Certification Practice Statement
Version 1.0.8

11

INTRODUCTION ....................................................................................................................................... 11
1.1

Overview ......................................................................................................................................... 11

1.2

Document name and identification ................................................................................................ 12

1.3

PKI participants ............................................................................................................................... 13

1.3.1

Certification authorities .......................................................................................................... 13

1.3.2

Registration authorities........................................................................................................... 13

1.3.3

Subscribers .............................................................................................................................. 14

1.3.4

Relying parties ......................................................................................................................... 14

1.3.5

Other participants ................................................................................................................... 14

1.4

1.4.1

Appropriate certificate uses .................................................................................................... 14

1.4.2

Prohibited certificate uses ...................................................................................................... 14

1.5

3

Policy administration....................................................................................................................... 15

1.5.1

Organization administering the document ............................................................................. 15

1.5.2

Contact person ........................................................................................................................ 15

1.5.3

Person determining CPS suitability for the policy ................................................................... 15

1.5.4

CPS approval procedures ........................................................................................................ 15

1.6

2

Certificate usage.............................................................................................................................. 14

Definitions and acronyms ............................................................................................................... 15

1.6.1

Definitions ............................................................................................................................... 15

1.6.2

Acronyms................................................................................................................................. 21

PUBLICATION AND REPOSITORY RESPONSIBILITIES................................................................................ 22
2.1

Repositories..................................................................................................................................... 22

2.2

Publication of certification information .......................................................................................... 22

2.3Time or frequency of publication .................................................................................................... 22

2.4

Access controls on repositories ...................................................................................................... 22

IDENTIFICATION AND AUTHENTICATION ................................................................................................ 22
3.1

Naming ............................................................................................................................................ 22

3.1.1

Types of names ....................................................................................................................... 22

3.1.2

Need for names to be meaningful .......................................................................................... 23

3.1.3

Anonymity or pseudonymity of subscribers ........................................................................... 23

3.1.4

Rules for interpreting various name forms ............................................................................. 23

3.1.5

Uniqueness of names .............................................................................................................. 23

3.1.6

Recognition, authentication, and role of trademarks ............................................................. 23

3.2

Initial identity validation ................................................................................................................. 232

3.2.1

Method to prove possession of private key............................................................................ 23

3.2.2

Authentication of Organization and Domain Identity............................................................. 23

3.2.3

Authentication of individual identity ...................................................................................... 24

3.2.4

Non-verified subscriber information....................................................................................... 24

3.2.5

Validation of authority ............................................................................................................ 24

3.2.6

Criteria for interoperation....................................................................................................... 24

3.3

3.3.1

Identification and authentication for routine re-key .............................................................. 24

3.3.2

Identification and authentication for re-key after revocation ................................................ 24

3.4
4

Identification and authentication for re-key requests .................................................................... 24

Identification and authentication for revocation request .............................................................. 24

CERTIFICATE LIFE-CYCLE OPERATIONAL REQUIREMENTS ....................................................................... 24
4.1

Certificate Application..................................................................................................................... 24

4.1.1

Who can submit a certificate application ............................................................................... 24

4.1.2

Enrollment process and responsibilities ................................................................................. 24

4.2

Certificate application processing ................................................................................................... 25

4.2.1

Performing identification and authentication functions ........................................................ 25

4.2.2

Approval or rejection of certificate applications .................................................................... 25

4.2.3

Time to process certificate applications ................................................................................. 25

4.3

Certificate issuance ......................................................................................................................... 26

4.3.1

CA actions during certificate issuance .................................................................................... 26

4.3.2

Notification to subscriber by the CA of issuance of certificate ............................................... 26

4.4

Certificate acceptance..................................................................................................................... 26

4.4.1

Conduct constituting certificate acceptance .......................................................................... 26

4.4.2

Publication of the certificate by the CA .................................................................................. 26

4.4.3

Notification of certificate issuance by the CA to other entities .............................................. 26

4.5

Key pair and certificate usage ......................................................................................................... 26

4.5.1

Subscriber private key and certificate usage .......................................................................... 26

4.5.2

Relying party public key and certificate usage ........................................................................ 26

4.6

Certificate renewal .......................................................................................................................... 27

4.6.1

Circumstance for certificate renewal ...................................................................................... 27

4.6.2

Who may request renewal ...................................................................................................... 27

4.6.3

Processing certificate renewal requests ................................................................................. 27

4.6.4

Notification of new certificate issuance to subscriber............................................................ 27

4.6.5

Conduct constituting acceptance of a renewal certificate ..................................................... 273

4.6.6

Publication of the renewal certificate by the CA .................................................................... 27

4.6.7

Notification of certificate issuance by the CA to other entities .............................................. 27

4.7

Certificate re-key ............................................................................................................................. 27

4.7.1

Circumstance for certificate re-key ......................................................................................... 27

4.7.2

Who may request certification of a new public key ............................................................... 27

4.7.3

Processing certificate re-keying requests ............................................................................... 27

4.7.4

Notification of new certificate issuance to subscriber............................................................ 27

4.7.5

Conduct constituting acceptance of a re-keyed certificate .................................................... 27

4.7.6

Publication of the re-keyed certificate by the CA ................................................................... 27

4.7.7

Notification of certificate issuance by the CA to other entities .............................................. 27

4.8

Certificate modification .................................................................................................................. 28

4.8.1

Circumstance for certificate modification............................................................................... 28

4.8.2

Who may request certificate modification ............................................................................. 28

4.8.3

Processing certificate modification requests .......................................................................... 28

4.8.4

Notification of new certificate issuance to subscriber............................................................ 28

4.8.5

Conduct constituting acceptance of modified certificate ....................................................... 28

4.8.6

Publication of the modified certificate by the CA ................................................................... 28

4.8.7

Notification of certificate issuance by the CA to other entities .............................................. 28

4.9

Certificate revocation and suspension............................................................................................ 28

4.9.1

Circumstances for revocation ................................................................................................. 28

4.9.2

Who can request revocation ................................................................................................... 28

4.9.3

Procedure for revocation request ........................................................................................... 28

4.9.4

Revocation request grace period ............................................................................................ 29

4.9.5

Time within which CA must process the revocation request ................................................. 29

4.9.6

Revocation checking requirement for relying parties............................................................. 29

4.9.7

CRL issuance frequency (if applicable) .................................................................................... 29

4.9.8

Maximum latency for CRLs (if applicable) ............................................................................... 29

4.9.9

On-line revocation/status checking availability ...................................................................... 29

4.9.10On-line revocation checking requirements............................................................................. 30

4.9.11Other forms of revocation advertisements available ............................................................. 30

4.9.12

Special requirements re key compromise............................................................................... 30

4.9.13Circumstances for suspension................................................................................................. 30

4.9.14

Who can request suspension .................................................................................................. 30

4.9.15

Procedure for suspension request .......................................................................................... 30
44.9.16
4.10

5Limits on suspension period.................................................................................................... 30

Certificate status services ............................................................................................................... 30

4.10.1

Operational characteristics ..................................................................................................... 30

4.10.2Service availability ................................................................................................................... 30

4.10.3

Optional features .................................................................................................................... 30

4.11

End of subscription.......................................................................................................................... 30

4.12

Key escrow and recovery ................................................................................................................ 30

4.12.1Key escrow and recovery policy and practices ....................................................................... 30

4.12.2

Session key encapsulation and recovery policy and practices................................................ 30

FACILITY, MANAGEMENT, AND OPERATIONAL CONTROLS .................................................................... 31
5.1

Physical controls.............................................................................................................................. 31

5.1.1

Site location and construction ................................................................................................ 31

5.1.2

Physical access ........................................................................................................................ 31

5.1.3

Power and air conditioning ..................................................................................................... 31

5.1.4

Water exposures ..................................................................................................................... 31

5.1.5Fire prevention and protection ............................................................................................... 31

5.1.6

Media storage ......................................................................................................................... 31

5.1.7

Waste disposal ........................................................................................................................ 31

5.1.8

Oﬀ-site backup ........................................................................................................................ 31

5.2

Procedural controls ......................................................................................................................... 31

5.2.1

Trusted roles ........................................................................................................................... 31

5.2.2

Number of persons required per task ..................................................................................... 32

5.2.3

Identification and authentication for each role ...................................................................... 32

5.2.4

Roles requiring separation of duties ....................................................................................... 32

5.3

Personnel controls .......................................................................................................................... 33

5.3.1

Qualifications, experience, and clearance requirements ....................................................... 33

5.3.2

Background check procedures ................................................................................................ 33

5.3.3

Training requirements............................................................................................................. 33

5.3.4

Retraining frequency and requirements ................................................................................. 33

5.3.5

Job rotation frequency and sequence..................................................................................... 33

5.3.6

Sanctions for unauthorized actions ........................................................................................ 33

5.3.7

Independent contractor requirements ................................................................................... 34

5.3.8

Documentation supplied to personnel ................................................................................... 34

5.4

Audit logging procedures ................................................................................................................ 3455.4.1

Types of events recorded ........................................................................................................ 34

5.4.2

Frequency of processing log and archiving audit logs ............................................................ 34

5.4.3

Retention period for audit logs ............................................................................................... 34

5.4.4

Protection of audit log ............................................................................................................ 34

5.4.5

Audit log backup procedures .................................................................................................. 34

5.4.6

Audit log accumulation system (internal vs. external)............................................................ 34

5.4.7

Notification to event-causing subject ..................................................................................... 35

5.4.8

Vulnerability assessments ....................................................................................................... 35

5.5

5.5.1

Types of records archived ....................................................................................................... 35

5.5.2

Retention period for archive ................................................................................................... 35

5.5.3

Protection of archive ............................................................................................................... 35

5.5.4

Archive backup procedures..................................................................................................... 35

5.5.5

Requirements for time-stamping of records .......................................................................... 36

5.5.6

Archive collection system (internal or external) ..................................................................... 36

5.5.7

Procedures to obtain and verify archive information ............................................................. 36

5.6

Key changeover ............................................................................................................................... 36

5.7

Compromise and disaster recovery ................................................................................................ 36

5.7.1

Incident and compromise handling procedures ..................................................................... 36

5.7.2

Computing resources, software, and/or data are corrupted.................................................. 36

5.7.3

Entity private key compromise procedures ............................................................................ 36

5.7.4

Business continuity capabilities after a disaster ..................................................................... 37

5.8
6Records archival .............................................................................................................................. 35

CA or RA termination ...................................................................................................................... 37

TECHNICAL SECURITY CONTROLS............................................................................................................ 37
6.1

Key pair generation and installation ............................................................................................... 37

6.1.1

Key pair generation ................................................................................................................. 37

6.1.2

Private key delivery to subscriber ........................................................................................... 37

6.1.3

Public key delivery to certificate issuer................................................................................... 37

6.1.4

CA public key delivery to relying parties ................................................................................. 37

6.1.5

Key sizes .................................................................................................................................. 37

6.1.6

Public key parameters generation and quality checking ........................................................ 38

6.1.7

Key usage purposes (as per X.509 v3 key usage field) ............................................................ 38

6.2

Private Key Protection and Cryptographic Module Engineering Controls ...................................... 38

6.2.1

Cryptographic module standards and controls ....................................................................... 38
6

6.2.2

Private key (n out of m) multi-person control ........................................................................ 38

6.2.3

Private key escrow .................................................................................................................. 38

6.2.4

Private key backup .................................................................................................................. 38

6.2.5

Private key archival ................................................................................................................. 38

6.2.6

Private key transfer into or from a cryptographic module ..................................................... 38

6.2.7

Private key storage on cryptographic module ........................................................................ 39

6.2.8

Method of activating private key ............................................................................................ 39

6.2.9

Method of deactivating private key ........................................................................................ 39

6.2.10

Method of destroying private key........................................................................................... 39

6.2.11

Cryptographic Module Rating ................................................................................................. 39

6.3

6.3.1

Public key archival ................................................................................................................... 39

6.3.2

Certificate operational periods and key pair usage periods ................................................... 39

6.4

Activation data ................................................................................................................................ 39

6.4.1

Activation data generation and installation............................................................................ 39

6.4.2

Activation data protection ...................................................................................................... 39

6.4.3

Other aspects of activation data ............................................................................................. 39

6.5

Computer security controls............................................................................................................. 40

6.5.1

Specific computer security technical requirements................................................................ 40

6.5.2

Computer security rating ........................................................................................................ 40

6.6

7

Other aspects of key pair management .......................................................................................... 39

Life cycle technical controls ............................................................................................................ 40

6.6.1

System development controls ................................................................................................ 40

6.6.2

Security management controls ............................................................................................... 40

6.6.3

Life cycle security controls ...................................................................................................... 40

6.7

Network security controls ............................................................................................................... 40

6.8

Time-stamping ................................................................................................................................ 40

CERTIFICATE, CRL, AND OCSP PROFILE S ................................................................................................. 41
7.1

Certificate profile ............................................................................................................................ 41

7.1.1

Version number(s) ................................................................................................................... 41

7.1.2

Certificate extensions.............................................................................................................. 41

7.1.3

Algorithm object identifiers .................................................................................................... 41

7.1.4

Name forms ............................................................................................................................. 41

7.1.5

Name constraints .................................................................................................................... 41

7.1.6

Certificate policy object identifier ........................................................................................... 41
7

7.1.7

Usage of Policy Constraints extension .................................................................................... 41

7.1.8

Policy qualifiers syntax and semantics .................................................................................... 41

7.1.9

Processing semantics for the critical Certificate Policies extension ....................................... 41

7.2

7.2.1

Version number(s) ................................................................................................................... 41

7.2.2

CRL and CRL entry extensions ................................................................................................. 41

7.3

8

9

CRL profile ....................................................................................................................................... 41

OCSP profile .................................................................................................................................... 42

7.3.1

Version number(s) ................................................................................................................... 42

7.3.2

OCSP extensions ...................................................................................................................... 42

COMPLIANCE AUDIT AND OTHER ASSESSMENTS ................................................................................... 42
8.1

Frequency or circumstances of assessment ................................................................................... 42

8.2

Identity/qualifications of assessor .................................................................................................. 42

8.3

Assessor’s relationship to assessed entity ...................................................................................... 43

8.4

Topics covered by assessment ........................................................................................................ 43

8.5

Actions taken as a result of deficiency ............................................................................................ 43

8.6

Communication of results ............................................................................................................... 43

8.7

Self-Audits ....................................................................................................................................... 43

OTHER BUSINESS AND LEGAL MATTERS ................................................................................................. 43
9.1

Fees ................................................................................................................................................. 43

9.1.1

Certificate issuance or renewal fees ....................................................................................... 43

9.1.2

Certificate access fees ............................................................................................................. 43

9.1.3

Revocation or status information access fees ........................................................................ 43

9.1.4

Fees for other services ............................................................................................................ 43

9.1.5

Refund policy........................................................................................................................... 43

9.2

Financial responsibility .................................................................................................................... 44

9.2.1

Insurance coverage ................................................................................................................. 44

9.2.2

Other assets ............................................................................................................................ 44

9.2.3

Insurance or warranty coverage for end-entities ................................................................... 44

9.3

Confidentiality of business information .......................................................................................... 44

9.3.1

Scope of confidential information .......................................................................................... 44

9.3.2

Information not within the scope of confidential information............................................... 44

9.3.3

Responsibility to protect confidential information ................................................................. 44

9.4

Privacy of personal information ...................................................................................................... 44

9.4.1

Privacy plan ............................................................................................................................. 448

9.4.2

Information treated as private ................................................................................................ 44

9.4.3

Information not deemed private ............................................................................................ 44

9.4.4

Responsibility to protect private information......................................................................... 45

9.4.5

Notice and consent to use private information ...................................................................... 45

9.4.6

Disclosure pursuant to judicial or administrative process ...................................................... 45

9.4.7

Other information disclosure circumstances .......................................................................... 45

9.5Intellectual property rights ............................................................................................................. 45

9.6

Representations and warranties ..................................................................................................... 45

9.6.1

CA representations and warranties ........................................................................................ 45

9.6.2

RA representations and warranties ........................................................................................ 45

9.6.3

Subscriber representations and warranties ............................................................................ 46

9.6.4

Relying party representations and warranties........................................................................ 46

9.6.5

Representations and warranties of other participants ........................................................... 47

9.7

Disclaimers of warranties ................................................................................................................ 47

9.8

Limitations of liability ...................................................................................................................... 47

9.9

Indemnities ..................................................................................................................................... 47

9.10

Term and termination ..................................................................................................................... 48

9.10.1

Term ........................................................................................................................................ 48

9.10.2

Termination ............................................................................................................................. 48

9.10.3

Eﬀect of termination and survival ........................................................................................... 48

9.11

Individual notices and communications with participants ............................................................. 49

9.12

Amendments ................................................................................................................................... 49

9.12.1

Procedure for amendment...................................................................................................... 49

9.12.2

Notification mechanism and period........................................................................................ 49

9.12.3Circumstances under which OID must be changed ................................................................ 49

9.13

Dispute resolution provisions ......................................................................................................... 49

9.14

Governing law ................................................................................................................................. 49

9.15

Compliance with applicable law...................................................................................................... 49

9.16

Miscellaneous provisions ................................................................................................................ 49

9.16.1

Entire agreement .................................................................................................................... 49

9.16.2

Assignment .............................................................................................................................. 50

9.16.3Severability .............................................................................................................................. 50

9.16.4

Enforcement (attorneys’ fees and waiver of rights) ............................................................... 50

9.16.5Force Majeure ......................................................................................................................... 50
9

9.17

Other provisions .............................................................................................................................. 50

Appendix A: Object Identifiers ........................................................................................................................ 50
Table 1: Signature Algorithms ..................................................................................................................... 50
Table 2: Selected Name Attribute Types..................................................................................................... 51
Appendix B: Certificate Profiles ...................................................................................................................... 51
Root CA Certificates .................................................................................................................................... 51
Subordinate CA Certificates ........................................................................................................................ 52
Standard Validation TLS Server Authentication Certificates....................................................................... 52
Extended Validation TLS Server Authentication Certificates ...................................................................... 53
Standard Validation Code Signing Certificates............................................................................................ 53
Extended Validation Code Signing Certificates ........................................................................................... 54
Client Certificates ........................................................................................................................................ 54
Augmented Client Certificates .................................................................................................................... 55
OCSP Signing Certificates ............................................................................................................................ 55
Time Stamp Authority Certificates .............................................................................................................. 55

10

1 INTRODUCTION
1.1 Overview

Amazon Trust Services (“Amazon”) has established the Amazon Public Internet Public Key Infrastructure(“Amazon PKI”). This CPS outlines the principles and practices related to the Amazon PKI certificate
issuance services and describes the practices used to comply with the Amazon CP and other applicablepolicies.
This practice statement is designed to be read in conjunction with the Amazon Certificate Policy. All
defined terms and acronyms in the CP have the same definitions in this document unless redefined in §1.6of this document.
The Amazon PKI conforms to the current version of the guidelines adopted by the Certification Authority/
Browser Forum (“CAB Forum”) when issuing publicly trusted certificates, including the Baseline
Requirements for the Issuance and Management of Publicly Trusted Certificates (“Baseline
Requirements”), the Guidelines for Extended Validation Certificates (“EV Guidelines”) , Baseline
Requirements for the Issuance and Management of Publicly Trusted Code Signing Certificates(“CodeSigning Guidelines"), and the Guidelines for Extended Validation Code Signing (“EV Code Signing
Guidelines), each of which are published at https:// www.cabforum.org. If any inconsistency exists
between this CPS and the Baseline Requirements, the EV Guidelines, or EV Code Signing Guidelines thenthe associated requirement or guideline document shall take precedence.
This CPS is only one of several documents that control Amazon PKI certification services. Other important
documents include both private and public documents, such as the CP, Amazon’s agreements with its
customers, and Amazon’s privacy policy. Amazon may provide additional certificate policies or certification
practice statements. These supplemental policies and statements are available to applicable users or
relying parties. The document name, location of, and status, whether public or confidential, are detailed
below. This is not an exhaustive list.
Document

StatusAmazon Certificate Policy

PublicAmazon Certification Practice Statement

PublicSubscriber Agreement

PublicTerms of Use

PublicLocation
AmazonRepository
AmazonRepository
AmazonRepository
AmazonRepository

Amazon Privacy Policy Public
https://www.amazon.com/gp/help/customer/display.html?nodeId=468496 Public
CA Procedure Documents

Presented
to auditors
Confidential accordinglyThis CPS, related agreements, and Certificate policies referenced within this document are available
online at https://www.amazontrust.com/repository.
This work is licensed under the Creative Commons Attribution-NoDerivatives 4.0 International License.
To view a copy of this license, visit http://creativecommons.org/licenses/by-nd/4.0/ or send a letter toCreative Commons, PO Box 1866, Mountain View, CA 94042, USA.

11

Pursuant to the IETF PKIX RFC 3647 CP/CPS framework, this CPS is divided into nine primary
components that cover the security controls and practices and procedures for certificate issuanceservices within the Amazon PKI. To preserve the outline specified by RFC 3647, section headings that do
not apply have the statement “Not applicable” or “No stipulation.”
This document is the CPS for the following Certification Authorities:CA
Type

CA Distinguished Name

Key pair typeandparameters

Root
CA

C=US
O=Amazon
CN=Amazon Root CA 1

RSA, n has
2048bits e=65537

Root
CA

C=US
O=Amazon
CN=Amazon Root CA 2

RSA, n has
4096bits e=65537

Root
CA

C=US
O=Amazon
CN=Amazon Root CA 3

EC, NIST P-256
curve

Root
CA

C=US
O=Amazon
CN=Amazon Root CA 4

EC, NIST P-384
curve

Validity Period
2015-05-26
fbe3018031f9586b 00:00:00
cbf41727e417b7d1 GMT to 2038-01c45c2f47f93be372
17
a17b96b50757d5a2 00:00:00 GMT
2015-05-26
7f4296fc5b6a4e3b 00:00:00
35d3c369623e364a GMT to 2040-05b1af381d8fa71215 26
33c9d6c633ea2461 00:00:00 GMT
2015-05-26
36abc32656acfc64
00:00:00
5c61b71613c4bf21 GMT to 2040-05c787f5cabbee4834 26
8d58597803d7abc9 00:00:00 GMT
2015-05-26
f7ecded5c66047d2 00:00:00
8ed6466b543c40e0 GMT to 2040-05743abe81d109254d 26
cf845d4c2c7853c5
00:00:00 GMT

Root
CA

C=US
ST=Arizona
L=Scottsdale
O=Starfield Technologies,Inc.
CN=Starfield Services
Root Certificate Authority - G2

RSA, n has
2048bits e=65537

28689b30e4c306aa
b53b027b29e36ad6
dd1dcf4b95399448
2ca84bdc1ecac996

SHA-256 Key
Fingerprint

2009-09-01
00:00:00
GMT to 2037-1231
23:59:59 GMT

Effective June 10, 2015, the Starfiel d Services Root Certificate Authority - G2 certification authority
operates under this CPS. Prior to such date, the Starfiel d Services Root Certificate Authority - G2
certification authority was operated under the Starfield Technologies, LLC Certificate Policy andCertification Practice Statement.

1.2 Document name and identification
This document is the Amazon Certification Practices Statement and was approved for publication by the
APPMA. The following revisions were made to the original document:
Date
Changes
2015-05-26 Initial release.
2015-06-10 Added new root.

Version
1.0.1
1.0.2
12

2015-10-21 Updated to Amazon Trust Services and to use standard policy identifiers.

1.0.3

Updated validation processes for wildcard DNs, email addresses, andSubordinate
2015-12-08 CAs.
2017-01-12 Yearly update
2018-01-15 Yearly update, including CAA information

1.0.4
1.0.5
1.0.6

2018-04-13 Updated 3.2.2 Validation of Domain Authorization or Control, BR 1.5.6

1.0.7

2019-12-17 Updated to add Code Signing Baseline Requirements

1.0.8

2020-30-03 Updated to latest Baseline Requirements

1.0.9

The OID for this CPS is 1.3.187.129.2 {iso(1) identified-organization(3) amazon(187) documents(129)cps(2)} Subsequent revisions to this CPS may have new OID assignments.

1.3 PKI participants
1.3.1 Certification authorities
Amazon is a CA that issues digital certificates. As a CA, Amazon performs functions associated with
Public Key operations, including receiving certificate requests, issuing, revoking and renewing a digital
certificate, and maintaining, issuing, and publishing CRLs and OCSP responses. General information
about Amazon products and services is available at www.amazon.com.
CAs issue certificates in accordance with the Amazon CP. Subscriber certificates are only issued from
Root CAs as necessary to meet the User Agent Verification Requirements of Appendix C of the Baseline
Requirements and may only be issued to Amazon Trust Services or an affiliated company. Amazon Trust
Services or an affiliated company must have the right to use or legitimate control of all domain names
and IP addresses in such subscriber certificates.

1.3.2 Registration authorities
Amazon may delegate the performance of certain functions to an RA and/or other third parties (each a“Delegated Third Party”) to request certificates and/or perform identification and authentication for
end user certificates. The specific role of an RA or Delegated Third Party varies greatly between entities,
ranging from simple translation services to actual assistance in gathering and verifying Applicant
information. Some RAs operate identity management systems and may manage the certificate lifecyclefor end users. Amazon contractually obligates each Delegated Third Party to abide by the policies andindustry standards that are applicable to that Delegated Third Party’s role in certificate issuance,
management, revocation or other related task that the Delegated Third Party performs.
RA personnel involved in the issuance of publicly trusted SSL Certificates must undergo training as
specified in 5.3.3 Training Requirements set forth in Section 5.3.3 hereof. An RA or identity
management system supporting a particular community of interest with custom identity vetting
practices that differ from those found herein may submit documentation to the APPMA for review andapproval. The documentation must contain sufficient detail to ensure that all tasks required by the CP
will be performed.

13

1.3.3 Subscribers
Subscribers use the Amazon PKI to support transactions and communications. Subscribers are notalways the party identified in a certificate, such as when certificates are issued to an organization’s
employees or when the subject owner has granted control of the subject to the subscriber. Prior toverification of identity and issuance of a certificate, a Subscriber is an Applicant.

1.3.4 Relying parties
Relying Parties must check the appropriate CRL or OCSP response prior to relying on information
featured in a certificate. The location of the CRL distribution point and OCSP responder is detailed
within the certificate.

1.3.5 Other participants
Other participants include Accreditation Authorities (such as Policy Management Authorities,
Federation Operators, Application Software Vendors, and applicable Community of Interest sponsors);
Bridge CAs and CAs that cross certify Amazon CAs as trust anchors in other PKI communities, CMAs,
RSPs, CSAs and TSAs.
If the CA subcontracts CMA, RSP, CSA, TSA, or other functions, the CA ensures that compliance with the
CP is required in the agreement with the subcontractor. The CA may use a practices statement of thesubcontractor as evidence of compliance if, and only if, the subcontractor’s practices are audited by anindependent external auditor on at least an annual basis and the subcontractor submits the results ofeach audit to the CA.

1.4 Certificate usage
A digital certificate (or certificate) is formatted data that cryptographically binds an identified Subscriber
with a Public Key. A digital certificate allows an entity taking part in an electronic transaction to prove
its identity to other participants in such transaction. Digital certificates are used in commercial
environments as a digital equivalent of an identification card.

1.4.1 Appropriate certificate uses
Certificates issued pursuant to this CPS may be used for all legal authentication, encryption, access
control, and digital signature purposes, as designated by the key usage and extended key usage fields
found within the certificate. However, the sensitivity of the information processed or protected by acertificate varies greatly, and each Relying Party must evaluate the application environment andassociated risks before deciding on whether to use a certificate issued under this CPS.

1.4.2 Prohibited certificate uses
Certificates do not guarantee that the Subject is trustworthy, honest, reputable in its business dealings,
compliant with any laws, or safe to do business with. A certificate only establishes that the informationin the certificate was verified as reasonably correct when the certificate issued.
Certificates issued under this CPS may not be used (i) for any application requiring fail safe performancesuch as (a) the operation of nuclear power facilities, (b) air traffic control systems, (c) aircraft navigation
systems, (d) weapons control systems, or (e) any other system whose failure could lead to injury, deathor environmental damage; or (ii) where prohibited by law.
Additionally, Certificates issued under this CPS may not be used for “traffic management” or man-inthe- middle purposes.
141.5 Policy administration
1.5.1 Organization administering the document
This CPS and the documents referenced herein are maintained by the Amazon PKI Policy Management
Authority (APPMA).

1.5.2 Contact person

Amazon PKI Policy Management Authority
410 Terry Ave. North Seattle, WA, 98109-5210+1 206 266 1000
Web: www. amazontrust.com
Email: appma@amazon.com
Contact information for Certificate Problem Reports can be found at:https://www.amazontrust.com/repository/

1.5.3 Person determining CPS suitability for the policy
The APPMA determines the suitability and applicability of this CPS based on the results andrecommendations received from an independent auditor. The APPMA is also responsible for evaluating
and acting upon the results of compliance audits.

1.5.4 CPS approval procedures
The APPMA approves the CPS and any amendments. Amendments are made after the APPMA has
reviewed the amendments’ consistency with the CP, by either updating the entire CPS or by publishingan addendum. The APPMA determines whether an amendment to this CPS is consistent with the CP,
requires notice, or an OID change.

