Certificate Policy

The party that the CAWG governing authority empowers to operate its conformance program on its behalf. It recognizes and accredits key conformance roles which agree to participate in the program. The CAWG Trust Task Force of the Creator Assertions Working Group operates in this capacity.

A corporation, partnership, joint venture or other entity controlling, controlled by, or under common control with another entity, or an agency, department, political subdivision, or any entity operating under the direct control of a government entity.

The natural person or legal entity that applies for (or seeks renewal of) a certificate. Once the certificate is issued, the applicant is referred to as the subscriber. For certificates issued to devices, the applicant is the entity that controls or operates the device named in the certificate, even if the device is sending the actual certificate request.

A natural person or human sponsor who is either the applicant, employed by the applicant, or an authorized agent who has express authority to represent the applicant:

A supplier of email client software or other relying-party application software such as mail user agents (web-based or application based) and email service providers that process S/MIME certificates.

Refer to the C2PA glossary definition for “assertion.”

Refer to the C2PA glossary definition for “asset.”

Also known as “doing business as”, “DBA”, or “d/b/a” name in the US and “trading as” name in the UK.

An indication to a relying party of the level of confidence that it may have that identity assertions and claims signed with a given CAWG claim signing certificate reflect the actual claimant. A higher assurance level allows the relying party to have a greater level of confidence.

The assurance level is conveyed through the CAWG-al (TBD) X.509 v3 certificate extension in a CAWG claim signing certificate. The value of this extension is an encoded OID value that corresponds to a numeric value no higher than the maximum assurance level for a given claim signing issuer. The OID values corresponding to each assurance level are defined in the CAWG oid.txt MIB definition file.

The assurance level in the CAWG claim signing certificate that is issued to an organization or individual may be lower than the maximum assurance level that the issuer is potentially eligible for.

A letter attesting that subject information is correct written by an accountant, lawyer, government official, or other reliable third party customarily relied upon for such information.

In a period-of-time audit, the period between the first day (start) and the last day of operations (end) covered by the auditors in their engagement. (This is not the same as the period of time when the auditors are on-site at the CA.) The coverage rules and maximum length of audit periods are defined in Section 11.1, “Compliance audits”.

A report from a qualified auditor stating the qualified auditor’s opinion on whether an entity’s processes and controls comply with the mandatory provisions of these requirements.

A key pair where the public key appears as the subject public key info in one or more root CA certificate(s) and/or subordinate CA certificate(s).

A document that sets the requirements that MUST be met by certification authorities (CAs) in the process of issuing digital certificates to subscribers that intend to sign CAWG digital assertions, and the requirements that MUST be met by the subscribers in their use of the certificates.

Refer to the C2PA glossary definition for “claim.”

An X.509 certificate issued by one of the certification authorities on the CAWG trust list to an instance of the Conforming Implementer’s conforming generator product, and names the generator product as the subject of the certificate.

A CAWG identity certificate binds a person or organization, not a software product. The same applies to the CA, Subscriber and Signer definitions. Suggest renaming to CAWG Identity Certificate and defining the subject as the verified person or organization.

A risk-based governance program intended to hold applicants who want to demonstrate their conformance to its requirements and then differentiate themselves through CAWG recognition by satisfying program requirements being acknowledged as achieving that level of conformance. It consists of a set of processes, policies, and requirements governing the designation of applicant certification authorities as adhering to the CAWG certificate policy, as defined by the CAWG Trust Task Force.

Processes include:

A collection of governance documents which defines the CAWG trust ecosystem including roles, requirements and processes used by the CAWG governing authority to achieve greater assurance over the provenance and authenticity of digital asset content.

Refer to the C2PA glossary definition for “Content Credential.”

A globally recognized standard for providing digital asset content provenance and authenticity. It is designed to enable global, opt-in, adoption of digital provenance techniques through the creation of a rich ecosystem of digital provenance enabled applications for a wide range of individuals and organizations while meeting appropriate security requirements.

Refer to the C2PA glossary definition for “C2PA manifest.”

