Import: Public key size

Yes

RSA 1024, 2048 and 4096 bit public keys must be supported. Any other sizes are optional.

Import of RSA public key less than 1024 or greater than 4096 bits to be rejected with an informative error.

Import of certificates with 1024 will be imported after a warning ‘The certificate public key may not be of sufficient strength. Do you wish to continue?’

Import: Certificate signature algorithm

Yes

SHA-1, SHA-256 SHA-384, and SHA-512 hashing algorithms must be supported. Any other SHA2 algorithms are optional.

Import of certificates with SHA-1 will be imported after a warning ‘The certificate signature algorithm may not be of sufficient strength. Do you wish to continue?’

Import of certificates with other algorithms (for example MD5, ECC) to be rejected with an informative error.

Import: Must have private key

Yes

Must be supplied.

Reject and informative error that private key has not been supplied

Import: Certificate checks

Yes

Minimum checks for:

• Version (v3)

• Start + end (present)

• Subject Name (present)

• Issuer Name (present)

• Data integrity (e.g. hash)

Reject + informative error if a check fails

Import: Certificate up to 4KB

Yes

Certificates can be varying sizes

Import: Formats

Yes

• PKCS#12 format. ‘.p12’ and ‘.pfx’ file extension. With or without password. This shall be the preferred/default option

• PEM format. ‘.cer’ ‘.pem’ and ‘.crt’ file extension.

• Pasted from clipboard in PEM format (optional)

NOTE that ONLY PKCS#12 file format is acceptable according to 147434–030–P1, however we cannot control what format customers receive their certificates in, hence all should be supported

See section below for certificate file import support

Import: Up to 4 other certificates in same file

Yes

Only supported where management of TCS also available.

• Any intermediate and root CA certificate included in the PKCS#12 file to be imported into the Trusted Certificate store

• The feature is intended for import of intermediate certificates, but can include unrelated certificates.

• An informative message to the admin if any have been imported

Import: Certificate chain support

Yes

Where identity certificate is signed by one or more intermediate CAs, search TCS for matching certificates and include in identity certificate chain.

View: Certificate Contents

Yes

Minimum viewable attributes (From CEC016: 147434–030–P1):

• Serial Number

• Subject Name

• Issuer Name

• Validity Period (that includes notBefore and notAfter dates)

• Thumbprint (Hash of the certificate)

• Subject Alternative Names

• Key Usage Extensions

• Extended Key Usage

Warnings/errors as per 147434–080–P1:

• Error displayed that certificate has expired

• Warning displayed that certificate is nearing expiry (within 60 days).

View: Private Key

No

Private key must not be viewable

Export: Formats

Yes

Private key must not be exportable

Export formats:

• DER format. ‘.cer’ ‘.der’ and ‘.crt’ file extension.

• PEM format. ‘.cer’ ‘.pem’ and ‘.crt’ file extension.

• PKCS#12 (optional)