Update file EN-304-624.md

- REFERENCE: ACC-PKI-EMM-07

  - OBJECTIVE:

    - Verify the product ensures a prospective certificate subject possesses the private key that corresponds to the public key in the certificate request before issuing a certificate, unless the private key never left the certificate issuance service.

  - PREPARATION: Document the circumstances in which the certificate generation service may issue a public-key certificate. Ability to request a certificate issuance.

  - PREPARATION:

    - Document the circumstances in which the certificate generation service may issue a public-key certificate.

    - Ability to request a certificate issuance.

  - ACTIVITIES: For each way the product may issue a public-key certificate:

    - attempt to issue a certificate with digital signature capabilities for a given public-key;

    - Attempt to issue a certificate with digital signature capabilities for a given public-key;

      - if the product does not generate the key pair itself, or it has left the issuance service:

        - provide an invalid signature when required;

          - verify the issuance to fail;

    - attempt to issue a certificate with encryption or key agreement capabilities for a given public-key;

        - provide an valid signature when required;

          - verify the issuance to succed.

    - Attempt to issue a certificate with encryption or key agreement capabilities for a given public-key;

      - if the product does not generate the key pair itself, or it has left the issuance service:

        - provide an invalid decryption when required;

          - verify the issuance to fail.

    Among all the issuance attempts involving signing or decryption, verify the random value to sign or decrypt is always distinct, and their concatenation of high entropy.

  - VERDICT: SUCCESS if all the verifications pass; else FAIL.

        - provide an valid decryption when required;

          - verify the issuance to succed.

    - Among all the issuance attempts involving signing or decryption, verify the random value to sign or decrypt is always distinct, and their concatenation of high entropy.

  - VERDICT: 

    - SUCCESS: The product verifies proof of possession of the private key before issuing a certificate whenever the private key is external to the issuance service, rejects invalid signing or decryption proofs, and uses distinct, high-entropy challenge values.

    - FAIL: A certificate can be issued without valid proof of possession of the corresponding private key, invalid proofs are accepted, or the challenge values used for proof of possession are not distinct or sufficiently random.

  - EVIDENCE:

    - The documentation of public-key certificate issuance circumstances;

    - The way issuances were requested, and the responses from the product;