In the context of the CAWG conformance program, a CAWG-managed list of X.509 certificate trust anchors (either root or subordinate certification authorities) that issue certificates to individualas and organizationss under the CAWG certificate policy.

A CAWG-managed list of X.509 certificate trust anchors (either root or subordinate certification authorities) that issue time-stamp signing certificates to time-stamping authorities (TSA).

A second CAWG TSA list, the TSA requirements (including the On-Device TSA) and the TSA profiles all duplicate C2PA. Suggest deleting them and pointing to the C2PA TSA Trust List.

An electronic document that uses a digital signature to bind a public key and an identity.

A trusted entity that issues, signs, and revokes digital certificates that bind public keys to subscriber identities. CAs are also known as PKI certificate Authorities because they issue certificates based on public key infrastructure (PKI). These certificates contain credentials that confirm the possession of a private key by an entity, among other verified attributes. Individualas and organizations sign C2PA manifests using digital signing credentials issued by CAs.

An entity on the CAWG trust list that is trusted by the CAWG conformance program to issue X.509 CAWG claim signing certificates to instances of conforming generator products.

An organization that operates a certification authority may also operate a time-stamping authority.

From RFC 9495: “The certification authority authorization (CAA) DNS resource record (RR) provides a mechanism for domains to express the allowed set of certification authorities that are authorized to issue certificates for the domain.

Certificate requests and data related thereto (whether obtained from the applicant or otherwise) in the CA’s possession or control or to which the CA has access.

Processes, practices, and procedures associated with the use of keys, software, and hardware, by which the CA verifies certificate data, issues certificates, maintains a repository, and revokes certificates.

A set of rules that indicates the applicability of a named certificate to a particular community and/or PKI implementation with common security requirements.

One of several documents forming the governance framework in which certificates are created, issued, managed, and used.

Complaint of suspected key compromise, certificate misuse, or other types of fraud, compromise, misuse, or inappropriate conduct related to certificates.

A set of documents or files that defines requirements for certificate content and certificate extensions in accordance with Section 10, “Certificate, CRL, and OCSP profiles” e.g., a section in a CA’s CPS or a certificate template file used by CA software.

A regularly updated time-stamped list of revoked certificates that is created and digitally signed by the CA that issued the certificates.

This CP defines certificate profiles differentiated by the type of subject, (for example organization, sponsored, individual).

A set of normative requirements that the CAWG expects a governed party to demonstrate its conformance as part of the CAWG conformance program. This criteria consists of requirements in the CAWG certificate policy.

Possession, directly or indirectly, of the power to: (1) direct the management, personnel, finances, or plans of such entity; (2) control the election of a majority of the directors; or (3) vote that portion of voting shares required for “control” under the law of the entity’s jurisdiction of incorporation or registration but in no case less than 10%.

The process of converting text from one writing system to ASCII characters.

Either a member of the United Nations OR a geographic region recognized as a sovereign state by at least two UN member nations.

A certificate that is used to establish a trust relationship between two root CAs.

A pseudo-random number generator intended for use in a cryptographic system.

A natural person or legal entity that is not the CA but is authorized by the CA, and whose activities are not within the scope of the appropriate CA audits, to assist in the certificate management process by performing or fulfilling one or more of the CA requirements found herein.

A government-issued identity document that is issued in a machine-processable form, that is digitally signed by the issuer, and that is in purely digital form.

From RFC 8499: “An ordered list of zero or more octets that makes up a portion of a domain name. Using graph theory, a label identifies one node in a portion of the graph of all possible domain names.”

An ordered list of one or more domain labels assigned to a node in the domain name system.

A credential containing individual identification data and/or attributes and which is used for authentication for an online service.

An employee or agent of an organization unaffiliated with the CA who authorizes issuance of certificates to that organization.

The EUID uniquely identifies officially-registered organizations, legal entities, and branch offices within the European Union or the European Economic Area. The EUID is specified in chapter 9 of the Annex contained in the Implementing Regulation (EU) 2021/1042 which describes rules for the application of Directive (EU) 2017/1132 “relating to certain aspects of company law (codification).”

The “Not After” date in a certificate that defines the end of a certificate’s validity period.

