Certificate Policy
The Cert Policy sub-tab of the Internal CA tab controls whether certificates issued by the Internal CA carry a certificate policy marker, which policy they state, and whether the operator is asked to confirm the subject's identity at issuance.
It applies to the Internal CA only. ADCS stamps whatever its own Active Directory template dictates.
What a Certificate Policy Is
A certificate policy is a short, standardised identifier written into a certificate that says how thoroughly the subject's identity was checked before it was issued. Signotaur uses the non-qualified profiles from ETSI EN 319 411-1.
Someone who receives a signed file can read the signer's certificate, see which policy it claims, and follow an optional link to your own policy document to find out what that claim means. This matters most when signed documents travel outside your organisation.
Two things about Signotaur's approach are load-bearing.
The marker is advisory. Signotaur deliberately does not set Policy Constraints, so no validator is obliged to enforce anything because of it. Adding a policy will not cause certificate path validation to fail.
You are the policy authority. Signotaur supplies the mechanism and explains what each option asserts. It never checks whether your process lives up to the claim, never forces an acknowledgement, and never blocks an issuance over one. Choose the policy each certificate type honestly meets, and keep your own policy document current.
These are your organisation's own claims. Certificates issued by the Internal CA are self-asserted: they are not qualified (eIDAS QES) certificates, they carry no external audit, and no public trust list includes them.
Policy Profiles
| Option | What it asserts | OID |
|---|---|---|
| LCP — Lightweight | A basic identity check, for example an email round-trip or simple evidence. | 0.4.0.2042.1.3 |
| NCP — Normalised | Stronger identity proofing, verified against authoritative records or equivalent evidence. | 0.4.0.2042.1.1 |
| NCP+ — Normalised, secure device | NCP identity proofing, plus the subject's key held on a secure device. Signotaur's server-held or HSM key custody can satisfy this. | 0.4.0.2042.1.2 |
The OID ordering is not what you would guess: NCP is .1, NCP+ is .2 and LCP is .3. The values follow the ETSI registry.
Choosing NCP or NCP+ tells anyone reading the certificate that you performed stronger identity checks on the subject. Signotaur shows a reminder to that effect, but leaves the choice to you.
CP/CPS Document URL
The CP/CPS document URL is an optional link to your own Certificate Policy or Certification Practice Statement: the document that explains what your policy claims actually mean in practice.
- It must be an absolute
http://orhttps://address using plain ASCII characters. - Signotaur neither hosts nor serves the document. You host it yourself.
- Leaving it blank stamps the policy identifier with no link, which is perfectly valid.
The address is written into every certificate issued while it is set, and cannot be changed for a certificate that already exists. Use an address you commit to keeping, and keep the document there current: it is what someone reading one of your certificates follows to find out what the policy means.
Per-Certificate-Type Settings
Code signing and document signing are configured independently, because the checks you perform (and therefore the policy you can honestly state) usually differ between them. Each has its own section on the tab.
| Setting | Default | Effect |
|---|---|---|
| State a policy on code-signing / document-signing certificates | Off | When off, certificates of that type carry no policy marker at all. Turning it off greys out the remaining fields but keeps their values, so you can see what would be asserted before switching it on. |
| Policy | LCP — Lightweight | The profile certificates of this type assert by default. The Issue dialog can override it for a single certificate. |
| Record identity verification at issuance | Off | Adds a required confirmation tick box to the Issue dialog for this type. |
All three apply live; no restart is required.
Web (TLS) certificates never carry a certificate policy, and have no section here.
Identity Attestation
With Record identity verification at issuance turned on, issuing a certificate of that type from the Internal CA asks the operator to tick:
I confirm the subject's identity has been verified per our policy
and, optionally, to answer How was identity verified? in up to 512 characters. Both the confirmation and the note are written to the issuance event, so the record of who vouched for the subject sits with the record of the issuance itself.
The tick is required, not decorative: without it the Issue action is refused with a validation error, and the refusal itself is recorded.
It applies to the interactive Issue from Internal CA dialog only. Renewals, the scheduled web-certificate bootstrap and the REST API are never blocked by it, because there is no operator there to ask.
Overriding a Policy for One Certificate
When a type states a policy, the Issue from Internal CA dialog shows a Certificate policy field pre-filled with that type's configured profile. Change it to state a different profile for that certificate alone. The configured default is unchanged.
Renewing a certificate re-states the policy the certificate already carries, so a renewal never quietly upgrades or downgrades what a certificate claims.
Policies on Intermediate CAs
An Intermediate CA can carry its own policy marker, saying which policies it issues under. By default Signotaur derives that from the intermediate's purposes, exactly as it derives its EKU: an all-purpose CA states Any policy, and a purpose-scoped CA states the configured profile for each purpose it can issue.
The Add Intermediate CA and Reissue Intermediate CA dialogs offer a Certificate policy control with four options: Derived from purposes (the default), No policy, Any policy, and Specific policies. See Intermediate CAs.
The marker is fixed when a CA certificate is created. Turning a policy on here changes new end-entity certificates immediately, but your Intermediate CAs only pick up a marker the next time they are reissued.
Prerequisites and Permissions
- Applies to the Internal CA only.
- Certificates issued before a policy was turned on are not changed. Only certificates issued afterwards carry the marker.