1.6 Definitions and acronyms
1.6.1 Definitions

Affiliate: A corporation, partnership, joint venture or other entity controlling, controlled by, or undercommon control with another entity, or an agency, department, political subdivision, or any entity
operating under the direct control of a Government Entity.
Applicant: The natural person or Legal Entity that applies for (or seeks renewal of) a Certificate. Once theCertificate issues, the Applicant is referred to as the Subscriber. For Certificates issued to devices, theApplicant is the entity that controls or operates the device named in the Certificate, even if the device issending the actual certificate request.
Applicant Representative: A natural person or human sponsor who is either the Applicant, employed by
the Applicant, or an authorized agent who has express authority to represent the Applicant: (i) who signs
and submits, or approves a certificate request on behalf of the Applicant, and/or (ii) who signs and submits
a Subscriber Agreement on behalf of the Applicant, and/or (iii) who acknowledges the Terms of Use on
behalf of the Applicant when the Applicant is an Affiliate of the CA or is the CA.
Application Software Supplier: A supplier of Internet browser software or other relying-party application
software that displays or uses Certificates and incorporates Root Certificates.
Attestation Letter: A letter attesting that Subject Information is correct written by an accountant, lawyer,
government official, or other reliable third party customarily relied upon for such information.
15

Audit Period: In a period-of-time audit, the period between the first day (start) and the last day ofoperations (end) covered by the auditors in their engagement. (This is not the same as the period of time
when the auditors are on-site at the CA.) The coverage rules and maximum length of audit periods aredefined in section 8.1.
Audit Report: A report from a Qualified Auditor stating the Qualified Auditor's opinion on whether anentity's processes and controls comply with the mandatory provisions of these Requirements.
Authorization Domain Name: The Domain Name used to obtain authorization for certificate issuance for agiven FQDN. The CA may use the FQDN returned from a DNS CNAME lookup as the FQDN for the purposesof domain validation. If the FQDN contains a wildcard character, then the CA MUST remove all wildcard
labels from the left most portion of requested FQDN. The CA may prune zero or more labels from left toright until encountering a Base Domain Name and may use any one of the intermediate values for the
purpose of domain validation.
Authorized Ports: One of the following ports: 80 (http), 443 (https), 25 (smtp), 22 (ssh).
Base Domain Name: The portion of an applied-for FQDN that is the first domain name node left of aregistry-controlled or public suffix plus the registry-controlled or public suffix (e.g. "example.co.uk" or"example.com"). For FQDNs where the right-most domain name node is a gTLD having ICANN Specification
13 in its registry agreement, the gTLD itself may be used as the Base Domain Name.
CAA: From RFC 6844 (http:tools.ietf.org/html/rfc6844): "The Certification Authority Authorization (CAA)DNS Resource Record allows a DNS domain name holder to specify the Certification Authorities (CAs)authorized to issue certificates for that domain. Publication of CAA Resource Records allows a publicCertification Authority to implement additional controls to reduce the risk of unintended certificate misissue."Certificate: An electronic document that uses a digital signature to bind a public key and an identity.
Certificate Data: Certificate requests and data related thereto (whether obtained from the Applicant orotherwise) in the CA's possession or control or to which the CA has access.
Certificate Management Process: Processes, practices, and procedures associated with the use of keys,
software, and hardware, by which the CA verifies Certificate Data, issues Certificates, maintains a
Repository, and revokes Certificates.
Certificate Policy: A set of rules that indicates the applicability of a named Certificate to a particularcommunity and/or PKI implementation with common security requirements.
Certificate Problem Report: Complaint of suspected Key Compromise, Certificate misuse, or other types offraud, compromise, misuse, or inappropriate conduct related to Certificates.
Certificate Revocation List: A regularly updated time-stamped list of revoked Certificates that is created
and digitally signed by the CA that issued the Certificates.
Certification Authority: An organization that is responsible for the creation, issuance, revocation, andmanagement of Certificates. The term applies equally to both Roots CAs and Subordinate CAs.
Certification Practice Statement: One of several documents forming the governance framework in which
Certificates are created, issued, managed, and used.
16

Control: "Control" (and its correlative meanings, "controlled by" and "under common control with") meanspossession, directly or indirectly, of the power to: (1) direct the management, personnel, finances, or plansof such entity; (2) control the election of a majority of the directors ; or (3) vote that portion of voting
shares required for "control" under the law of the entity's Jurisdiction of Incorporation or Registration but
in no case less than 10%.
Country: Either a member of the United Nations OR a geographic region recognized as a Sovereign State byat least two UN member nations.
Cross Certificate: A certificate that is used to establish a trust relationship between two Root CAs.
CSPRNG: A random number generator intended for use in cryptographic system.
Delegated Third Party: A natural person or Legal Entity that is not the CA but is authorized by the CA, andwhose activities are not within the scope of the appropriate CA audits, to assist in the Certificate
Management Process by performing or fulfilling one or more of the CA requirements found herein.
DNS CAA Email Contact: The email address defined in section B.1.1.
DNS CAA Phone Contact: The phone number defined in section B.1.2.
DNS TXT Record Email Contact: The email address defined in section B.2.1.
DNS TXT Record Phone Contact: The phone number defined in section B.2.2.
Domain Authorization Document: Documentation provided by, or a CA's documentation of acommunication with, a Domain Name Registrar, the Domain Name Registrant, or the person or entity listedin WHOIS as the Domain Name Registrant (including any private, anonymous, or proxy registration service)attesting to the authority of an Applicant to request a Certificate for a specific Domain Namespace.
Domain Contact: The Domain Name Registrant, technical contact, or administrative contact (or theequivalent under a ccTLD) as listed in the WHOIS record of the Base Domain Name or in a DNS SOA record,or as obtained through direct contact with the Domain Name Registrar.
Domain Name: The label assigned to a node in the Domain Name System.
Domain Namespace: The set of all possible Domain Names that are subordinate to a single node in the
Domain Name System.
Domain Name Registrant: Sometimes referred to as the "owner" of a Domain Name, but more properly
the person(s) or entity(ies) registered with a Domain Name Registrar as having the right to control how a
Domain Name is used, such as the natural person or Legal Entity that is listed as the "Registrant" by WHOIS
or the Domain Name Registrar.
Domain Name Registrar: A person or entity that registers Domain Names under the auspices of or byagreement with: (i) the Internet Corporation for Assigned Names and Numbers (ICANN), (ii) a national
Domain Name authority/registry, or (iii) a Network Information Center (including their affiliates,
contractors, delegates, successors, or assignees).
Enterprise RA: An employee or agent of an organization unaffiliated with the CA who authorizes issuanceof Certificates to that organization.
Expiry Date: The "Not After" date in a Certificate that defines the end of a Certificate's validity period.
17

Fully-Qualified Domain Name: A Domain Name that includes the labels of all superior nodes in theInternet Domain Name System.
Government Entity: A government-operated legal entity, agency, department, ministry, branch, or similarelement of the government of a country, or political subdivision within such country (such as a state,province, city, county, etc.).
High Risk Certificate Request: A Request that the CA flags for additional scrutiny by reference to internal
criteria and databases maintained by the CA, which may include names at higher risk for phishing or otherfraudulent usage, names contained in previously rejected certificate requests or revoked Certificates,names listed on the Miller Smiles phishing list or the Google Safe Browsing list, or names that the CA
identifies using its own risk-mitigation criteria.
Internal Name: A string of characters (not an IP address) in a Common Name or Subject Alternative Name
field of a Certificate that cannot be verified as globally unique within the public DNS at the time ofcertificate issuance because it does not end with a Top Level Domain registered in IANA's Root Zone
Database.
IP Address: A 32-bit or 128-bit label assigned to a device that uses the Internet Protocol forcommunication.
IP Address Contact: The person(s) or entity(ies) registered with an IP Address Registration Authority as
having the right to control how one or more IP Addresses are used.
IP Address Registration Authority: The Internet Assigned Numbers Authority (IANA) or a Regional Internet
Registry (RIPE, APNIC, ARIN, AfriNIC, LACNIC).
Issuing CA: In relation to a particular Certificate, the CA that issued the Certificate. This could be either a
Root CA or a Subordinate CA.
Key Compromise: A Private Key is said to be compromised if its value has been disclosed to an
unauthorized person, or an unauthorized person has had access to it.
Key Generation Script: A documented plan of procedures for the generation of a CA Key Pair .
Key Pair: The Private Key and its associated Public Key.
Legal Entity: An association, corporation, partnership, proprietorship, trust, government entity or otherentity with legal standing in a country's legal system.
Object Identifier: A unique alphanumeric or numeric identifier registered under the International
Organization for Standardization's applicable standard for a specific object or object class.
OCSP Responder: An online server operated under the authority of the CA and connected to its Repository
for processing Certificate status requests. See also, Online Certificate Status Protocol.
Online Certificate Status Protocol: An online Certificate-checking protocol that enables relying-party
application software to determine the status of an identified Certificate. See also OCSP Responder.
Parent Company: A company that Controls a Subsidiary Company.
Private Key: The key of a Key Pair that is kept secret by the holder of the Key Pair, and that is used tocreate Digital Signatures and/or to decrypt electronic records or files that were encrypted with thecorresponding Public Key.
18

Public Key: The key of a Key Pair that may be publicly disclosed by the holder of the corresponding Private
Key and that is used by a Relying Party to verify Digital Signatures created with the holder's corresponding
Private Key and/or to encrypt messages so that they can be decrypted only with the holder's corresponding
Private Key.
Public Key Infrastructure: A set of hardware, software, people, procedures, rules, policies, and obligations
used to facilitate the trustworthy creation, issuance, management, and use of Certificates and keys basedon Public Key Cryptography.
Publicly-Trusted Certificate: A Certificate that is trusted by virtue of the fact that its corresponding Root
Certificate is distributed as a trust anchor in widely-available application software.
Qualified Auditor: A natural person or Legal Entity that meets the requirements of Section 8.2.
Random Value: A value specified by a CA to the Applicant that exhibits at least 112 bits of entropy.
Registered Domain Name: A Domain Name that has been registered with a Domain Name Registrar.
Registration Authority (RA): Any Legal Entity that is responsible for identification and authentication ofsubjects of Certificates, but is not a CA, and hence does not sign or issue Certificates. An RA may assist in
the certificate application process or revocation process or both. When "RA" is used as an adjective todescribe a role or function, it does not necessarily imply a separate body, but can be part of the CA.
Reliable Data Source: An identification document or source of data used to verify Subject Identity
Information that is generally recognized among commercial enterprises and governments as reliable, andwhich was created by a third party for a purpose other than the Applicant obtaining a Certificate.
Reliable Method of Communication: A method of communication, such as a postal/courier delivery
address, telephone number, or email address, that was verified using a source other than the Applicant
Representative.
Relying Party: Any natural person or Legal Entity that relies on a Valid Certificate. An Application Software
Supplier is not considered a Relying Party when software distributed by such Supplier merely displays
information relating to a Certificate.
Repository: An online database containing publicly-disclosed PKI governance documents (such as
Certificate Policies and Certification Practice Statements) and Certificate status information, either in theform of a CRL or an OCSP response.
Request Token: A value, derived in a method specified by the CA which binds this demonstration of control
to the certificate request. The CA SHOULD define within its CPS (or a document clearly referenced by the
CPS) the format and method of Request Tokens it accepts.
The Request Token SHALL incorporate the key used in the certificate request.
A Request Token MAY include a timestamp to indicate when it was created.
A Request Token MAY include other information to ensure its uniqueness.
A Request Token that includes a timestamp SHALL remain valid for no more than 30 days from the time ofcreation.
A Request Token that includes a timestamp SHALL be treated as invalid if its timestamp is in the future.
19

A Request Token that does not include a timestamp is valid for a single use and the CA SHALL NOT re-use it
for a subsequent validation.
The binding SHALL use a digital signature algorithm or a cryptographic hash algorithm at least as strong asthat to be used in signing the certificate request.
Note: Examples of Request Tokens include, but are not limited to: (i) a hash of the public key; or (ii) a hashof the Subject Public Key Info [X.509]; or (iii) a hash of a PKCS#10 CSR. A Request Token may also be
concatenated with a timestamp or other data. If a CA wanted to always use a hash of a PKCS#10 CSR as aRequest Token and did not want to incorporate a timestamp and did want to allow certificate key re-use
then the applicant might use the challenge password in the creation of a CSR with OpenSSL to ensure
uniqueness even if the subject and key are identical between subsequent requests.
Note: This simplistic shell command produces a Request Token which has a timestamp and a hash of a CSR.
echo `date -u +%Y%m%d%H%M` `sha256sum <r2.csr` \| sed "s/[ -]//g" The script outputs:
201602251811c9c863405fe7675a3988b97664ea6baf442019e4e52fa335f406f7c5f26cf14f
Required Website Content: Either a Random Value or a Request Token, together with additional
information that uniquely identifies the Subscriber, as specified by the CA.
Requirements: The Baseline Requirements found in this document.
Reserved IP Address: An IPv4 or IPv6 address that the IANA has marked as reserved:
http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml
http://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xml
Root CA: The top level Certification Authority whose Root Certificate is distributed by Application Software
Suppliers and that issues Subordinate CA Certificates.
Root Certificate: The self-signed Certificate issued by the Root CA to identify itself and to facilitate
verification of Certificates issued to its Subordinate CAs.
Sovereign State: A state or country that administers its own government, and is not dependent upon, or
subject to, another power.
Subject: The natural person, device, system, unit, or Legal Entity identified in a Certificate as the Subject.
The Subject is either the Subscriber or a device under the control and operation of the Subscriber.
Subject Identity Information: Information that identifies the Certificate Subject. Subject Identity
Information does not include a domain name listed in the subjectAltName extension or the Subject
commonName field.
Subordinate CA: A Certification Authority whose Certificate is signed by the Root CA, or another
Subordinate CA.
Subscriber: A natural person or Legal Entity to whom a Certificate is issued and who is legally bound by a
Subscriber Agreement or Terms of Use.
Subscriber Agreement: An agreement between the CA and the Applicant/Subscriber that specifies therights and responsibilities of the parties.
Subsidiary Company: A company that is controlled by a Parent Company.
20Technically Constrained Subordinate CA Certificate: A Subordinate CA certificate which uses a
combination of Extended Key Usage settings and Name Constraint settings to limit the scope within which
the Subordinate CA Certificate may issue Subscriber or additional Subordinate CA Certificates.
Terms of Use: Provisions regarding the safekeeping and acceptable uses of a Certificate issued inaccordance with these Requirements when the Applicant/Subscriber is an Affiliate of the CA or is the CA.
Test Certificate: This term is no longer used in these Baseline Requirements.
Trustworthy System: Computer hardware, software, and procedures that are: reasonably secure from
intrusion and misuse; provide a reasonable level of availability, reliability, and correct operation; arereasonably suited to performing their intended functions; and enforce the applicable security policy.
Unregistered Domain Name: A Domain Name that is not a Registered Domain Name.
Valid Certificate: A Certificate that passes the validation procedure specified in RFC 5280.
Validation Specialists: Someone who performs the information verification duties specified by these
Requirements.
Validity Period: The period of time measured from the date when the Certificate is issued until the Expiry
Date.
WHOIS: Information retrieved directly from the Domain Name Registrar or registry operator via theprotocol defined in RFC 3912, the Registry Data Access Protocol defined in RFC 7482, or an HTTPS website.
Wildcard Certificate: A Certificate containing an asterisk (*) in the left-most position of any of the Subject
Fully-Qualified Domain Names contained in the Certificate.
Wildcard Domain Name: A Domain Name consisting of a single asterisk character followed by a single fullstop character ("*.") followed by a Fully-Qualified Domain Name.

1.6.2 Acronyms

Acronym
Meaning
AICPA American Institute of Certified Public Accountants
ADN Authorization Domain Name
CA
Certification Authority
CAA
Certification Authority Authorization
ccTLD Country Code Top-Level Domain
CICA Canadian Institute of Chartered AccountantsCP
Certificate Policy
CPS
Certification Practice Statement
CRL
Certificate Revocation List
DBA
Doing Business As
DNS
Domain Name System
FIPS(US Government) Federal Information Processing Standard
FQDN Fully Qualified Domain Name
IM
Instant Messaging
IANA Internet Assigned Numbers Authority
ICANN Internet Corporation for Assigned Names and Numbers
ISO
International Organization for Standardization
21

NIST (US Government) National Institute of Standards and Technology
OCSP Online Certificate Status Protocol
OID
Object Identifier
PKI
Public Key Infrastructure
RA
Registration Authority
S/MIME
Secure MIME (Multipurpose Internet Mail Extensions)
SSL
Secure Sockets Layer
TLS
Transport Layer Security
VoIP Voice Over Internet Protocol

2 PUBLICATION AND REPOSITORY RESPONSIBILITIES
2.1 Repositories

Amazon makes its root certificates, revocation data for issued digital certificates, CPs, CPSs, and standard
Subscriber Agreements available in public repositories. All updates, amendments and legal promotions arelogged in accordance with the logging procedures referenced in section 5.4 of this CPS. Amazon’s legal
repository is located at https://www.amazontrust.com/repository. Amazon publicly trusted root
certificates and its CRLs and OCSP responses are available through online resources 24 hours a day, 7 daysa week with systems that are designed to minimize downtime.
Amazon publishes all Subordinate CA Certificates which are not Technically Constrained Subordinate CA
Certificate and all Cross Certificates it issues. For each such certificate, Amazon includes the certificate, alink to CPS for the subject of the certificate, and a link to the public attestation of operations of the CA in
the Amazon repository located at https://www.amazontrust.com/repository.

