Import: Public key size

Yes

RSA 1024, 2048 and 4096 bit public keys must be supported. Any other sizes are optional.

Import of RSA public key less than 1024 or greater than 4096 bits to be rejected with an informative error.

Import of certificates with 1024 will be imported after a warning ‘The certificate public key may not be of sufficient strength. Do you wish to continue?’

Import: Certificate signature algorithm

Yes

SHA-1, SHA-256 SHA-384, and SHA-512 hashing algorithms must be supported. Any other SHA2 algorithms are optional.

Import of certificates with SHA-1 will be imported after a warning ‘The certificate signature algorithm may not be of sufficient strength. Do you wish to continue?’

Import of certificates with other algorithms (for example MD5, ECC) to be rejected with an informative error.

Import: Must have private key

Yes

Must be supplied.

Reject and informative error that private key has not been supplied

Import: Certificate checks

Yes

Minimum checks for:

Reject + informative error if a check fails

Import: Certificate up to 4KB

Yes

Certificates can be varying sizes

Import: Formats

Yes

NOTE that ONLY PKCS#12 file format is acceptable according to 147434–030–P1, however we cannot control what format customers receive their certificates in, hence all should be supported

See section below for certificate file import support

Import: Up to 4 other certificates in same file

Yes

Only supported where management of TCS also available.

Import: Certificate chain support

Yes

Where identity certificate is signed by one or more intermediate CAs, search TCS for matching certificates and include in identity certificate chain.

View: Certificate Contents

Yes

Minimum viewable attributes (From CEC016: 147434–030–P1):

Warnings/errors as per 147434–080–P1:

View: Private Key

No

Private key must not be viewable

Export: Formats

Yes

Private key must not be exportable

Export formats: