Import: RSA 1024-4096 key size

Yes

RSA 1024, 2048 and 4096 bit public keys must be supported. Any other sizes are optional.

Import of RSA public key less than 1024 or greater than 4096 bits to be rejected with an informative error.

Import: Must have private key

Yes

Must be supplied.

Reject and informative error that private key has not been supplied

Import: Certificate checks

Yes

Minimum checks for:

• Version (v3)

• Start + end (present)

• Subject Name (present)

• Issuer Name (present)

• Data integrity (e.g. hash)

Reject and informative error if a check fails

Import: Certificate up to 4KB

Yes

Certificates can be varying sizes

Import: Formats

Yes

• PKCS#12 format. ‘.p12’ and ‘.pfx’ file extension. With or without password. This shall be the preferred/default option

• PEM format. ‘.cer’ ‘.pem’ and ‘.crt’ file extension.

• Pasted from clipboard in PEM format (optional)

NOTE that ONLY PKCS#12 file format is acceptable according to 147434–030–P1, however we cannot control what format customers receive their certificates in, hence all should be supported

Import: Other certificates in same file

No

Informative warning that other certificates have not been imported

View: TCS Certificate

Yes

Minimum viewable attributes (From CEC016: 147434–030–P1):

• Serial Number

• Subject Name

• Issuer Name

• Validity Period (that includes notBefore and notAfter dates)

• Thumbprint (Hash of the certificate)

• Subject Alternative Names

• Key Usage Extensions

• Extended Key Usage

Warnings/errors as per 147434–080–P1:

• Error displayed that certificate has expired

• Warning displayed that certificate is nearing expiry (within 60 days).

Renew existing:

Yes

Regenerate CA keeping all keys and other contents same except:

• notBefore and notAfter dates

• Serial Number

• Thumbprint (Hash of the certificate)

• ??

Can this be done to imported CAs or just internally generated ones?

Create new:

Yes

Regenerate CA, including keys

Export: Formats

Yes

Private key must not be exportable

Export formats:

• DER format. ‘.cer’ ‘.der’ and ‘.crt’ file extension.

• PEM format. ‘.cer’ ‘.pem’ and ‘.crt’ file extension.

• PKCS#12 (optional)