Minor asset updates

| Certificate request                  | Subject certificate signing request |

| Subscriber management function       | Used to register subscribers and change subscriber details |

| Cerificate request approval function | Used to approve or reject subject certificate requests |

| Registration service user interface | E.g., remotely accessible web portal |

| Registration user interface | E.g., remotely accessible web portal |

| Certificate request API | E.g., remotely accessible logical interface |

<strong>Table 4.2.</strong> Registration assets

</div>

If the PKI product does provide support for subscriber management as part of its registration services, then the subscriber data and subscriber management function will not be present. 

If the PKI product does provide support for subscriber management as part of its registration services, then the subscriber data and subscriber management function assets will not be present. 

#### 4.2.6.3 Certificate generation service

| Subject private key data        | Subject private decryption keys, if key recovery is supported |

| Key management function         | Used to manage CA and subject private keys |

| Certificate generation function | Used to sign certificates and CRLs |

| Certificate generation service <br> user interface | E.g., remotely accessible web portal or locally accessible command <br> line interface |

| Certificate generation user interface | E.g., remotely accessible web portal or locally accessible command <br> line interface |

|Secure cryprographic device API | Logical interface for the secure cryptographic device |

<strong>Table 4.3.</strong> Certificate generation assets

| Certificate store data                         | Issued subject certificates and related information | 

| Certificate store management function          | Used to manage certificates in the certificate store |

| Certificate store look-up function             | Used to handle requests for certificates from relying parties |

| Dissemination service user interface           | E.g., remotely accessible web portal |

| Subscriber dissemination service interface     | E.g., email client interface |

| Relying party dissemination service interface  | E.g., remotely accessible logical interface | 

| Dissemination user interface           | E.g., remotely accessible web portal |

| Subscriber dissemination interface     | E.g., email client interface |

| Relying party dissemination interface  | E.g., remotely accessible logical interface | 

<strong>Table 4.4.</strong> Dissemination assets

</div>

<strong>Table 4.5.</strong> Revocation management assets

</div>

The PKI product can support limited revocation management services even if it does not support a certificate status service. In such cases, the revocation management function and user interface can be considered part of the corresponding certificate generation assets.

The PKI product can support limited revocation management services even if it does not support a certificate status service. In such cases, the revocation management function and user interface assets can be considered part of the corresponding certificate generation function and user interface assets.

#### 4.2.6.6 Certificate status service

Table 4.5 provides a list of assets for a PKI product that supports revocation management services.

Table 4.5 provides a list of assets for a PKI product that supports certificate status services.

<div align="center">

</div>

### 4.2.7 Threats

<div align="center">