2.2 Publication of certification information

The Amazon certificate services and the repository are on the web at https://www.amazontrust.com/
repository (and via URIs included in the certificates themselves).
Links to test Web Pages demonstrating valid, revoked, and expired certificates are included in therepository.

2.3 Time or frequency of publication

CA certificates are published in a repository as soon as possible after issuance. CRLs are published inaccordance with §4.9.7
Amazon may publish new CRLs prior to the scheduled issuance of the next CRL. New or modified versionsof the CP, this CPS, Subscriber Agreements, or Relying Party representations and warranties (as describedin§9.6.4) are typically published within seven days after their approval.

2.4 Access controls on repositories

Read only access to the repository is unrestricted. Logical and physical controls prevent unauthorized write
access to repositories.

3 IDENTIFICATION AND AUTHENTICATION
3.1 Naming
3.1.1 Types of names

Certificates are issued with distinguished names and subject alternative names that comply with the CP.
223.1.2 Need for names to be meaningful

Amazon uses distinguished names that identify both the entity (i.e. person, organization, device, or object)that is the subject of the certificate and the entity that is the issuer of the certificate.

3.1.3 Anonymity or pseudonymity of subscribers

The subscriber is not identified in certificates that do not contain organizationName, surname, or
givenName. Relying parties should treat the subscriber as anonymous.

3.1.4 Rules for interpreting various name forms

Distinguished Names in certificates are interpreted using X.500 standards and ASN.1 syntax. See RFC 2253
and RFC 2616 for further information on how X.500 distinguished names in certificates are interpreted as
Uniform Resource Identifiers and HTTP references.
Certificates do not assert any specific relationship between the subscriber and registrant(s) of DNS name(s)contained in certificates.

3.1.5 Uniqueness of names

The uniqueness of each subject name in a Certificate is enforced by inclusion of the domain name in theCertificate. Domain name uniqueness is controlled by the Internet Corporation for Assigned Names andNumbers (ICANN). Name uniqueness is not violated when multiple certificates are issued to the same
entity.

3.1.6 Recognition, authentication, and role of trademarks

Subscribers may not request certificates with content that infringes on the intellectual property rights ofanother entity. Unless otherwise specifically stated in this CPS, Amazon does not verify an Applicant’s rightto use a trademark and does not resolve trademark disputes. Amazon may reject any application or requirerevocation of any certificate that is part of a trademark dispute.

3.2 Initial identity validation

Amazon may use any legal means of communication or investigation to ascertain the identity of anorganizational or individual Applicant. Amazon may refuse to issue a Certificate at its sole discretion.
For EV Certificates, Amazon takes all verification steps reasonably necessary to satisfy the EV Verification
Requirements set forth in the EV Guidelines.
For EV Code Signing Certificates, Amazon takes all verification steps reasonably necessary to satisfy the EV
Verification Requirements set forth in the EV Code Signing Guidelines.

3.2.1 Method to prove possession of private key

Amazon verifies a digital signature on a signed object containing the matching public key to confirm
possession of the private key. The signed object is normally a PKCS#10 certification request, but may be inother formats.

3.2.2 Authentication of Organization and Domain Identity

Amazon follows the Amazon CP for validation of domain authorization or control.
Amazon does not use methods found at 3.2.2.4.6, 3.2.2.4.8, 3.2.2.4.9, and 3.2.2.4.10 in the Amazon CP for
validating wildcard names.
Amazon confirms the Applicant has control of or right to use Email Addresses by contacting the requested
email address and confirming authorization of the Certificate’s issuance.

233.2.3 Authentication of individual identity

Amazon follows the Amazon CP for authentication of individual identification.

3.2.4 Non-verified subscriber information

All subscriber information required by the chosen certificate type is verified.

3.2.5 Validation of authority

Amazon follows the Amazon CP for validation of authority.
Amazon allows an Applicant to specify the individuals who may request Certificates. If an Applicant
specifies, in writing, the individuals who may request a Certificate, then Amazon will not accept any
certificate requests that are outside this specification. A request to limit authorized individuals is noteffective until approved by Amazon. Amazon will provide an Applicant with a list of its authorizedcertificate requesters upon the Applicant’s verified written request.

3.2.6 Criteria for interoperation

Amazon discloses cross certificates by placing copies of the cross certificate in the Repository.

3.3 Identification and authentication for re-key requests

Amazon does not rekey certificates without following the same procedures as issuing a new certificate.

3.3.1 Identification and authentication for routine re-key
As per §3.2.

3.3.2 Identification and authentication for re-key after revocation
As per §3.2.

3.4 Identification and authentication for revocation request

Amazon or an RA authenticates all revocation requests that are at the Subscriber’s request. Amazon may
authenticate revocation requests by referencing the Certificate’s Public Key, regardless of whether the
associated Private Key is compromised.
When the revocation is at the CA’s request, such as for cause in accordance with §4.9, identification andauthentication is not required.

4 CERTIFICATE LIFE-CYCLE OPERATIONAL REQUIREMENTS
4.1 Certificate Application
4.1.1 Who can submit a certificate application

Any Applicant or an authorized Certificate Requester that is a customer of either (1) Amazon Web Servicesor (2) an authorized reseller of Amazon Web Services offerings, may submit certificate requests. Applicants
are responsible for the accuracy of any data submitted.
Amazon shall only issue EV SSL and EV Code Signing Certificates to Applicants which meet therequirements specified in the CA/Browser Forum's EV SSL and EV Code Signing Guidelines respectively, in
addition to the requirements of this CP/CPS.

4.1.2 Enrollment process and responsibilities

In no particular order, the enrollment process includes:••

Submitting a certificate application,
Generating a key pair,
24

•
•
•

Delivering the public key of the key pair to Amazon,
Agreeing to the applicable Subscriber Agreement, and,
Paying any applicable fees.

4.2 Certificate application processing
4.2.1 Performing identification and authentication functions

Amazon or an RA (as described in §1.3.2) verifies the application information and other information
specified in the Amazon CP. As part of this verification, Amazon checks the certificate against an internal
database of previously revoked certificates and rejected certificate requests to identify suspicious
certificate requests. If some or all of the documentation used to support an application is in a language
other than English, an Amazon employee, RA, or agent skilled in the language assists in the identification
and authentication.
Amazon Root CAs check CAA records prior to issuing certificates unless either (a) the CA or an Affiliate of
the CA is the DNS Operator (as defined in RFC 7719) of the domain’s DNS or (b) a Certificate Transparency
pre‐certificate was created and logged in at least two public logs, and for which CAA was checked.
We look for amazon.com, amazontrust.com, awstrust.com, or amazonaws.com in CAA records. We also
may accept FQDNs which are subordinate to these names (for example aws.amazon.com)

4.2.2 Approval or rejection of certificate applications

Amazon follows the Amazon CP with respect to new gTLDs.
For Applications for a Subordinate CA where the Subordinate CA will not be controlled by Amazon, Amazon
ensures that all the following are true:
•
•
•
•
•

The APPMA has approved the Subordinate CA
There is a contract in place requiring the Subordinate CA to comply with CA/Browser Forumguidelines
The CA generated and stores its keys on a HSM that meets the requirements in the CP
The CA had the key generation audited by a qualified auditor. This is not required to be a WebTrust
licensed auditor, but the auditor must meet items 1, 3, 6, and 7 of section 8.2 of the CP.
If the Subordinate CA certificate is not technically constrained, then the contract requires theSubordinate CA operator to provide evidence of a WebTrust audit with a period ending not morethan one year prior to application or a WebTrust point in time readiness assessment that occurred
no more than one year prior to application. Additionally, the CA must have WebTrust audits
covering periods no longer than one year in duration where each audit period must immediately
start after the previous period end with no gaps.

Amazon will post links to Subordinate CA certificates, CP, CPS, and audit options (if applicable) in its
repository.

4.2.3 Time to process certificate applications

The time required to process a certificate application shall not exceed the time to approve or reject theapplication.

25

4.3 Certificate issuance
4.3.1 CA actions during certificate issuanceAmazon confirms the source of a certificate request before issuance. Databases and CA processes
occurring during certificate issuance are protected from unauthorized modification. After issuance iscomplete, the certificate is stored in a database and sent to the Subscriber.

4.3.2 Notification to subscriber by the CA of issuance of certificate

Amazon will deliver certificates within a reasonable time after issuance. Generally, Amazon delivers
certificates via email to the email address designated by the Subscriber, via a programmatic method suchas an API, or via download from a website.

4.4 Certificate acceptance
4.4.1 Conduct constituting certificate acceptance

Subscribers are solely responsible for installing the issued certificate on the Subscriber’s computer or
hardware security module. Certificates are considered accepted on the earlier of••

The Subscriber’s use of the certificate,
30 days after the certificate’s issuance.

4.4.2 Publication of the certificate by the CA

Amazon publishes all CA certificates in its repository and publishes end entity certificates by delivering
them to the Subscriber using email or an API.
Subordinate CA certificates are provided to relevant entities as part of the certificate chain.

4.4.3 Notification of certificate issuance by the CA to other entities

RAs may receive notification of a certificate’s issuance if the RA was involved in the issuance process.
Amazon may notify the public of the issuance of a certificate by adding it to one or more publicly accessible
Certificate Transparency (CT) Logs.

4.5

Key pair and certificate usage

4.5.1 Subscriber private key and certificate usage
See Section 9.6.3, provisions 2. and 4.

4.5.2 Relying party public key and certificate usage

Relying Parties may only use software that is compliant with X.509, IETF RFCs, and other applicablestandards. Amazon does not warrant that any third party software will support or enforce the controls andrequirements found herein.
A Relying Party should use discretion when relying on a certificate and should consider the totality of thecircumstances and risk of loss prior to relying on a certificate. If the circumstances indicate that additional
assurances are required, the Relying Party must obtain such assurances before using the certificate. Any
warranties provided by Amazon are only valid if a Relying Party’s reliance was reasonable.
A Relying Party should rely on a digital signature or SSL/TLS handshake only if:
1. The digital signature or SSL/TLS session was created during the operational period of a valid
certificate and can be verified by referencing a valid certificate,
2. The certificate is not revoked and the Relying Party checked the revocation status of the certificate
prior to the certificate’s use by referring to the relevant CRLs or OCSP responses, and3. The certificate is being used for its intended purpose and in accordance with this CPS.
26

Before relying on a time stamp token, a Relying Party must:
1. Verify that the time stamp token has been correctly signed and that the Private Key used to sign
the time stamp token has not been compromised prior to the time of the verification,
2. Take into account any limitations on the usage of the time stamp token indicated by the timestamp policy, and
3. Take into account any other precautions prescribed in this CPS or elsewhere.

4.6 Certificate renewal

Amazon treats all certificate renewal requests as applications for certificate issuance and follows the sameprocedures used when issuing a certificate.

4.6.1 Circumstance for certificate renewal
No stipulation.

4.6.2 Who may request renewal
See §4.1.1.

4.6.3 Processing certificate renewal requests
See §4.2.

4.6.4 Notification of new certificate issuance to subscriber
See §4.3.2.

4.6.5 Conduct constituting acceptance of a renewal certificate
See §4.4.1.

4.6.6 Publication of the renewal certificate by the CA
See §4.4.2.

4.6.7 Notification of certificate issuance by the CA to other entities
See §4.4.3.

4.7 Certificate re-key
4.7.1 Circumstance for certificate re-key

Amazon treats all certificate re-key requests as applications for certificate issuance and follows the sameprocedures used when issuing a certificate.

4.7.2 Who may request certification of a new public key
See §4.1.1.

4.7.3 Processing certificate re-keying requests
See §4.2.

4.7.4 Notification of new certificate issuance to subscriber
See §4.3.2.

4.7.5 Conduct constituting acceptance of a re-keyed certificate
See §4.4.1.

4.7.6 Publication of the re-keyed certificate by the CA
See §4.4.2.

4.7.7 Notification of certificate issuance by the CA to other entities
See §4.4.3.

27

4.8 Certificate modification
4.8.1 Circumstance for certificate modification

Amazon treats all certificate modification requests as applications for certificate issuance and follows thesame procedures used when issuing a certificate.

4.8.2 Who may request certificate modificationSee §4.1.1.

4.8.3 Processing certificate modification requests
See §4.2.

4.8.4 Notification of new certificate issuance to subscriber
See §4.3.2.

4.8.5 Conduct constituting acceptance of modified certificate
See §4.4.1.

4.8.6 Publication of the modified certificate by the CA
See §4.4.2.

4.8.7 Notification of certificate issuance by the CA to other entities
See §4.4.3.

4.9 Certificate revocation and suspension

Revocation of a certificate permanently ends the operational period of the certificate prior to thecertificate reaching the end of its stated validity period. Amazon supports Certificate Revocation.
Certificate suspension is not used.

4.9.1 Circumstances for revocation

Amazon will revoke a certificate if the revocation request was made by either the organization or individualthat made the certificate application or by an entity with the legal jurisdiction and authority to request
revocation.
Amazon will follow the Amazon CP and revoke a certificate in accordance with §4.9.1.1 and §4.9.1.2 of the
Amazon CP.

4.9.2 Who can request revocation

Any appropriately authorized party, such as a recognized representative of a Subscriber or cross-signed
partner, may request revocation of a certificate. Amazon may revoke a certificate without receiving arequest and without reason. Third parties may request certificate revocation for problems related to fraud,misuse, compromise, or non-compliance with the CP or CPS. Certificate revocation requests must identify
the entity requesting revocation and specify the reason for revocation.

4.9.3 Procedure for revocation request

Amazon processes a revocation request as follows:
1. Amazon logs the identity of entity making the request or problem report and the reason forrequesting revocation. Amazon may also include its own reasons for revocation in the log.
2. Amazon may request confirmation of the revocation from a known administrator, whereapplicable, via out of band communication (e.g., telephone, fax, etc.).
3. If the request is authenticated as originating from the Subscriber, Amazon revokes the certificate.
28

4. For requests from third parties, Amazon personnel begin investigating the request within 24 hours
after receipt and decide whether revocation is appropriate based on the following criteria:
a. The nature of the alleged problem,b. The number of reports received about a particular certificate or website,c. The identity of the complainants (for example, complaints from a law enforcement official
that a web site is engaged in illegal activities have more weight than a complaint from a
consumer alleging they never received the goods they ordered), andd. Relevant legislation.
5. If Amazon determines that revocation is appropriate; Amazon personnel revoke the certificate andupdate the CRL.
Amazon maintains a continuous 24/7 ability to internally respond to any high priority revocation requests.
If appropriate, Amazon forwards complaints to law enforcement.
Instructions for requesting revocation are linked from the Repository.

4.9.4 Revocation request grace period

Subscribers are required to request revocation within one day after detecting the loss or compromise of
the Private Key. Amazon may grant and extend revocation grace period on a case-by-case basis.

4.9.5 Time within which CA must process the revocation request

Amazon will revoke a CA certificate within one hour after receiving clear instructions from the APPMA.
Other certificates are revoked as quickly as practical after validating the revocation request, generally
within the following time frames:
1. Certificate revocation requests for publicly trusted certificates are processed within 18 hours after
their receipt,
2. Revocation requests received two or more hours before CRL issuance are processed before thenext CRL is published, and
3. Revocation requests received within two hours of CRL issuance are processed before the following
CRL is published.