A domain name that includes the domain labels of all superior nodes in the Internet domain name system.

An organization which desires to play a recognized role in the CAWG conformance program. It applies to the CAWG conformance program which requires them to sign a legal agreement and have their application reviewed prior to entering them on the CAWG trust list. Governed parties of the C2PA ecosystem are certification authorities that elect to apply and and abide by the CAWG conformance program requirements.

The organization responsible for the trust of the ecosystem. It empowers an administering authority to manage the ecosystem and certifying entities to convey trust. The CAWG is the governing party of its conformance program driven by its Steering Committee.

A government-operated legal entity, agency, department, ministry, branch, or similar element of the government of a country, or political subdivision within such country (such as a state, province, city, county, etc.).

A natural person.

Refers to a certificate subject that includes only individual (natural person) attributes, rather than attributes linked to an organization.

In relation to a particular certificate, the CA that issued the certificate. This could be either a root CA or a subordinate CA.

The country and (where applicable) the state or province or locality where the organization’s legal existence was established by a filing with (or an act of) an appropriate government agency or entity (e.g., where it was incorporated). In the context of a government entity, the country and (where applicable) the state or province where the entity’s legal existence was created by law.

A private key is said to be compromised if its value has been disclosed to an unauthorized person, or an unauthorized person has had access to it.

A documented plan of procedures for the generation of a CA key pair.

A private key and its associated public key.

An association, corporation, partnership, proprietorship, trust, government entity or other entity with legal standing in a country’s legal system.

A process in which the content of digitally signed data such as a precertificate (RFC 9162 §3.2), certificate, CRL, or OCSP response, or data-to-be-signed object such as a tbsCertificate (RFC 5280 §4.1.1.1) is checked for conformance with the profiles and requirements defined in these requirements.

A numeric designation, using generally accepted market schemes based on degree of validation performed on an individual or organization.

A driver license that is issued in digital format by an issuing authority that is authorized by the relevant government or jurisdiction to issue driving licenses in accordance with applicable law, and conforms to ISO/IEC 18013-5 and ISO/IEC 18013-7.

An individual; a human being as distinguished from a legal entity.

A unique alphanumeric or numeric identifier registered under the International Organization for Standardization’s applicable standard for a specific object or object class.

An online server operated under the authority of the CA and connected to its repository for processing certificate status requests. See also, online certificate status protocol.

An online certificate-checking protocol that enables relying-party application software to determine the status of an identified certificate. See also OCSP responder.

In the distinguished name field of a certificate.

Refers to a certificate subject that includes only Organizational (legal entity) attributes, rather than attributes linked to an individual.

In the distinguished name field of a certificate.

A company that controls a subsidiary company.

Personal name is a name of an individual subject typically presented as subject:givenName and/or subject:surname. However, the personal name may be in a format preferred by the subject, the CA, or enterprise RA as long as it remains a meaningful representation of the subject’s verified name.

A government-issued identity document issued in physical and human-readable form (such as a passport or national identity card).

The key of a key pair that is kept secret by the holder of the key pair, and that is used to create digital signatures and/or to decrypt electronic records or files that were encrypted with the corresponding public key.

A fictitious identity that a person assumes for a particular purpose. Unlike an anonymous identity, a pseudonym can be linked to the person’s real identity.

The key of a key pair that can be publicly disclosed by the holder of the corresponding private key and that is used by a relying party to verify digital signatures created with the holder’s corresponding private key and/or to encrypt messages so that they can be decrypted only with the holder’s corresponding private key.

A set of hardware, software, people, procedures, rules, policies, and obligations used to facilitate the trustworthy creation, issuance, management, and use of certificates and keys based on public key cryptography.

A certificate that is trusted by virtue of the fact that its corresponding root CA certificate is distributed as a trust anchor in widely-available application software.

A natural person or legal entity that meets the requirements of [review-of-delegated-parties].

A value specified by a CA to the applicant that exhibits at least 112 bits of entropy.

A domain name that has been registered with a domain name registrar.

