STARFIELDTECHNOLOGIES, LLC
CERTIFICATE POLICYAND
CERTIFICATION PRACTICE
STATEMENT(CP/CPS)

Version 2.9
July 22, 2011

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

Contents
1

INTRODUCTION .............................................................................................................................................. 8
1.1

OVERVIEW............................................................................................................................................. 8

1.2

Identification ......................................................................................................................................... 8

1.3

Community and Applicability ................................................................................................................. 8

1.3.1

Certification Authorities..................................................................................................................... 8

1.3.2

Registration Authorities ..................................................................................................................... 9

1.3.3

End Entities ....................................................................................................................................... 9

1.3.4

Applicability..................................................................................................................................... 10

1.4
2Contact Details .................................................................................................................................... 10

General Provisions ........................................................................................................................................ 10
2.1

Obligations .......................................................................................................................................... 10

2.1.1

Starfield Governance and Policy Authority Committee Obligations ................................................... 10

2.1.2

Certification Authority Obligations ................................................................................................... 10

2.1.3

Repository Obligations..................................................................................................................... 11

2.1.4

Registration Authority Obligations ................................................................................................... 11

2.1.5

Subscriber Obligations ..................................................................................................................... 11

2.1.6

Relying Party Obligations ................................................................................................................. 11

2.2

Liability ................................................................................................................................................ 11

2.2.1

Warranties and Limitations on Warranties ....................................................................................... 11

2.2.2

Disclaimer of Warranties ................................................................................................................. 15

2.2.3

Subscriber Liability........................................................................................................................... 15

2.2.4

Other Exclusions .............................................................................................................................. 16

2.3

Financial Responsibility ........................................................................................................................ 16

2.3.1

Indemnification by Subscribers and Relying Parties .......................................................................... 16

2.3.2

Fiduciary Relationships .................................................................................................................... 17

2.3.3

Administrative Processes ................................................................................................................. 17

2.4Interpretation and Enforcement .......................................................................................................... 17

2.4.1

Governing Law................................................................................................................................. 17

2.4.2

Severability, Survival, Merger and Notice ......................................................................................... 17

2.4.3

Dispute Resolution Procedures ........................................................................................................ 18

2.5

Fees..................................................................................................................................................... 18
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

2.5.1

Certificate Issuance or Renewal Fees ............................................................................................... 18

2.5.2

Certificate Access Fees..................................................................................................................... 18

2.5.3

Status Information Access or Revocation Fees ................................................................................. 18

2.5.4

Fees for Other Services Such as Policy Information........................................................................... 18

2.5.5

Refund Policy................................................................................................................................... 18

2.6
2.6.1

Publication of CA Information .......................................................................................................... 19

2.6.2

Frequency of Publication ................................................................................................................. 19

2.6.3

Access Controls ............................................................................................................................... 19

2.6.4

Repositories .................................................................................................................................... 19

2.7

Compliance Audit ................................................................................................................................ 19

2.7.1

Frequency of Entity Compliance Audit ............................................................................................. 19

2.7.2

Identity/Qualifications of Auditor .................................................................................................... 19

2.7.3

Auditor's Relationship to Audited Party ........................................................................................... 20

2.7.4

Topics Covered by Audit .................................................................................................................. 20

2.7.5

Actions Taken as a Result of an Audit Deficiency .............................................................................. 20

2.7.6

Communication of Results ............................................................................................................... 20

2.8

Confidentiality ..................................................................................................................................... 20

2.8.1

Types of Information to be Kept Confidential ................................................................................... 20

2.8.2

Types of Information not Considered Confidential ........................................................................... 21

2.8.3

Disclosure of Certificate Revocation Information.............................................................................. 21

2.8.4

Release to Law Enforcement Officials .............................................................................................. 21

2.8.5

Release as Part of Civil Discovery ..................................................................................................... 21

2.8.6

Disclosure Upon Owner's Request ................................................................................................... 21

2.8.7

Other Information Release Circumstances ....................................................................................... 21

2.9

3

Publication and Repository .................................................................................................................. 19Intellectual Property Rights .................................................................................................................. 21

2.9.1

Property Rights in Certificates and Revocation Information.............................................................. 21

2.9.2

Property Rights in the Agreement .................................................................................................... 22