4.9.6 Revocation checking requirement for relying parties

Prior to relying on information listed in a certificate, a Relying Party must confirm the validity of eachcertificate in the certificate path in accordance with IETF PKIX standards, including checking for certificate
validity, issuer to subject name chaining, policy and key use constraints, and revocation status throughCRLs or OCSP responders identified in each certificate in the chain.

4.9.7 CRL issuance frequency (if applicable)

Amazon will update and reissue CRLs with a frequency greater than or equal to that required by the
Amazon CP.

4.9.8 Maximum latency for CRLs (if applicable)

CRLs for certificates issued to end entity Subscribers are posted automatically to the online repository
within a commercially reasonable time after generation. Regularly scheduled CRLs are posted prior to thenext Update field in the previously issued CRL of the same scope.
OCSP responses are provided within a commercially reasonable time and no later than ten seconds after
the request is received, under normal operating conditions.

4.9.9 On-line revocation/status checking availability

Amazon makes certificate status information available via OCSP for all certificates it issues.
294.9.10 On-line revocation checking requirements

A relying party must confirm the validity of a certificate prior to relying on the certificate. Amazon OCSP
responders comply with the requirements of the Amazon CP.

4.9.11 Other forms of revocation advertisements available
Amazon allows, but does not require, OCSP stapling.

4.9.12 Special requirements re key compromise
See Section 4.9.1.

4.9.13 Circumstances for suspension
Amazon does not suspend certificates.

4.9.14 Who can request suspension
Not applicable.

4.9.15 Procedure for suspension request
Not applicable.

4.9.16 Limits on suspension period
Not applicable.

4.10 Certificate status services
4.10.1 Operational characteristics

Certificate status information is available via CRL and OCSP responder. The serial number of a revokedcertificate remains on the CRL until one additional CRL is published after the end of the certificate’s validity
period, except for revoked Code Signing Certificates and EV Code Signing Certificates, which remain on the
CRL for at least 365 days following the certificate’s validity period. OCSP information for Subscriber
certificates is updated at least every four days. OCSP information for subordinate CA certificates is updated
at least every 12 months and within 24 hours after revoking the certificate.

4.10.2 Service availability

Certificate status services are designed to be available 24x7.

4.10.3 Optional features
Not applicable.

4.11 End of subscription

A Subscriber’s subscription service ends if its certificate expires or is revoked or if the applicable Subscriber
Agreement expires without renewal.

4.12 Key escrow and recovery

Amazon does not escrow private keys.

4.12.1 Key escrow and recovery policy and practices
Not applicable.

4.12.2 Session key encapsulation and recovery policy and practices
Not applicable.

30

5 FACILITY, MANAGEMENT, AND OPERATIONAL CONTROLS
5.1 Physical controls
5.1.1 Site location and construction

Certificate Manufacturing Facilities are located in the United States. Private keys for all CAs following thisCPS are exclusively located in the United States unless otherwise stated in the Repository. Physical barriers,
including solid walls that extend from real floor to real ceiling are in place to prevent unauthorized entry to
Certificate Manufacturing Facilities.

5.1.2 Physical accessPhysical access to Amazon PKI facilities is restricted to authorized Amazon employees, vendors, andcontractors who require access to execute their jobs. Amazon uses multi-factor authentication
mechanisms for access control as well as additional security mechanisms designed to ensure that only
authorized individuals enter PKI facilities. Amazon enforces two-person access for all access to CA systems.

5.1.3 Power and air conditioning

Heating, ventilation, and air conditioning systems are designed to maintain environmental specifications
provided system vendors.

5.1.4 Water exposures

Amazon’s facilities are designed to protect CA systems from water exposure.

5.1.5 Fire prevention and protection

Amazon’s facilities are designed to provide fire suppression for the CA.

5.1.6 Media storage

Amazon’s facilities and processes are designed to protect media from accidental damage and authorized
physical access.

5.1.7 Waste disposal

Storage media containing sensitive data is physically destroyed or securely overwritten prior to disposal orreuse. Printed documents containing sensitive data needing disposal are stored in locked shred bins which
are periodically collected and destroyed by a data destruction company.

5.1.8 Oﬀ-site backup

Amazon maintains copies of CA private keys and activation data at multiple locations for redundancy. All
copies are stored in a system or device validated as meeting FIPS 140 Level 3 to ensure that they are only
accessible by trusted personnel.

5.2 Procedural controls
5.2.1 Trusted roles

Personnel acting in trusted roles include CA, TSA, and RA system administration personnel, and personnel
involved with identity vetting and the issuance and revocation of certificates. The functions and duties
performed by persons in trusted roles are distributed so that one person alone cannot circumvent security
measures or subvert the security and trustworthiness of the PKI or TSA operations. All personnel in trusted
roles must be free from conflicts of interest that might prejudice the impartiality of the Amazon PKI’s
operations. A list of personnel appointed to trusted roles is maintained and reviewed annually.
PKI Executive

31

The Executive is responsible for overseeing all activities in the Amazon PKI, including appointmentof persons to all other roles. The PKI Executive is a member of the PKI Policy Management
Authority but cannot function in any other Trusted Role.
PKI Policy Management Authority Member
The APPMA is responsible for approving this CPS and certain other documents related to CAs in the
Amazon PKI. The APPMA approves the generation, revocation and suspension of CA certificates.
APPMA members cannot serve in any other Trusted Role (except for PKI Executive).
PKI Managers
Amazon PKI Managers are responsible for PKI Operations and CA documents, including theCertificate Policy, Certification Practice Statement, and this document. The PKI Manager cannot
serve as a PKI Security Officer.
PKI Security Officer
PKI Security Officers have a combination to the safe and/or PINs for the PED keys necessary to use
the HSMs.
PKI Engineers
PKI Engineers are responsible for CA systems development and operations.
Validation Specialists
Validation Specialists are responsible for the collection and review of information in support of acertificate application. Validation Specialists look for discrepancies or other details requiring
further explanation in the application and supporting information.
Internal Auditor
Internal Auditors are responsible for overseeing internal compliance to determine if Amazon, an
Issuer CA, or RA is operating in accordance with this CPS or an RA Practices Statement. This may
include acting as Witness to ceremonies or holding credential or key required to initiate aceremony.

5.2.2 Number of persons required per task

Amazon ensures that at least three people are required for CA key generation, CA signing key activation,
and CA private key backup.

5.2.3 Identification and authentication for each role

All personnel are required to authenticate themselves to CA and supporting systems before they areallowed access to systems necessary to perform their trusted roles.

5.2.4 Roles requiring separation of duties

The PKI Executive may not concurrently serve as Internal Auditor, PKI Engineer, or Validation Specialist.
Persons serving as Internal Auditors may not hold any other trusted role. Persons serving as members of
the PMA may not serve as PKI Engineer or Validation Specialist.
For the issuance of Extended Validation certificates, the same person may not serve as both System
Operator and Verification Operator.

32

5.3 Personnel controls
5.3.1 Qualifications, experience, and clearance requirements

The APPMA is responsible and accountable for Amazon PKI operations and ensures compliance with thisCPS and the CP. Amazon personnel and management practices provide reasonable assurance of thetrustworthiness and competence of its employees and of the satisfactory performance of their duties.
Management and operational support personnel involved in time stamp operations possess experience
with information security and risk assessment and knowledge of time stamping technology, digital
signature technology, mechanisms for calibration of time stamping clocks with UTC, and security
procedures. The APPMA ensures that all individuals assigned to trusted roles have the experience,
qualifications, and trustworthiness required to perform their duties under this CPS.

5.3.2 Background check procedures

Amazon verifies the identity of each employee appointed to a trusted role and performs a backgroundcheck prior to allowing such person to act in a trusted role. Amazon requires each individual to appear inperson before a human resources employee whose responsibility it is to verify identity. The humanresources employee verifies the individual’s identity using government issued photo identification (e.g.,
passports and/ or driver’s licenses reviewed pursuant to U.S. Citizenship and Immigration Services Form I 9,
Employment Eligibility Verification, or comparable procedure for the jurisdiction in which the individual’s
identity is being verified). Background checks include employment history, education, character references,
social security number, previous residences, driving records and criminal background. Checks of previous
residences are over the past three years. All other checks are for the previous five years. The highest
education degree obtained is verified regardless of the date awarded. Background checks are refreshed atleast every ten years.

5.3.3 Training requirements

Amazon provides suitable training to all staff before they take on a Trusted Role should they not alreadyhave the complete skill-set required for that role.
Training of personnel is undertaken via a mentoring process involving senior members of the team towhich they are attached.
Validation Specialists are trained in Amazon’s validation and verification policies and procedures.

5.3.4 Retraining frequency and requirements

Personnel in Trusted Roles have additional training when changes in industry standards or changes inAmazon’s operations require it.
Amazon provides refresher training and informational updates sufficient to ensure that Trusted Personnel
retain the requisite degree of expertise.

5.3.5 Job rotation frequency and sequence
No applicable.

5.3.6 Sanctions for unauthorized actions

Amazon employees and agents failing to comply with this CPS, whether through negligence or malicious
intent, are subject to administrative or disciplinary actions, including termination of employment or agency
and criminal sanctions. If a person in a trusted role is cited by management for unauthorized orinappropriate actions, the person will be immediately removed from the trusted role pending management
review. After management has reviewed and discussed the incident with the employee involved,
33

management may reassign that employee to a non-trusted role or dismiss the individual from employment
as appropriate.

5.3.7 Independent contractor requirements

Independent contractors who are assigned to perform trusted roles are subject to the duties andrequirements specified for such roles as specified in 5.3 Personnel controls and are subject to sanctions
specified in 5.3.6 Sanctions for Unauthorized Actions.

5.3.8 Documentation supplied to personnel

Personnel in trusted roles are provided with the documentation necessary to perform their duties,
including a copy of the CP, this CPS, EV Guidelines, and other technical and operational documentationneeded to maintain the integrity of Amazon CA operations.

5.4 Audit logging procedures
5.4.1 Types of events recorded

Audit log files are generated for all events relating to the security and services of the CA. Where possible,
the security audit logs are automatically generated. Where this is not possible, a logbook, paper form, orother physical mechanism are used. All security audit logs, both electronic and non-electronic, shall be
retained and made available during compliance audits.
Amazon ensures all events relating to the lifecycle of Certificates are logged in a manner to ensure thetraceability to a person in a trusted role for any action required for CA services. At a minimum, each audit
record includes the following (either recorded automatically or manually) elements:
•
•
•
•
•
•

the type of event;the date and time the event occurred;
success or failure where appropriate;
the identity of the entity and/or operator that caused the event;the identity to which the event was targeted; andthe cause of the event.

5.4.2 Frequency of processing log and archiving audit logs

Logs are archived by the system administrator within 7 days of event activity. CA management reviews logs
in the audit log repository as needed.

5.4.3 Retention period for audit logs

Audit logs are retained for at least seven years and will be made available to the Amazon external
independent auditor upon request.

5.4.4 Protection of audit log

Production and archived logical and physical audit logs are protected using a combination of physical andlogical access controls.

5.4.5 Audit log backup procedures

Amazon makes regular backup copies of audit logs and audit log summaries and sends a copy of the audit
log off-site on a monthly basis.

5.4.6 Audit log accumulation system (internal vs. external)

Automatic audit data is generated and recorded at the application, network, and operating system level. If
an automated audit system fails and the integrity of the system or confidentiality of the information34

protected by the system is at risk, Amazon Administrators will consider suspending its operation until the
problem is remedied. Manually generated audit data is recorded by authorized Amazon personnel.

5.4.7 Notification to event-causing subject

Events that are deemed potential security issues involving the Certificate Authority infrastructure will beescalated to a internal security monitoring team.

5.4.8 Vulnerability assessments

Amazon performs a vulnerability scan at least once a quarter on Certificate System IP addresses. Amazon
will perform a vulnerability scan after any system or network changes that Amazon determines are
significant and within one week of receiving a request from the CA/Browser Forum. Amazon will undergo a
Penetration Test on Certificate Systems on at least an annual basis and after infrastructure or application
upgrades that Amazon determines are significant.
Amazon records will be maintained in a manner reasonably sufficient to demonstrate that each
Vulnerability Scan and Penetration Test was performed by a person or entity with the skills, tools,
proficiency, code of ethics, and independence necessary to provide a reliable Vulnerability Scan or
Penetration Test.

5.5 Records archival

Amazon complies with all record retention policies that apply by law. Amazon includes reasonably
sufficient detail in its archived records to show that a certificate or time-stamp token was issued inaccordance with this CPS.

5.5.1 Types of records archived

Amazon backs up both application and system data. Amazon may archive the following information:••••

audit data, as specified in section 5.4 of this CPS;
certificate application information;
documentation supporting a Certificate application; andcertificate lifecycle information.

5.5.2 Retention period for archive

Amazon retains the records of Amazon digital certificates and the associated documentation for a term of
not less than 7 years, or as necessary to comply with applicable laws.

5.5.3 Protection of archive

Archive records are stored at a secure off-site location and are maintained in a manner that prevents
unauthorized modification, substitution, or destruction. Archives are not released except as allowed by the
APPMA or as required by law. Amazon maintains any software application required to process the archive
data until the data is either destroyed or transferred to a newer medium.
If Amazon needs to transfer any media to a different archive site or equipment, Amazon will maintain botharchived locations and/or pieces of equipment until the transfer are complete. All transfers to new archives
will occur in a secure manner.

5.5.4 Archive backup procedures

Amazon maintains backup copies of its archived records at a location distinct from either Certificate
Manufacturing Facility.

35

5.5.5 Requirements for time-stamping of records

Amazon time-stamps archived records with system time (non-cryptographic method) as they are created.
Online systems are synchronized with a third party time source using automated means. Air-gappedsystems have their time manually set. Manual journal entries have a manually entered date and time.

5.5.6 Archive collection system (internal or external)
Archive information is collected internally by Amazon.

5.5.7 Procedures to obtain and verify archive information

Amazon's primary and backup archives shall only be accessible by authorized Amazon personnel.
Amazon shall not release archives in their entirety, except as required by law.
Amazon may require compensation and fees for any costs incurred in accessing or retrieving any requested
archival data.

5.6 Key changeover

Key changeover procedures enable the smooth transition from expiring CA certificates to new CA
certificates. Towards the end of a CA Private Key’s lifetime, Amazon ceases using the expiring CA Private
Key to sign certificates and uses the expiring Private Key only to sign CRLs and OCSP responder certificates.
A new CA signing key pair is commissioned and all subsequently issued certificates and CRLs are signedwith the new private signing key. Both the old and the new key pairs may be concurrently active. This key
changeover process helps minimize any adverse effects from CA certificate expiration. The corresponding
new CA Public Key certificate is provided to Subscribers and Relying Parties through the delivery methods
detailed in 6.1.4 CA Public Key Delivery to Relying Parties. Where Amazon has cross-certified another CAthat is in the process of a key rollover, Amazon obtains a new CA Public Key or new CA certificate from theother CA and distributes a new CA cross certificate following the procedures described above.

5.7 Compromise and disaster recovery
5.7.1 Incident and compromise handling procedures

Amazon maintains incident response procedures to guide personnel in response to security incidents,
natural disasters, and similar events that may give rise to system compromise. Amazon reviews, tests, andupdates its incident response plans and procedures on at least an annual basis.