An entity authorized by the certification authority to collect, verify, and submit information provided by applicants and/or subscribers which is to be entered into public key certificates. The term RA refers to hardware, software, and individuals that collectively perform this function, including tasks such as validating platform attestations and presence of potential subscriber implementations on the C2PA Conforming Products List. The RA operates under the CA’s authority and adheres to the guidelines set forth in the C2PA certificate policy.

The CA MAY delegate the performance of all, or any part, of Section 6.2, “Initial identity validation” requirements to a delegated third party, provided that the process as a whole fulfills all of the requirements of Section 6.2, “Initial identity validation”.

Before the CA authorizes a delegated third party to perform a delegated function, the CA MUST contractually require the delegated third party to:

Enterprise registration authorities

The CA MAY delegate to an enterprise registration authority (RA) to verify certificate requests for subjects within the enterprise RA’s own organization. The CA MUST NOT accept certificate requests authorized by an enterprise RA unless the following requirements are satisfied:

The CA MUST impose these limitations as a contractual requirement on the enterprise RA and monitor compliance by the enterprise RA in accordance with [review-of-delegated-parties].

A method of communication, such as a postal/courier delivery address, telephone number, or email address, that was verified using a source other than the applicant’s representative.

An entity that evaluates the trustworthiness of assertions made by a signer in a C2PA asset, based on the signer’s identity and the assurance level encoded into the C2PA claim Signing certificate.

An online database containing publicly-disclosed PKI governance documents (such as certificate policies and certification practice statements) and certificate status information, either in the form of a CRL or an OCSP response.

Refer to the NIST glossary definition for “rich execution environment.”

The top level certification authority whose root CA certificate is distributed by application software suppliers and that issues subordinate CA certificates.

The self-signed certificate issued by the root CA to identify itself and to facilitate verification of certificates issued to its subordinate CAs.

Refer to the NIST glossary definition for “root of trust.”

Refer to the NIST glossary definition for “security incident.”

In the CAWG Trust Model, the assertions enumerated in the created_assertions object of the CAWG Claim are attributed to the signer.

In the context of the CAWG conformance program, an indiviual or organization identified as the subject of a CAWG Signing certificate is always the signer.

Refers to a certificate subject which combines individual (natural person) attributes in conjunction with an subject:organizationName (an associated legal entity) attribute. Registration for sponsor-validated certificates MAY be performed by an enterprise RA where the subject:organizationName is either that of the delegated enterprise, or an affiliate of the delegated enterprise, or that the delegated enterprise is an agent of the named subject organization.

An applicant that has become a customer of one of the certification authorities on the CAWG trust list, and is eligible to receive CAWG claim signing certificates for use by instances of their conforming generator product.

The natural person, device, system, unit, or legal entity identified in a certificate as the subject. The subject is either the subscriber or a mailbox under the control and operation of the subscriber.

Information that identifies the certificate subject. Subject identity information does not include a mailbox address listed in the subject:commonName or subject:emailAddress fields, or in the subjectAltName extension.

A certification authority whose certificate is signed by the root CA, or another subordinate CA.

A natural person or legal entity to whom a certificate is issued and who is legally bound by a subscriber agreement or terms of use.

An agreement between the CA and the applicant/subscriber that specifies the rights and responsibilities of the parties.

A company that is controlled by a parent company.

Used in addition to authoritative evidence to strengthen the reliability of the identity verification and/or as evidence for attributes that are not evidenced by the authoritative evidence.

A subordinate CA certificate which uses a combination of extended key usage settings and name constraint settings to limit the scope within which the subordinate CA certificate MAY issue certificates to subscriber or additional subordinate CAs.

Provisions regarding the safekeeping and acceptable uses of a certificate issued in accordance with these requirements when the applicant/subscriber is an affiliate of the CA or is the CA.

A server that provides electronic certification and trust services by creating a hash of a document or digital information. The hash verifies the date and time of the document’s creation or last modification, and acts as an independent witness to prove that the document has not changed since it was signed. This is similar to how a notary acts for online documents. TSAs that are part of applicant certification authorities that want to be recognized as issuing digital signing credentials approved by the CAWG, must satisfy the requirements of the program to be considered approved and designated as such within its governance records.