Update file EN-304-624.md

  - REQUIREMENT: The product shall disallow the keyUsage extension to simultaneously include values from:

    - digitalSignature, contentCommitment, keyCertSign, cRLSign; and

    - keyEncipherment, dataEncipherment, keyAgreement.

  - RATIONALE: The same public key may not be used for signature verification, and encryption or key agreement. Only valid certifcates as defined by the PKI service provider policies shall be generated by the product.

  - RATIONALE: The same public key cannot be used for signature verification, and encryption or key agreement. Only valid certifcates as defined by the PKI service provider policies shall be generated by the product.

  - APPLICABILITY: U2, UC3, UC4, UC5, applicable only if REQ-PKI-EMM-01a is used.

- REFERENCE: REQ-PKI-EMM-07

  - REQUIREMENT: The product shall verify that the prospective certificate subject possesses the private key corresponding to the public key contained in the certificate request by means of a cryptographic challenge (e.g., signature generation or decryption) before issuing a certificate, unless the public/private key pair was generated by the product and has never left the certificate issuance service.

  - RATIONALE: A subject bringing forth his own public key should prove ownership of the corresponding private key. The product may generate a key pair and associated public key, and later communicate the private key to the correct subject in a secure manner. This may notably be done for other components of the product itself needing public-key certificates. The same private key should not be owned by distinct subjects, including other services of the product; if the private key was generated by the product but already provided to the subject once, the subject can and should prove its ownership.

  - RATIONALE: A subject bringing forth his own public key should prove ownership of the corresponding private key. The product can generate a key pair and associated public key, and later communicate the private key to the correct subject in a secure manner. This can notably be done for other components of the product itself needing public-key certificates. The same private key should not be owned by distinct subjects, including other services of the product; if the private key was generated by the product but already provided to the subject once, the subject can and should prove its ownership.

  - APPLICABILITY: U2, UC3, UC4, UC5.

### 5.12.2 EMM - Certificate status

    - nextUpdate.

  - RATIONALE: The product shall provide accurate and integrity protected certificates statues using the standardised CRL format ensuring integrity of revocation list and conformity to the product service provider chosen policies.

  - APPLICABILITY: Where the product has a certificate status service, issuing CRLs.

  - NOTE: The issuerAltName may be absent from the profile if issued certificates do not use it.

  - NOTE: The issuerAltName can be absent from the profile if issued certificates do not use it.

- REFERENCE: REQ-PKI-EMM-11

  - REQUIREMENT: The product shall implement an OCSP response profile and shall ensure that issued OCSP responses are consistent with that profile.