5.7.2 Computing resources, software, and/or data are corrupted

If Amazon discovers that any of its computing resources, software, or data operations have been
compromised, Amazon assesses the threats and risks that the compromise presents to the integrity or
security of its operations or those of affected parties. If Amazon determines that a continued operation
could pose a significant risk to Relying Parties or Subscribers, Amazon suspends such operation until it
determines that the risk is mitigated.

5.7.3 Entity private key compromise procedures

In the event a CA Private Key is Compromised, lost, destroyed or suspected to be Compromised, Amazon
will, after investigation of the problem, decide if the CA Certificate should be revoked. If so, then all the
Subscribers who have currently unrevoked unexpired certificates will be notified at the earliest feasible
opportunity. A new CA Key Pair will be generated or an alternative existing CA hierarchy will be used tocreate new Subscriber Certificates.
If Root CA private keys compromised, Amazon will inform browser vendors of the compromise and best
estimate of the date of compromise.
36

5.7.4 Business continuity capabilities after a disaster

Amazon systems are redundantly configured at its primary facility and are mirrored at a separate,
geographically diverse location for failover in the event of a disaster. If a disaster causes Amazon PKI
operations to become inoperative at one site, Amazon will re-initiate its operations at its alternative site.

5.8 CA or RA termination

Before terminating its CA or TSA activities, Amazon will:
1. Provide notice and information about the termination by sending notice by email to its customers
with unrevoked unexpired certificates, Application Software Vendors, and any cross certifying
entities and by posting such information on Amazon web site; and2. Transfer all responsibilities to a qualified successor entity.
If a qualified successor entity does not exist, Amazon will:
1. Transfer those functions capable of being transferred to a reliable third party and arrange topreserve all relevant records with a reliable third party or a government, regulatory, or legal bodywith appropriate authority;
2. Revoke all certificates that are still un revoked or un expired on a date as specified in the noticeand publish final CRLs;
3. Destroy all Private Keys; and4. Make other necessary arrangements that are in accordance with this CPS.

6 TECHNICAL SECURITY CONTROLS
6.1 Key pair generation and installation
6.1.1 Key pair generation

Amazon CA key pairs are generated on hardware that meets the requirements of §6.2.1. They are
generated during a ceremony that meets requirements of the Amazon CP.
Subscriber key pairs are generated by the Subscriber.

6.1.2 Private key delivery to subscriber

Amazon does not generate keys for Subscribers and does not distribute Integrated Circuit Cards tosubscribers

6.1.3 Public key delivery to certificate issuer

Subscribers generate key pairs and submit the Public Key to Amazon in a CSR as part of the certificate
request process. The Subscriber’s signature on the request is authenticated prior to issuing the certificate.

6.1.4 CA public key delivery to relying parties

Amazon Public Keys are provided to Relying Parties as trust anchors in commercial browsers and operating
system root stores and/or as roots signed by other CAs. All accreditation authorities supporting Amazon
certificates and all application software providers are permitted to redistribute Amazon root anchors.
Amazon may also distribute Public Keys that are part of an updated signature-Key Pair as a self-signed
certificate, as a new CA certificate, or in a key roll over certificate. Relying Parties may obtain Amazon selfsigned CA certificates from the Amazon web site.

6.1.5 Key sizes

Amazon CAs use RSA and elliptic curve keys. All RSA keys are 2048-bits or larger and all elliptic curve keys
are on one of three NIST curves (P-256, P-384, or P-521).
37

6.1.6 Public key parameters generation and quality checking

Amazon uses a HSM device that conforms to FIPS 186 2 and provides random number generation and onboard generation of up to 4096 bit RSA Public Keys and a wide range of ECC curves.

6.1.7 Key usage purposes (as per X.509 v3 key usage field)

Amazon includes Key Usage and Extended Key Usage fields in certificates as defined in the certificate
profile.

6.2 Private Key Protection and Cryptographic Module Engineering Controls
6.2.1 Cryptographic module standards and controls

Amazon generates and stores all Private Keys used for certificate signing in cryptographic modules thatmeet at least one of the following:•••

Certified to FIPS 140-1 or 140-2, Level 3 (or higher)
Certified to ISO/IEC 19790, Level 3 (or higher)
Certified to EAL4 (or higher) of the CWA 14169 or EN 14169 Protection Profile under the Common
Criteria (ISO/IEC 15408) framework

Subscribers must store Private Keys used for Extended Validation Code Signing and Augmented Clientcertificates in cryptographic modules that meet at least one of the following:••••

Certified to FIPS 140-1 or 140-2, Level 2 or higher
Certified to ISO/IEC 19790, Level 2 or higher
Certified to EAL4 of the CWA 14169 or EN 14169 Protection Profile under the Common Criteria(ISO/IEC 15408) framework; orCertified as a Secure Signature Creation Device (SSCD) by an EU government entity

6.2.2 Private key (n out of m) multi-person control

Amazon authentication mechanisms are protected securely when not in use and may only be accessed byactions of multiple trusted persons.
Backups of CA Private Keys are securely stored off site and require at least two-person access. Re activationof a backed up CA Private Key (unwrapping) requires the same security and multi person control as when
performing other sensitive CA Private Key operations.

6.2.3 Private key escrow

Amazon does not escrow its signature keys and does not provide Subscriber key escrow.

6.2.4 Private key backup

If required for business continuity, Amazon backs up Private Keys under the same multi-person control as
the original keys.

6.2.5 Private key archival

Amazon does not archive private keys.

6.2.6 Private key transfer into or from a cryptographic module

All keys must be generated by and in a cryptographic module. Private Keys are exported from thecryptographic module only for backup purposes. The Private Keys are encrypted when transferred out of
the module and never exist in plaintext form.

38

6.2.7 Private key storage on cryptographic module

Amazon Private Keys are generated and stored inside cryptographic modules which meet the requirementsof §6.2.1.

6.2.8 Method of activating private key

Amazon Private Keys are activated according to the specifications of the cryptographic module
manufacturer. Activation data entry is protected from disclosure. Subscribers are solely responsible forprotecting their Private Keys. Subscribers should use a strong password or equivalent authentication
method to prevent unauthorized access or use of the Subscriber’s Private Key.

6.2.9 Method of deactivating private key

Amazon Private Keys are deactivated via logout procedures on the applicable HSM device when not in use.
Root Private Keys are further deactivated by removing them entirely from the storage partition on the HSM
device. Amazon never leaves its HSM devices in an active unlocked or unattended state.

6.2.10 Method of destroying private key

Amazon personnel, acting in trusted roles, destroy CA, RA, and status server Private Keys when no longer
needed. Amazon may destroy a Private Key by deleting it from all known storage partitions. Amazon also
zeroizes the HSM device and associated backup tokens according to the specifications of the hardware
manufacturer. If the zeroization or re initialization procedure fails, Amazon will crush, shred, and/orincinerate the device in a manner that destroys the ability to extract any Private Key.

6.2.11 Cryptographic Module RatingSee §6.2.1.

6.3 Other aspects of key pair management
6.3.1 Public key archival

Amazon archives copies of Public Keys as specified in §5.5.

6.3.2 Certificate operational periods and key pair usage periods

The lifetime of Amazon’s Root CA certificates is as set out in section 1.1. Key pairs in Amazon root
certificates have the same term as the certificate validity period. Certificates signed by the CA have avalidity period that terminates on or before the end of the validity period of the CA.
Subscriber certificates are issued for a period no greater than defined in the Amazon CP.

6.4 Activation data
6.4.1 Activation data generation and installation

Generation and use of CA activation data used to activate CA Private Keys are made during a key
ceremony. Activation data is either generated automatically by the appropriate HSM or in such a way thatmeets the same needs. It is then delivered to a holder of a share of the key who is a person in a trusted
role. The delivery method maintains the confidentiality and the integrity of the activation data.

6.4.2 Activation data protection

CA activation data is protected from disclosure through a combination of cryptographic and physical access
control mechanisms.

6.4.3 Other aspects of activation data
Not applicable.

396.5 Computer security controls
6.5.1 Specific computer security technical requirements

Amazon PKI systems maintaining CA software and data files are secure from unauthorized accessAmazon enforces multi-factor authentication for all accounts capable of directly causing certificate
issuance.

6.5.2 Computer security rating

Amazon has established a security framework which covers and governs the technical aspects of its
computer security.

6.6 Life cycle technical controls
6.6.1 System development controls

Amazon has mechanisms in place to control and monitor the acquisition and development of its CA
systems. Change requests require the approval of at least one administrator who is different from theperson submitting the request. Amazon only installs software on CA systems if the software is part of the
CA’s operation. CA hardware and software are dedicated to performing operations of the CA.
Vendors are selected based on their reputation in the market, ability to deliver quality product, andlikelihood of remaining viable in the future. Management is involved in the vendor selection and purchasedecision process. Non-PKI hardware and software is usually purchased without identifying the purpose forwhich the component will be used. All hardware and software are shipped under standard conditions toensure delivery of the component directly to a trusted employee who ensures that the equipment isinstalled without opportunity for tampering.
Some of the PKI software components used by Amazon are developed in-house or by consultants using
standard software development methodologies. All such software is designed and developed in acontrolled environment and subjected to quality assurance review. Other software is purchasedcommercial off-the- shelf. Quality assurance is maintained throughout the process through testing anddocumentation or by purchasing from trusted vendors as discussed above.
Updates of equipment and software are purchased or developed in the same manner as the original
equipment or software and are installed and tested by trusted and trained personnel. All hardware andsoftware essential to Amazon operations is scanned for malicious code on first use and periodicallythereafter.

6.6.2 Security management controls

Amazon has mechanisms in place to control and monitor the security-related configurations of its CA
systems.

6.6.3 Life cycle security controls
See section 6.5.1

6.7 Network security controls

Amazon has implemented reasonable safeguards and controls to prevent unauthorized access to thevarious systems and devices that comprise the CA infrastructure and to various degrees depending on thesensitivity of the function. Root CA private keys are kept offline and protected by various means.

6.8 Time-stamping
See §5.5.5.

40

7 CERTIFICATE, CRL, AND OCSP PROFILE S

Amazon uses the ITU X.509, version 3 standard to construct digital certificates for use within the Amazon
PKI. Amazon adds certain certificate extensions to the basic certificate structure for the purposes intended
by X.509v3 as per Amendment 1 to ISO/IEC 9594-8, 1995.

7.1 Certificate profile
7.1.1 Version number(s)All certificates are X.509 version 3 certificates.

7.1.2 Certificate extensions

See Amazon Certificate Profiles appendix.

7.1.3 Algorithm object identifiers

See Amazon Certificate Profiles appendix.

7.1.4 Name forms

Each certificate includes a unique positive serial number that is never reused. Optional subfields in thesubject of an SSL Certificate must either contain information verified by Amazon or be left empty. SSL
Certificates cannot contain metadata such as ‘.’, ‘-‘ and ‘ ‘ characters or any other indication that the field is
not applicable. Amazon logically restricts OU fields from containing Subscriber information that has notbeen verified as specified in 3 Identification and Authentication.
The distinguished name for each Certificate type is set forth in Amazon certificate profiles appendix. The
contents of the fields in EV Certificates must meet the requirements in Section 8.1 of the EV Guidelines.

7.1.5 Name constraints

Amazon follows the Amazon CP with regards to Name Constraints.

7.1.6 Certificate policy object identifier

Certificates that are issued under the Amazon PKI and are compliant with the CA/Browser Forum Baseline
Requirements may include the 1.3.187.1 object identifier in their policy list.
Certificates that are issued under the Amazon PKI and are complaint with the CA/Browser Forum Extended
Validation Guidelines may include the 1.3.187.1.1 object identifier in the policy list.

7.1.7 Usage of Policy Constraints extension
Not applicable.

7.1.8 Policy qualifiers syntax and semantics
Not applicable.

7.1.9 Processing semantics for the critical Certificate Policies extension
Not applicable.

7.2 CRL profile
7.2.1 Version number(s)Amazon issues version 2 CRLs.

7.2.2 CRL and CRL entry extensions
Field
CRL Number
Authority Key Identifier

Value
Never repeated monotonically increasing integer
Same as the Authority Key Identifier listed in thecertificate
41Invalidity Date
Reason Code

Optional date in UTC format
Optional reason for revocation

7.3 OCSP profile
7.3.1 Version number(s)Amazon OCSP responders conform to version 1 as defined in RFC 6960. Amazon OCSP responders may
decline to respond to messages that do not comply with RFC 5019. Specifically, Amazon OCSP responders
may not include a nonce in the reply even if a nonce is provided in the request.

7.3.2 OCSP extensions
No stipulations.

8 COMPLIANCE AUDIT AND OTHER ASSESSMENTS

The practices in this CPS are designed to meet or exceed the requirements of generally accepted industry
standards, including the latest version of the EV Guidelines and the AICPA/CICA WebTrust Program for
Certification Authorities, ANS X9.79/ISO 21188 PKI Practices and Policy Framework (“CA WebTrust/ISO
21188”).

8.1 Frequency or circumstances of assessment

The WebTrust for CAs audit mandates that the period during which a CA issues Certificates be divided into
an unbroken sequence of audit periods. An audit period must not exceed one year in duration.

8.2 Identity/qualifications of assessor

Amazon receives an annual audit by an independent external auditor to assess Amazon compliance withthis CPS, any applicable CPs, and the CA WebTrust/ISO 21188 and WebTrust EV Program criteria. The audit
covers Amazon operated RA systems, Sub CAs, and OCSP Responders.
WebTrust auditors must meet the requirements of Section 14.1.14 of the EV Guidelines. Specifically:
1. Qualifications and experience: Auditing must be the auditor’s primary business function. The
individual or at least one member of the audit group must be qualified as a Certified Information
Systems Auditor, an AICPA Certified Information Technology Professional, a Certified Internal
Auditor, or have another recognized information security auditing credential. Auditors must be
subject to disciplinary action by its licensing body.
2. Expertise: The individual or group must be trained and skilled in the auditing of secure information
systems and be familiar with Public Key infrastructures, certification systems, and Internet security
issues.
3. Rules and standards: The auditor must conform to applicable standards, rules, and best practices
promulgated by the American Institute of Certified Public Accountants (AICPA), the Canadian
Institute of Chartered Accountants (CICA), the Institute of Chartered Accountants of England &Wales (ICAEW), the International Accounting Standards adopted by the European Commission(IAS), Information Systems Audit and Control Association (ISACA), the Institute of Internal Auditors(IIA), or another qualified auditing standards body.
4. Reputation: The firm must have a reputation for conducting its auditing business competently andcorrectly.
5. Insurance: EV auditors must maintain Professional Liability/Errors and Omissions Insurance, with
policy limits of at least $1 million in coverage.
428.3 Assessor’s relationship to assessed entity

Amazon’s WebTrust auditor does not have a financial interest, business relationship, or course of dealingthat could foreseeably create a significant bias for or against Amazon.

8.4 Topics covered by assessment

The audit covers Amazon business practices disclosure, the integrity of Amazon PKI operations, andAmazon compliance with the EV Guidelines. The audit verifies that Amazon is compliant with the CP andthis CPS.

8.5 Actions taken as a result of deficiency

If an audit reports a material noncompliance with applicable law, this CPS, the CP, or any other contractual
obligations related to Amazon, then (1) the auditor will document the discrepancy, (2) the auditor willpromptly notify Amazon, and (3) Amazon will develop a plan to cure the noncompliance. Amazon willsubmit the plan to the APPMA for approval and to third parties if required by law. The APPMA may require
additional action if necessary to rectify any significant issues created by the non- compliance, including
requiring revocation of affected certificates.

