@@ -1182,7 +1182,7 @@ To limit certificate forgery or misuse of certificate content, this section defi
- APPLICABILITY: U2, UC3, UC4, UC5.
- REFERENCE: REQ-PKI-EMM-07
- REQUIREMENT: The product shall verify that the prospective certificate subject possesses the private key that corresponds to the public key in the certificate request before issuing a certificate, unless the public/private key pair was generated by the product and never left the certificate issuance service.
- REQUIREMENT: The product shall verify that the prospective certificate subject possesses the private key corresponding to the public key contained in the certificate request by means of a cryptographic challenge (e.g., signature generation or decryption) before issuing a certificate, unless the public/private key pair was generated by the product and has never left the certificate issuance service.
- RATIONALE: A subject bringing forth his own public key should prove ownership of the corresponding private key. The product may generate a key pair and associated public key, and later communicate the private key to the correct subject in a secure manner. This may notably be done for other components of the product itself needing public-key certificates. The same private key should not be owned by distinct subjects, including other services of the product; if the private key was generated by the product but already provided to the subject once, the subject can and should prove its ownership.