2.9.3

Property Rights to Names ................................................................................................................ 22

2.9.4

Property Rights in Keys and Key Material ......................................................................................... 22

Identification and Authentication.................................................................................................................. 22
3.1

Initial Registration................................................................................................................................ 22

3.1.1

Types of Names ............................................................................................................................... 22

3.1.2

Need for Names to be Meaningful ................................................................................................... 23
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

4

3.1.3

Rules for Interpreting Various Name Forms...................................................................................... 23

3.1.4

Uniqueness of Names ...................................................................................................................... 23

3.1.5

Name Claim Dispute Resolution Procedure ...................................................................................... 23

3.1.6

Recognition, Authentication and Role of Trademarks ....................................................................... 23

3.1.7

Method to Prove Possession of Private Key...................................................................................... 23

3.1.8

Domain Name Access Verification.................................................................................................... 23

3.1.9

Medium Assurance Authentication .................................................................................................. 24

3.1.10High Assurance Authentication for Individual Subscribers ............................................................ 24

3.1.11High Assurance Authentication for Organizational Subscribers ..................................................... 24

3.1.12High Assurance Authentication for Code Signing Subscribers ....................................................... 24

3.1.13

Unified Communications Certificate Authentication..................................................................... 24

3.1.14

Extended Validation Authentication ............................................................................................ 24

3.1.15

Custom Certificate Authentication ............................................................................................... 25

3.2

Routine Re-key .................................................................................................................................... 25

3.3

Re-key After Revocation ...................................................................................................................... 25

3.4

Certificate Renewal.............................................................................................................................. 25

3.5

Revocation Request ............................................................................................................................. 25

3.6

Suspension Request ............................................................................................................................. 25

3.7

Request to Release Suspension ............................................................................................................ 26

3.8

Re-Verification of Subscriber Information ............................................................................................ 26

Operational Requirements ............................................................................................................................ 26
4.1

Certificate Application ......................................................................................................................... 26

4.2

Certificate Issuance.............................................................................................................................. 26

4.3

Certificate Acceptance ......................................................................................................................... 26

4.4

Certificate Suspension and Revocation................................................................................................. 26

4.4.1

Circumstances for Revocation.......................................................................................................... 26

4.4.2

Who Can Request Revocation .......................................................................................................... 27

4.4.3

Procedure for Revocation Request................................................................................................... 27

4.4.4

Revocation Request Grace Period .................................................................................................... 27

4.4.5

Circumstances for Suspension.......................................................................................................... 27

4.4.6

Who Can Request Suspension.......................................................................................................... 27

4.4.7

Procedure for Suspension Request................................................................................................... 27

4.4.8

Limits on Suspension Period ............................................................................................................ 27

4.4.9

CRL Issuance Frequency................................................................................................................... 27
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

4.4.10

CRL Checking Requirements ........................................................................................................ 27

4.4.11

Online Revocation/Status Checking Availability............................................................................ 27

4.4.12

Online Revocation Checking Requirements .................................................................................. 28

4.4.13

Other Forms of Revocation Advertisements Available .................................................................. 28

4.4.14Checking Requirements for Other Forms of Revocation Advertisements ...................................... 28

4.4.15Special Requirements for Key Compromise .................................................................................. 28

4.5
4.5.1

Reporting ........................................................................................................................................ 28

4.5.2

Investigation.................................................................................................................................... 28

4.5.3

Response......................................................................................................................................... 28

4.6

Security Audit Procedures .................................................................................................................... 29

4.6.1

Types of Events Recorded ................................................................................................................ 29

4.6.2

Required Data Elements .................................................................................................................. 29

4.6.3

Frequency of Processing Log ............................................................................................................ 29

4.6.4

Retention Period for Audit Log......................................................................................................... 29

4.6.5

Protection of Audit Log .................................................................................................................... 30

4.6.6

Audit Log Backup Procedures........................................................................................................... 30

4.6.7

Audit Collection System (Internal vs. External) ................................................................................. 30

4.6.8

Notification to Event-Causing Subject .............................................................................................. 30

4.6.9

Vulnerability Assessments ............................................................................................................... 30

4.7

5

Certificate Problem Reporting and Response ....................................................................................... 28