8.6 Communication of results

The results of each audit are reported to the APPMA, to the public and to any third party entities which areentitled by law, regulation, or agreement to receive a copy of the audit results. On an annual basis, Amazon
submits a report of its audit compliance to various parties, such as Mozilla, Microsoft, CA licensing bodies,etc. Amazon is not required to make publicly available any general audit finding that does not impact theoverall audit opinion.

8.7 Self-Audits

On at least a quarterly basis, Amazon performs regular internal audits against a randomly selected sample
of at least the greater of 1 certificate or three percent of the certificates issued since the last internal audit.
Internal audits on EV Certificates are performed in accordance with section 14.1.2 of the EV Guidelines.

9 OTHER BUSINESS AND LEGAL MATTERS
9.1 Fees
9.1.1 Certificate issuance or renewal fees

Amazon may charge Subscribers for certificate issuance and renewal.

9.1.2 Certificate access fees
Not applicable.

9.1.3 Revocation or status information access fees

Amazon does not charge a certificate revocation fee or a fee for checking the validity status of an issued
certificate using a CRL. Amazon may charge a fee for providing certificate status information via OCSP.

9.1.4 Fees for other services

Amazon does not charge Subscribers for revocation.

9.1.5 Refund policy

Amazon refunds customers for erroneous charges.

439.2 Financial responsibility
9.2.1 Insurance coverage

Amazon maintains insurance or self-insures in accordance with Section 9.2.1 of the CP.

9.2.2 Other assets
Not applicable

9.2.3 Insurance or warranty coverage for end-entities

Amazon maintains insurance or self-insures in accordance with Section 9.2.1 of the CP.

9.3 Confidentiality of business information
9.3.1 Scope of confidential information

The following information is considered confidential information of Amazon and is protected against
disclosure using a reasonable degree of care:
1.
2.
3.
4.
5.

Private Keys;
Activation data used to access Private Keys or to gain access to the CA system;
Business continuity, incident response, contingency, and disaster recovery plans;
Other security practices used to protect the confidentiality, integrity, or availability of information;
Information held by Amazon as private information in accordance with 9.3 Confidentiality ofBusiness Information;
6. Audit logs and archive records; and7. Transaction records, financial audit records, and external or internal audit trail records and any
audit reports (with the exception of an auditor’s letter confirming the effectiveness of the controls
set forth in this CPS).

9.3.2 Information not within the scope of confidential information

Certificates and revocation data are considered public information. Amazon reserves the right to publish a
CRL as may be indicated.

9.3.3 Responsibility to protect confidential information

Amazon employees, agents, and contractors are responsible for protecting confidential information andare bound by Amazon’s policies with respect to the treatment of confidential information or arecontractually obligated to do so. Employees receive training on how to handle confidential information.

9.4 Privacy of personal information
9.4.1 Privacy plan

Amazon follows the Amazon Web Services Privacy Notice posted on the AWS website when handlingpersonal information.

9.4.2 Information treated as private

Amazon treats all personal information about an individual that is not publicly available in the contents of acertificate or CRL as private information. Amazon protects private information using appropriate
safeguards and a reasonable degree of care.

9.4.3 Information not deemed private

Certificates and revocation data are not private information.

44

9.4.4 Responsibility to protect private information

Amazon employees and contractors are subject to policies or contractual obligations requiring such
employees and contractors to comply with the Amazon Privacy Policy or contractual obligations at least as
protective of private information as the Amazon Privacy Policy.

9.4.5 Notice and consent to use private information

Amazon follows the Amazon Web Services Privacy Notice posted on the AWS website when handlingpersonal information.

9.4.6 Disclosure pursuant to judicial or administrative process

Amazon will not disclose Subject private information except as specified on the Amazon Web Services
Privacy Notice posted on the AWS website

9.4.7 Other information disclosure circumstances

Amazon will not disclose Subject private information except as specified on the Amazon Web Services
Privacy Notice posted on the AWS website

9.5 Intellectual property rights

Amazon and/or its affiliates and business partners own the intellectual property rights in Amazon’s
services, including the certificates, trademarks used in providing the services, and this CPS. Certificate andrevocation information are the property of Amazon. Amazon grants permission to reproduce and distributecertificates on a non- exclusive and royalty-free basis, provided that they are reproduced and distributed infull. Private Keys and Public Keys remain the property of the Subscribers who rightfully hold them.

9.6 Representations and warranties
9.6.1 CA representations and warranties

Except as expressly stated in this CPS or in a separate agreement with a Subscriber, Amazon does not makeany representations or warranties regarding its products or services. Amazon represents and warrants, tothe extent specified in this CPS, that:
1. Amazon complies, in all material aspects, with the CP and this CPS,
2. Amazon publishes and updates CRLs and OCSP responses on a regular basis,
3. All certificates issued under this CPS will be verified in accordance with this CPS and meet theminimum requirements found herein and in the Baseline Requirements, and
4. Amazon will maintain a repository of public information on its website.
For EV Certificates, Amazon warrants to Subscribers, Subjects, Application Software Vendors that distribute
Amazon root certificates, and Relying Parties that use an Amazon certificate while the certificate is validthat Amazon followed the EV Guidelines in all material respects when verifying information and issuing EV
Certificates.
This foregoing warranty is limited solely to Amazon compliance with the EV Guidelines (e.g., Amazon may
rely on erroneous information provided in an attorney’s opinion or accountant’s letter that is checked inaccordance with the EV Guidelines).

9.6.2 RA representations and warranties
Each RA represents and warrants that:

1. The RA’s certificate issuance and management services conform to the Amazon CP and this CPS,
2. Information provided by the RA does not contain any false or misleading information,
3. Translations performed by the RA are an accurate translation of the original information, and45

4. All certificates requested by the RA meet the requirements of this CPS.
Amazon’s agreement with the RA may contain additional representations and warranties.

9.6.3 Subscriber representations and warranties

Prior to issuance of a certificate, Amazon confirms that either:
1. the applicant has agreed to the Subscriber Agreement or
2. the applicant is an employee or agent of Amazon or an Affiliate of Amazon
Subscribers represent and warrant that:
1. each digital signature created using the Private Key corresponding to the Public Key listed in thecertificate has been accepted and has not expired or been revoked at the time the digital signatureis created;
2. the Subscriber, or someone explicitly authorized by the Subscriber, have been and remain the only
person(s) in possession of Subscriber’s Private Key and all materials and information protecting
Subscriber’s Private Key, and no unauthorized person has had or will have access to such materials
and information;
3. All material information Subscriber provides to the CA in Subscriber’s certificate application or
related to the issuance of a certificate is accurate, complete and up to date; and4. Subscriber’s certificates is and will be used in compliance with all applicable laws and inaccordance with this CPS, any subscriber agreement between Subscriber and the CA and any
applicable standards, including, without limitation, the EV Guidelines, as an end user and not as a
CA to issue certificates, certificate revocation lists, or otherwise.
The Subscriber Agreement between the Subscriber and Amazon may include additional representations
and warranties.

9.6.4 Relying party representations and warranties

Each Relying Party represents and warrants that, prior to relying on an Amazon certificate, it:
1. Obtained sufficient knowledge on the use of digital certificates and PKI,
2. Studied the applicable limitations on the usage of certificates and agrees to Amazon’s limitations
on its liability related to the use of certificates,
3. Has read, understands, and agrees to this CPS,
4. Verified both the Amazon certificate and the certificates in the certificate chain using the relevant
CRL or OCSP,
5. Will not use an Amazon certificate if the certificate has expired or been revoked, and
6. Will take all reasonable steps to minimize the risk associated with relying on a digital signature,including only relying on an Amazon certificate after considering:a. Applicable law and the legal requirements for identification of a party, protection of theconfidentiality or privacy of information, and enforceability of the transaction;b. The intended use of the certificate as listed in the certificate or this CPS,
c. The data listed in the certificate,d. The economic value of the transaction or communication,e. The potential loss or damage that would be caused by an erroneous identification or a lossof confidentiality or privacy of information in the application, transaction, orcommunication,46

f. The Relying Party’s previous course of dealing with the Subscriber,g. The Relying Party’s understanding of trade, including experience with computer-based
methods of trade, andh. Any other indicia of reliability or unreliability pertaining to the Subscriber and/or theapplication, communication, or transaction.
Any unauthorized reliance on a certificate is at a party’s own risk.

9.6.5 Representations and warranties of other participants
No Stipulation.

9.7 Disclaimers of warranties

AMAZON’S SERVICE OFFERINGS IN CONNECTION WITH THIS CPS ARE PROVIDED “AS IS.” WE AND OUR
AFFILIATES AND LICENSORS MAKE NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, WHETHER
EXPRESS, IMPLIED, STATUTORY OR OTHERWISE REGARDING THE SERVICE OFFERINGS OR ANY THIRD PARTYCONTENT, INCLUDING ANY WARRANTY THAT THE SERVICE OFFERINGS OR THIRD PARTY CONTENT WILL BE
UNINTERRUPTED, ERROR FREE OR FREE OF HARMFUL COMPONENTS, OR THAT ANY CONTENT, WILL BE
SECURE OR NOT OTHERWISE LOST OR DAMAGED. EXCEPT TO THE EXTENT PROHIBITED BY LAW, WE AND
OUR AFFILIATES AND LICENSORS DISCLAIM ALL WARRANTIES, INCLUDING ANY IMPLIED WARRANTIES OF
MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, NON- INFRINGEMENT,OR QUIET ENJOYMENT, AND ANY WARRANTIES ARISING OUT OF ANY COURSE OF DEALING OR USAGE OF
TRADE.

9.8 Limitations of liability

WE AND OUR AFFILIATES OR LICENSORS WILL NOT BE LIABLE TO YOU FOR ANY DIRECT, INDIRECT,INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES (INCLUDING DAMAGES FOR LOSS OF
PROFITS, GOODWILL, USE, OR DATA), EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCHDAMAGES. FURTHER, NEITHER WE NOR ANY OF OUR AFFILIATES OR LICENSORS WILL BE RESPONSIBLE FOR
ANY COMPENSATION, REIMBURSEMENT, OR DAMAGES ARISING IN CONNECTION WITH: (A) YOURINABILITY TO USE A CERTIFICATE, INCLUDING AS A RESULT OF ANY (I) TERMINATION OR SUSPENSION OF
THIS CPS OR REVOCATION OF A CERTIFICATE, (II) OUR DISCONTINUATION OF ANY OR ALL SERVICE
OFFERINGS IN CONNECTION WITH THIS CPS, OR, (III) ANY UNANTICIPATED OR UNSCHEDULED DOWNTIMEOF ALL OR A PORTION OF CA SERVICES FOR ANY REASON, INCLUDING AS A RESULT OF POWER OUTAGES,SYSTEM FAILURES OR OTHER INTERRUPTIONS;(B) THE COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; (C) ANY INVESTMENTS,
EXPENDITURES, OR COMMITMENTS BY YOU IN CONNECTION WITH THIS CPS OR YOUR USE OF OR ACCESSTO AMAZON’S CA SERVICE OFFERINGS; OR (D) ANY UNAUTHORIZED ACCESS TO, ALTERATION OF, OR THE
DELETION, DESTRUCTION, DAMAGE, LOSS OR FAILURE TO STORE ANY OF YOUR CONTENT OR OTHER DATA.
IN ANY CASE, OUR AND OUR AFFILIATES’ AND LICENSORS’ AGGREGATE LIABILITY IN CONNECTION WITH
THIS CPS AND ALL CERTIFICATES ISSUED HEREUNDER, IS LIMITED TO $500; PROVIDED, HOWEVER, THATFOR ANY EV CERTIFICATE ISSUED UNDER THIS CPS, OUR AND OUR AFFILIATES’ AND LICENSORS’
AGGREGATE LIABILITY IS LIMITED TO $2,000 PER SUBSCRIBER OR RELYING PARTY PER EV CERTIFICATE.

9.9 Indemnities

Indemnification by Amazon
Amazon shall indemnify each Application Software Vendor against any damage or loss suffered by an
Application Software Vendor related to or arising out of any third party allegation, claim, lawsuit, or47

proceeding (a “Claim”) to the extent such Claim is based on an EV Certificate issued by Amazon except
where the claim, damage, or loss suffered by the Application Software Vendor was directly caused by the
Application Software Vendor’s software displaying either (1) a valid and trustworthy EV Certificate as not
valid or trustworthy or (2) displaying as trustworthy (i) an EV Certificate that has expired or (ii) a revoked
EV Certificate where the revocation status is available online but the Application Software Vendor’s
software failed to check or ignored the status.
In connection with any Claim described in the foregoing paragraph, the indemnified party will: (a) give
Amazon prompt written notice of the Claim (provided that any delay in notification will not relieve Amazonof its indemnity obligations except to the extent that the delay impairs its ability to defend); (b) cooperatereasonably with Amazon (at Amazon’s expense) in connection with the defense and settlement of theClaim; and (c) permit Amazon to control the defense and settlement of the Claim, provided that Amazon
may not settle the Claim without the indemnified party’s prior written consent (which will not be
unreasonably withheld or delayed), and provided further that the indemnified party (at its cost) may
participate in the defense and settlement of the Claim with counsel of its own choosing. Amazon’s duty to
indemnify under this Section 9.9 will be independent from its other obligations under this Agreement.
Indemnification by Subscribers
To the extent permitted by law, each Subscriber shall indemnify Amazon, its partners, and any cross-signed
entities, and their respective directors, officers, employees, agents, and contractors against any loss,
damage, or expense, including reasonable attorney’s fees, related to (i) any misrepresentation or omission
by Subscriber, regardless of whether the misrepresentation or omission was intentional or unintentional;(ii) Subscriber’s breach of its Subscriber Agreement, this CPS, or applicable law; (iii) the compromise or
unauthorized use of a certificate or Private Key caused by the Subscriber’s negligence or intentional acts; or(iv) Subscriber’s misuse of a certificate or Private Key.
Indemnification by Relying Parties
To the extent permitted by law, each Relying Party shall indemnify Amazon, its partners, and any crosssigned entities, and their respective directors, officers, employees, agents, and contractors against any
loss, damage, or expense, including reasonable attorney’s fees, related to the Relying Party’s (i) breach of
any service terms applicable to the services provided by Amazon or its affiliates and used by the Relying
Party, this CPS, or applicable law; (ii) unreasonable reliance on a certificate; or (iii) failure to check thecertificate’s status prior to use.

9.10 Term and termination
9.10.1 Term

This CPS and any amendments to the CPS are effective when published to Amazon online repository andremain in effect until replaced with a newer version.

9.10.2 Termination

This CPS and any amendments remain in effect until replaced by a newer version.

9.10.3 Eﬀect of termination and survival

Amazon will communicate the conditions and effect of this CPS’s termination via the Amazon Repository.
The communication will specify which provisions survive termination. At a minimum, all responsibilities
related to protecting confidential information will survive termination. All Subscriber Agreements remain
effective until the certificate is revoked or expired, even if this CPS terminates.
48

9.11 Individual notices and communications with participantsAmazon accepts notices related to this CPS at the locations specified in §2.2. Notices are deemed effective
after the sender receives a valid and digitally signed acknowledgment of receipt from Amazon. If an
acknowledgement of receipt is not received within five days, the sender must resend the notice in paper
form to the street address specified in §2.2 using either a courier service that confirms delivery or via
certified or registered mail with postage prepaid and return receipt requested. Amazon may allow otherforms of notice in its Subscriber Agreements.

9.12 Amendments
9.12.1 Procedure for amendment

This CPS is reviewed at least annually and may be reviewed more frequently. Amendments are made byposting an updated version of the CPS to the online repository. Controls are in place that are designed toreasonably ensure that this CPS is not amended and published without the prior authorization of the
APPMA.

