DO1GL: HAM-PKI policy work in progress

DO1GL — Sat, 27 Dec 2014 18:27:35 GMT

HAM-PKI policy work in progress

Neue Seite

= ChaosWelle PKI Certification And Revocation Policy =

This document is a WIP draft policy listing the conditions required to issue HAM-PKI certificates by Chaoswelle CA, as well as the conditions for revocation of such certificates.

== Certificate Issuance ==

The Chaoswelle CA will issue HAM-PKI Certificates ('''Certs''') to '''Applicants''' that have been successfully '''Authorized'''.

=== Certs ===

A HAM-PKI '''Cert''' created by Chaoswelle CA must contain the following information in its distinguished name (DN):

* Full Name (<code>CN</code>)
* E-Mail (<code>OID.1.2.840.113549.1.9.1</code>)
* Callsign (<code>OID.1.3.6.1.4.1.12348.1.1</code>)

TODO: Are additional fields needed / allowed?

An audit record is created for every issued '''Cert''' containing the following data:

* Full Name
* Postal Address
* E-Mail
* Callsign
* HAM-PKI user who approved the request
* Date and Time of approval
* Certificate

=== Applicants ===

'''Certs''' are issued to the following entities:

* Natural persons (the Callsign must be assigned to that person and the assignment must be valid)
* TODO: Training callsigns
* TODO: Club stations (have a separate field in the DN for club vs. natural person assignee?)
* TODO: Other Kinds Of Applicants?

=== Authorization ===

==== Natural Person ====

A natural person needs to provide the following documents to be entitled for a '''Cert''':

* Callsign assignment document scan(must show the person's full name and be valid)
* A recent utility bill scan (not older than 31 days, must show the person's full name and address)

== Certificate Revocation ==

Chaoswelle CA will be operating a [http://en.wikipedia.org/wiki/Revocation_list CRL] and indicate that CRL in the issued '''Certs'''. To put a given '''Cert''' on the CRL, proof is needed that the '''Cert''' was issued to an incorrect '''Applicant''', i.e. the Callsign, Full Name or E-Mail Address values of the '''Cert''' do not belong to the person using the '''Cert'''.

This proof must be presented by the actual owner of the Callsign or E-Mail Address, or by a third party that can believably show that the '''Cert''' was issued wrongly.

'''Certs''' will only be revoked if they were issued to the wrong person, or used by a different person. Technical abuse of Internet services by the official owner of a '''Cert''' does not qualify for revocation. Instead, technical measures must be taken at the abused system.

HAM-PKI/Policy - Versionsgeschichte

DO1GL: HAM-PKI policy work in progress