Records Archival .................................................................................................................................. 30

4.7.1

Types of Events Recorded ................................................................................................................ 30

4.7.2

Retention Period for Archive............................................................................................................ 30

4.7.3

Protection of Archive ....................................................................................................................... 30

4.7.4

Archive Backup Procedures.............................................................................................................. 30

4.7.5

Requirements for Time-Stamping of Records ................................................................................... 30

4.7.6

Archive Collection System (Internal or External) ............................................................................... 30

4.7.7

Procedures to Obtain and Verify Archive Information ...................................................................... 30

4.8

Key Changeover ................................................................................................................................... 31

4.9

Compromise and Disaster Recovery ..................................................................................................... 31

4.10

CA Termination.................................................................................................................................... 31

Physical, Procedural and Personnel Security Controls .................................................................................... 31
5.1
5.1.1

Physical Controls.................................................................................................................................. 31
Site Location and Construction ........................................................................................................ 31
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

5.1.2

Physical Access ................................................................................................................................ 31

5.1.3

Power and Air Conditioning ............................................................................................................. 32

5.1.4

Water Exposures ............................................................................................................................. 32

5.1.5Fire Prevention and Protection ........................................................................................................ 32

5.1.6

Media Storage ................................................................................................................................. 32

5.1.7

Offsite Backup ................................................................................................................................. 32

5.1.8

Waste Disposal ................................................................................................................................ 32

5.2
5.2.1

Trusted Roles................................................................................................................................... 32

5.2.2

Number of Persons Required Per Task ............................................................................................. 32

5.2.3

Identification and Authentication for Each Role ............................................................................... 33

5.3

6

Procedural Controls ............................................................................................................................. 32

Personnel Controls .............................................................................................................................. 33

5.3.1

Background, Qualifications, Experience, and Clearance Requirements ............................................. 33

5.3.2

Background Check Procedures ......................................................................................................... 33

5.3.3

Training Requirements .................................................................................................................... 33

5.3.4

Retraining Frequency and Requirements ......................................................................................... 33

5.3.5

Job Rotation Frequency and Sequence............................................................................................. 33

5.3.6

Sanctions for Unauthorized Actions ................................................................................................. 33

5.3.7

Contracting Personnel Requirements ............................................................................................... 34

5.3.8

Documentation Supplied to Personnel ............................................................................................. 34

Technical Security Controls ........................................................................................................................... 34
6.1

Key Pair Generation ............................................................................................................................. 34

6.1.1

Key Pair Generation ......................................................................................................................... 34

6.1.2

Private Key Delivery to Entity ........................................................................................................... 34

6.1.3

Public Key Delivery to Certificate Issuer ........................................................................................... 34

6.1.4

CA Public Key Delivery to Users........................................................................................................ 34

6.1.5

Key Sizes.......................................................................................................................................... 34

6.1.6

Public Key Parameters Generation and Quality Checking.................................................................. 35

6.1.7

Hardware/Software Key Generation ................................................................................................ 35

6.1.8

Key Usage Purposes......................................................................................................................... 35

6.2

Key Pair Generation ............................................................................................................................. 35

6.2.1

Standards for Cryptographic Module ............................................................................................... 35

6.2.2

Standards for Cryptographic Module ............................................................................................... 35

6.2.3

Private Key Escrow .......................................................................................................................... 36
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

6.2.4

Private Key Backup and Archival ...................................................................................................... 36

6.2.5

Private Key Entry into Cryptographic Module ................................................................................... 36

6.2.6

Method of Activating Private Keys ................................................................................................... 36

6.2.7

Method of Deactivating Private Key ................................................................................................. 36

6.2.8

Method of Destroying Private Key ................................................................................................... 36

6.3
6.3.1

Public Key Archival........................................................................................................................... 36

6.3.2

Usage periods for the Public and Private Keys .................................................................................. 36

6.4

Activation Data .................................................................................................................................... 37

6.5

Computer Security Controls ................................................................................................................. 37

6.5.1

Public Key Archival........................................................................................................................... 37

6.5.2

Computer Security Rating ................................................................................................................ 37

6.6

7

System Development Controls ......................................................................................................... 37

6.6.2

Security Management Controls........................................................................................................ 37