9.12.2 Notification mechanism and period

Amazon posts CPS revisions to its Repository. Amazon does not guarantee or set a notice-and-comment
period and may make changes to this CPS without notice and without changing the version number. Majorchanges affecting accredited certificates are announced and approved by the accrediting agency prior to
becoming effective. The APPMA is responsible for determining what constitutes a material change of theCPS.

9.12.3 Circumstances under which OID must be changed

The APPMA is solely responsible for determining whether an amendment to the CPS requires an OID
change.

9.13 Dispute resolution provisions

Parties are required to notify Amazon and attempt to resolve disputes directly with Amazon before
resorting to any dispute resolution mechanism.

9.14 Governing law

The laws of the state of Washington State govern the interpretation, construction, and enforcement of thisCPS and all proceedings related to Amazon products and services, including tort claims, without regard to
any conflicts of law principles. The state or federal courts located in King County, Washington have nonexclusive venue and jurisdiction over any proceedings related to the CPS or any Amazon product or service.
Amazon may seek injunctive or other relief in any state, federal, or national court of competent jurisdiction
for any actual or alleged infringement of our, our affiliates, or any third party’s intellectual property orother proprietary rights. The United Nations Convention for the International Sale of Goods does not apply
to this CPS.

9.15 Compliance with applicable law

This CPS is subject to all applicable laws and regulations, including United States restrictions on the exportof software and cryptography products.

9.16 Miscellaneous provisions
9.16.1 Entire agreement

Amazon contractually obligates each RA to comply with this CPS and applicable industry guidelines.
Amazon also requires each party using its products and services to enter into an agreement that delineates
the terms associated with the product or service. If an agreement has provisions that differ from this CPS,
49

then the agreement with that party controls, but solely with respect to that party. Third parties may not
rely on or bring action to enforce such agreement.

9.16.2 Assignment

Any entities operating under this CPS may not assign their rights or obligations without the prior writtenconsent of Amazon. Unless specified otherwise in a contract with a party, Amazon does not provide noticeof assignment.

9.16.3 Severability

If any provision of this CPS is held invalid or unenforceable by a competent court or tribunal, the remainderof the CPS will remain valid and enforceable. Each provision of this CPS that provides for a limitation of
liability, disclaimer of a warranty, or an exclusion of damages is severable and independent of any otherprovision.

9.16.4 Enforcement (attorneys’ fees and waiver of rights)

Amazon may seek indemnification and attorneys’ fees from a party for damages, losses, and expenses
related to that party’s conduct. Amazon failure to enforce a provision of this CPS does not waive Amazon
right to enforce the same provision later or right to enforce any other provision of this CPS. To be effective,
waivers must be in writing and signed by Amazon.

9.16.5 Force Majeure

Amazon is not liable for any delay or failure to perform an obligation under this CPS to the extent that thedelay or failure is caused by an occurrence beyond Amazon reasonable control. The operation of theInternet is beyond Amazon’s reasonable control.

9.17 Other provisions
No stipulation.

Appendix A: Object Identifiers
Table 1: Signature Algorithms
Name
md2WithRSAEncryption

Object Identifier
1.2.840.113549.1.1.2

md4WithRSAEncryption

1.2.840.113549.1.1.3

md5WithRSAEncryption

1.2.840.113549.1.1.4

sha1WithRSAEncryption

1.2.840.113549.1.1.5

sha256WithRSAEncryption
sha384WithRSAEncryption
sha512WithRSAEncryption
rsassaPss

1.2.840.113549.1.1.11
1.2.840.113549.1.1.12
1.2.840.113549.1.1.13
1.2.840.113549.1.1.10

dsaWithSHA1

1.2.840.10040.4.3

dsa_with_SHA256
ecdsa-with-SHA1

2.16.840.1.101.3.4.3.2
1.2.840.10045.4.1

Comments
No certificates will be issued
with this signature algorithm
No certificates will be issued
with this signature algorithm
No certificates will be issued
with this signature algorithm
No certificates will be issued
with this signature algorithm

The hash algorithm is specified in
the parameters data structure
No certificates will be issued
with this signature algorithm
No certificates will be issued
with this signature algorithm50ecdsa-with-SHA256
ecdsa-with-SHA384
ecdsa-with-SHA512

1.2.840.10045.4.3.2
1.2.840.10045.4.3.3
1.2.840.10045.4.3.4

Table 2: Selected Name Attribute Types
NameorganizationName
countryNameorganizationalUnitName
commonName
surnamegivenName

Object Identifier
2.5.4.10
2.5.4.6
2.5.4.11
2.5.4.3
2.5.4.4
2.5.4.42

Comments
Short name: O
Short name: C
Short name: OU
Short name: CN
Short name: SN
Short name: GN

Appendix B: Certificate Profiles

All certificates from the Amazon PKI must meet the following requirements:
1. The Certificate must be a X.509 certificate.
2. The version must be v3(2).
3. The serial number must be a positive integer
4. The validity:notBefore date must be present
5. the IssuerUniqueId and subjectUniqueId must not be present
6. the signature must be a value from Table 1
7. the subjectPublicKeyInfo must be present
8. the order of extensions in the certificate may vary
9. Names may only have one Attribute per RelativeDistinguishedName
10. the Certificate must match one of the below profiles
As described in the Amazon CP, each certificate is categorized as either a CA Certificate or a Subscriber
Certificate. Amazon does not issue Subscriber Certificates that simultaneously meet the criteria of multipleof the categories of Subscriber Certificates defined in the CP.

Root CA CertificatesField
issuervalidity:notAfter

Content
Must match subject
Not more than 25 years after the later ofvalidity:notBefore or the date thecertificate wasissuedsubject
Must contain countryName, organizationName,and commmonNameattributes
extension:subjectKeyIdentifier
160-bit SHA-1 hash of subjectPublicKey as
described in section 4.2.1.2 ofRFC5280
extension:basicConstraints
cA is TRUE, pathLenConstraint is not present
extension:keyUsage
digitalSignature, keyCertsign, and cRLSign bits areset, all other bits are notset
The subject Name may have additional attributes such as organizationalUnitName. The subject contents
must be validated according to the standard validation rules in section 3.2 of the Certificate Policy. The
commonName attribute must contain at least character that a letter, number, “:”, “-“, “.”, or “_” to ensure
it is not misinterpreted as a domain name or IP address. For example, the commonName may include aspace character to meet this requirement.
51

Subordinate CA CertificatesFieldvalidity:notAfter

Content
Not later than the notAfter date of the signing
certificate
subject
Must contain countryName, organizationName,and commonNameattributes
extension:subjectKeyIdentifier
160-bit SHA-1 hash of subjectPublicKey as
described in section 4.2.1.2 ofRFC5280
extension:authorityKeyIdentifier
keyIdentifier matches subjectKeyIdentifier ofsigning certificate;authorityCertIssuer andauthorityCertSerialNumber are not present
extension:certificatePolicies
must contain at least one set of policyInformation
containing at least a policyIdentifer
extension:basicConstraints
cA is TRUE
extension:keyUsage
digitalSignature, keyCertsign, and cRLSign bits areset, all other bits are not set
extension:authorityInfoAccessmust contain one AccessDescription with anaccessMethod of caIssuers and a Location of type
uniformResourceIdentifier and one
AccessDescription with an accessMethod of ocsp
and a Location of type uniformResourceIdentifierextension:cRLDistributionPoints
must have at least one DistributionPoint
containing a fullName of type
uniformResourceIdentifier
The subject Name may have additional attributes such as organizationalUnitName. The subject contents
must be validated according to the standard validation rules in section 3.2 of the Certificate Policy. The
commonName attribute must contain at least character that a letter, number, “:”, “-“, “.”, or “_” to ensure
it is not misinterpreted as a domain name or IP address. For example, the commonName may include aspace character to meet this requirement.
For subordinate CA certificates issued to organizations other than Amazon, the path length constraint in
the basicConstraints extensions is set to 0 (zero).

Standard Validation TLS Server Authentication Certificates
Field
serialNumber

validity:notAfter
subject
extension:authorityKeyIdentifierextension:certificatePolicies

Content
If the signatureAlgorithm uses SHA-1, the serial
number must contain at least 64 bits of randomly
generated entropy
Not more than 825 days after the later ofvalidity:notBefore or the date the certificate wasissuedIf the subject contains a commonName attribute,the value must be one of the values in thesubjectAlternativeName extension
keyIdentifier matches subjectKeyIdentifier ofsigning certificate; authorityCertIssuer andauthorityCertSerialNumber are not present
must contain at least one set of policyInformation
containing the policyIdentifier 2.23.140.1.2.1
52

extension:basicConstraints
extension:subjectAltName

is either absent or is empty
must contain at least one name and all names
must either be of typedNSName or iPAddress
extension:keyUsage
digitalSignature bit must be set, keyExchange may
be set, other bits should not be set
extension:extKeyUsage
must include serverAuth, may include clientAuth
extension:authorityInfoAccessmust contain one AccessDescription with anaccessMethod of caIssuers and a Location of type
uniformResourceIdentifier and one
AccessDescription with an accessMethod of ocsp
and a Location of type uniformResourceIdentifierextension:cRLDistributionPoints
must have at least one DistributionPoint
containing a fullName of type
uniformResourceIdentifier
The subject and subjectAlternativeName contents must be validated according to the standard validation
rules in section 3.2 of the Certificate Policy and comply with CP sections 7.1.4.2 and 7.1.4.3

Extended Validation TLS Server Authentication Certificates

Extended Validation TLS Server Authentication Certificates follow the same profile as Standard Validation
TLS Server Authentication Certificates with the following modifications.
Fieldvalidity:notAfter

Content
Not more than 27 months after the later ofvalidity:notBefore or the date the certificate wasissuedextension:certificatePolicies
must contain at least one set of policyInformation
containing the policyIdentifier 2.23.140.1.1
The subject and subjectAltName contents must be validated according to the extended validation rules ofsection 3.2 of the Certificate Policy and must comply with CP sections 7.1.4.4 and 7.1.4.5. dNSNames in thesubjectAltName may not contain the ‘*’ character.

Standard Validation Code Signing Certificates
Field
serialNumber

validity:notAfter
subject
extension:authorityKeyIdentifierextension:certificatePolicies
extension:basicConstraints
extension:subjectAltName

Content
If the signatureAlgorithm uses SHA-1, the serial
number must contain at least 64 bits of randomly
generated entropy
Not more than 39 months after the later ofvalidity:notBefore or the date the certificate wasissuedMust not be empty
keyIdentifier matches subjectKeyIdentifier ofsigning certificate;authorityCertIssuer andauthorityCertSerialNumber are not present
must contain at least one set of policyInformation
containing thepolicyIdentifier 1.3.187.1
is either absent or is empty
a General Name of type permanentIdentifier with
an identifierValue present and no assigner value
present
53

extension:keyUsage

digitalSignature bit must be set, other bits should
not be set
extension:extKeyUsage
must include codeSigning
extension:authorityInfoAccessmust contain one AccessDescription with anaccessMethod of caIssuers and a Location of type
uniformResourceIdentifier and one
AccessDescription with an accessMethod of ocsp
and a Location of type uniformResourceIdentifierextension:cRLDistributionPoints
must have at least one DistributionPoint
containing a fullName of type
uniformResourceIdentifier
The subject and subjectAlternativeName contents must be validated according to the standard validation
rules in section 3.2 of the Certificate Policy.

Extended Validation Code Signing Certificates

Extended Validation Code Signing Certificates follow the same profile as Standard Validation Code Signing
Certificates with the following modifications.
Field
extension:certificatePolicies

Content
must contain at least one set of policyInformation
containing the policyIdentifier 1.3.187.1.1
The subject and subjectAltName contents must be validated according to the extended validation rules ofsection 3.2 of the Certificate Policy and must comply with CP section 7.1.4.6.

Client Certificates
Field
serialNumber

validity:notAfter
subject
extension:authorityKeyIdentifierextension:certificatePolicies
extension:basicConstraints
extension:subjectAltName
extension:keyUsage
extension:extKeyUsage
extension:authorityInfoAccessContent
If the signatureAlgorithm uses SHA-1, the serial
number must contain at least 64 bits of randomly
generated entropy
Not more than 39 months after the later ofvalidity:notBefore or the date the certificate wasissuedMust not be empty if the subjectAltName is empty
keyIdentifier matches subjectKeyIdentifier ofsigning certificate; authorityCertIssuer andauthorityCertSerialNumber are not present
must contain at least one set of policyInformation
containing the policyIdentifier 1.3.187.1
is either absent or is empty
may be present
digitalSignature bit must be set, keyExchange may
be set, other bits should not be set
must include at least one of clientAuth,emailProtection, DocumentSigning, or Encrypting
Filesystem
must contain one AccessDescription with anaccessMethod of caIssuersand a Location of type
uniformResourceIdentifier andoneAccessDescription with an accessMethod of54

ocsp and a Location of type
uniformResourceIdentifierextension:cRLDistributionPoints
must have at least one DistributionPoint
containing a fullName of type
uniformResourceIdentifier
For each rfc822Name included in the subjectAltName, the CA ensures that Applicant either has the right touse or controls the email account.

Augmented Client Certificates

Augmented Client Certificates follow the same profile as Client Certificates.
Before issuing an Augmented Client Certificate, the CA confirms that the private key is stored on a device
that meets at least one of the following:••••

Certified to FIPS 140-1 or 140-2, Level 3 (or higher)
Certified to ISO/IEC 19790, Level 3 (or higher)
Certified to EAL4 (or higher) of the CWA 14169 or EN 14169 Protection Profile under the Common
Criteria (ISO/IEC 15408) framework
Certified as a Secure Signature Creation Device (SSCD) by an EU government entity

OCSP Signing Certificates
Field
serialNumber

validity:notAfter
subject
extension:authorityKeyIdentifierextension:certificatePolicies
extension:basicConstraints
extension:keyUsage
extension:extKeyUsage
extension:ocsp-nocheck

Time Stamp Authority Certificates
Field
serialNumber

validity:notAfter
subject
extension:basicConstraints

Content
If the signatureAlgorithm uses SHA-1, the serial
number must contain at least 64 bits of randomly
generated entropy
Not more than 39 months after the later ofvalidity:notBefore or the date the certificate wasissuedMust not be empty
keyIdentifier matches subjectKeyIdentifier ofsigning certificate; authorityCertIssuer andauthorityCertSerialNumber are not present
must contain at least one set of policyInformation
containing the policyIdentifier 1.3.187.1
is either absent or is empty
digitalSignature bit must be set, other bits should
not be set
must include OCSPSigningmust be present
Content
If the signatureAlgorithm uses SHA-1, the serial
number must contain at least 64 bits of randomly
generated entropy
Not more than 120 months after the later ofvalidity:notBefore or the date the certificate wasissuedMust not be empty
is either absent or is empty
55extension:keyUsage
extension:extKeyUsage
extension:authorityInfoAccessextension:cRLDistributionPoints
extension:authorityKeyIdentifier

digitalSignature bit must be set, other bits should
not be set
must include timeStamping
must contain one AccessDescription with anaccessMethod of caIssuers and a Location of type
uniformResourceIdentifier and one
AccessDescription with an accessMethod of ocsp
and a Location of type uniformResourceIdentifiermust have at least one DistributionPoint
containing a fullName of type
uniformResourceIdentifier
keyIdentifier matches subjectKeyIdentifier ofsigning certificate; authorityCertIssuer andauthorityCertSerialNumber are not present56