@@ -1225,14 +1225,14 @@ To limit certificate forgery or misuse of certificate content, this section defi
- APPLICABILITY: Where the product has a certificate status service, issuing OCSP responses of the basic response type: UC1 and UC2.
- NOTE: An OCSP responder is required to be capable to emit OCSP responses of the basic type by RFC 6960 [\[i.3\]](#_ref_i.3).
### 5.12.4 EMM - Certificate re-key
### 5.12.3 EMM - Certificate re-key
- REFERENCE: REQ-PKI-EMM-14
- REQUIREMENT: In case of certificate re-key, any modified certified names or attributes shall be validated and updated registration information shall be recorded.
- RATIONALE: The product should never issue a certificate without having validated all its certified names and attributes at some point in time. The product should possess accurate registration information regarding certificates it re-keys.
- APPLICABILITY: All use cases where the product has a certificate generation service, issuing public-key certificates and supporting certificate re-key.
### 5.12.5 EMM - Certificate modification
### 5.12.4 EMM - Certificate modification
- REFERENCE: REQ-PKI-EMM-16
@@ -2686,6 +2686,51 @@ As stated in clause 5.10, since minimizing the impact on other systems relies on
- FAIL: The product allows issuance of OCSP responses without configured acceptable values for `responderID`.
- EVIDENCE: The way OCSP responses were requested, and the responses and OCSP responses from the product.
### 6.12.3 EMM - Certificate re-key
- REFERENCE: ACC-PKI-EMM-014
- OBJECTIVE:
- Verify that during certificate re-key operations, any modified certified names or attributes are validated and that updated registration information is properly recorded.
- PREPARATION:
- Certificate generation service supporting certificate re-key is available.
- Ability to request certificate re-key operations.
- Administrator or authorized user access to registration information and configuration.
- Verify that all modified values are validated before issuance.
- Verify that updated registration information is recorded and associated with the re-keyed certificate.
- VERDICT:
- SUCCESS: All modified certified names and attributes are validated prior to issuance, and updated registration information is correctly recorded for all certificate re-key operations.
- FAIL: Any re-keyed certificate is issued without validating modified certified names or attributes, or updated registration information is not recorded.
- EVIDENCE:
- Re-key request inputs and configuration.
- Issued re-keyed certificates.
- Validation logs or system responses.
- Registration database or records showing updated information.
### 6.12.4 EMM - Certificate modification
- REFERENCE: ACC-PKI-EMM-015
- OBJECTIVE:
- Verify that during certificate modification operations, any modified certified names or attributes are validated and updated registration information is recorded.
- PREPARATION:
- Certificate generation service supporting certificate modification is available.
- Ability to request certificate modification operations.
- Authorized user access to registration information and audit/configuration data.
- ACTIVITIES:
- Perform certificate modification requests with changes to certified names and/or attributes.
- Verify that all modified values are validated before issuance.
- Verify that updated registration information is recorded and correctly linked to the modified certificate.
- VERDICT:
- SUCCESS: All modified certified names and attributes are validated before issuance, and updated registration information is correctly recorded for all certificate modification operations.
- FAIL: Any modified certificate is issued without validation of updated certified names or attributes, or updated registration information is not recorded.
- EVIDENCE:
- Certificate modification request inputs.
- Issued modified certificates.
- Validation results and system logs.
- Registration records reflecting updated certificate information.
