都算在内。
- [根证书计划](https://ssl.sh/zh/glossary/root-program/): 根证书计划是浏览器或操作系统厂商用来决定其信任库收录、限制或移除哪些根 CA 的政策与流程。