@@ -1643,6 +1643,102 @@ The assessment criteria for each security requirements are described in a struct
d) the random values generated by the product.
### 6.12.2 Certificate status
- REFERENCE: ACC_PKI_EMM_009
- OBJECTIVE: Verify the certificate revocation statuses to be either or both of CRLs as defined by and subject to the requirements of ITU-T X.509 [\[3\]](#_ref_3), or OCSP responses as defined by and subject to the requirements of RFC 6960 [\[i.3\]](#_ref_i.3).
- PREPARATION: Document the circumstances in which the certificate generation service may issue a public-key certificate. Ability to request a certificate issuance. Ability to configure revocation aspects of the certificate profile if supported.
- ACTIVITIES:
a) Attempt to configure the certificate profile to not offer any revocation source in issued certificates;
a.1) if successful, request a certificate for each way the product may issue a public-key certificate, and verify the issuances to fail.
b) For each way the product may successfully issue a public-key certificate:
b.1) request a certificate;
b.2) verify the issued certificate to contain information allowing a verifier to obtain a CRL or OCSP response.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE:
a) The configuration attempts, or other evidence such configuration is not supported;
b) the way issuances were requested, and the responses from the product.
- REFERENCE: ACC_PKI_EMM_010
- OBJECTIVE: Verify the product implements and enforces a CRL profile for issued CRLs.
- PREPARATION: Ability to request a CRL as certificate status for a given certificate. Document the CRL profile implemented by the product.
- ACTIVITIES:
a) Request a CRL;
b) verify the CRL to match the constraints of the CRL profile.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE: The way the CRL was requested, and the response and CRL from the product.
- REFERENCE: ACC_PKI_EMM_011
- OBJECTIVE: Verify that the product requires the Administrator to specify the set of acceptable values for the fields and extensions identified in REQ-5.4-03.
- PREPARATION: Administrator access to not-installed or reinitialised product, or specifically its certificate status service and related configuration.
- ACTIVITIES: Verify that no CRL may be issued until acceptables values for the issuer, issuerAltName and nextUpdate fields and extensions are set.
- VERDICT: SUCCESS if the verifications passes; else FAIL.
- EVIDENCE: The way CRLs were requested, and the responses from the product.
- REFERENCE: ACC_PKI_EMM_012
- OBJECTIVE: Verify the product implements and enforces an OCSP response profile for issued OCSP responses.
- PREPARATION: Ability to request an OCSP response as certificate status for a given certificate. Document the OCSP response profile implemented by the product.
- ACTIVITIES:
a) Request an OCSP response;
b) verify the OCSP response to match the constraints of the OCSP response profile.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE: The way the OCSP response was requested, and the response and OCSP response from the product.
- REFERENCE: ACC_PKI_EMM_013
- OBJECTIVE: Verify that the product requires the Administrator to specify the set of acceptable values for the responseType field.
- PREPARATION: Administrator access to not-installed or reinitialised product, or specifically its certificate status service and related configuration.
- ACTIVITIES: Verify that no OCSP response may be issued until acceptable values for the responseType field are set.
- VERDICT: SUCCESS if all the verification pass; else FAIL.
- EVIDENCE: The way OCSP responses were requested, and the responses and OCSP responses from the product.
- REFERENCE: ACC_PKI_EMM_014
- OBJECTIVE: Verify that the product requires the Administrator to specify the set of acceptable values for the responderID field.
- PREPARATION: Administrator access to not-installed or reinitialised product, or specifically its certificate status service and related configuration.
- ACTIVITIES: Verify that no OCSP response may be issued until acceptable values for the responderID field are set.
- VERDICT: SUCCESS if all the verification pass; else FAIL.
- EVIDENCE: The way OCSP responses were requested, and the responses and OCSP responses from the product.