6.6.3

Life Cycle Security Ratings................................................................................................................ 37

6.7

Network Security Controls ................................................................................................................... 37

6.8

Cryptographic Module Engineering Controls ........................................................................................ 38

Certificate and CRL Profiles ........................................................................................................................... 38
Certificate Profiles ............................................................................................................................... 38

7.1.1

Root CAs.......................................................................................................................................... 38

7.1.2

Issuing CA ........................................................................................................................................ 41

7.1.3

Bridge CA Certificates ...................................................................................................................... 44

7.1.4

End Entity SSL Certificates................................................................................................................ 45

7.1.5

End Entity Code Signing Certificates ................................................................................................. 49

7.1.6

End Entity Custom Certificates ......................................................................................................... 51

7.2

9Life Cycle Technical Controls ................................................................................................................ 37

6.6.1

7.1

8

Other Aspects of Key Pair Management ............................................................................................... 36

CRL Profiles.......................................................................................................................................... 53

7.2.1

Root CAs.......................................................................................................................................... 53

7.2.2

Issuing CAs ...................................................................................................................................... 58

Specification Administration ......................................................................................................................... 61
8.1

Specification Change Procedures ......................................................................................................... 61

8.2

Publication and Notification Policies .................................................................................................... 61

8.3

CPS Approval Procedures ..................................................................................................................... 61

Definitions .................................................................................................................................................... 61
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

1 INTRODUCTION
Starfield Technologies is an innovator in the field of Internet foundation services, providing advanced software andInternet solutions critical to the building of online presence and e-commerce.
The Starfield Public Key Infrastructure (“Starfield PKI”) has been established to provide a variety of digital
certificate services.

1.1 OVERVIEWThis Certificate Policy and Certification Practice Statement (CP/CPS) describes the practices of the Starfield PKI
and applies to all Certification Authorities (CAs) within the Starfield PKI hierarchy. This CP/CPS is applicable toall entities with relationships with the Starfield PKI, including Policy Authorities (PAs), Certification Authorities(CAs), Registration Authorities (RAs), Subscribers, and Relying Parties.

1.2 IDENTIFICATIONThis document is formally referred to as the “Starfield Certificate Policy and Certification Practice Statement”(Starfield CP/CPS). Starfield CAs issue certificates in accordance with the policy and practice requirements ofthis document.

1.3 COMMUNITY AND APPLICABILITY

This document is formally referred to as the “Starfield Certificate Policy and Certification Practice Statement”(Starfield CP/CPS). Starfield CAs issue certificates in accordance with the policy and practice requirements ofthis document.

1.3.1 CERTIFICATION AUTHORITIESStarfield Certification Authorities (CAs) perform the following general functions:• Create and sign certificates• Distribute certificates to the appropriate Subscribers and Relying Parties• Revoke certificates• Distribute certificate status information in the form of Certificate Revocation Lists (CRLs) or othermechanisms• Provide a repository where certificates and certificate status information are stored and made available(if applicable).
Within the Starfield PKI, there are two general types of CAs: Root and Issuing CAs. Currently, the Starfield
PKI hierarchy consists of the following CAs:
CA Type
ValiCert Root CA

Starfield Root CA

CA NameValiCert Class 2 Policy
Validation Authority(also referred to as
the “Starfield RootCA”) 1
Starfield Class 2
Certification Authority

Description of Function
Serves as the legacy “trust anchor” for the Starfield PKI
hierarchy.

Serves as the “trust anchor” for the Starfield PKI hierarchy
for any certificates other than those sold under the Go
Daddy brand. Issues any new CAs for different types of
PKI services except those used with the Go Daddy brand.
Serves as a trusted root for time stamping certificates.

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

Starfield Root CA

Starfield Class 2
Certification Authority

Starfield Root CA –G2

Starfield Root
Certificate Authority –G2

Go Daddy Root CA

Go Daddy Class 2
Certification Authority

Go Daddy Root CA– G2

Go Daddy Root
Certificate Authority –G2

Legacy Issuing CA

Starfield Secure
Certification Authority
Starfield Class 2
Certification Authority
Go Daddy Class 2
Certification Authority
Starfield Services Root
Certificate Authority
Starfield Services Root
Certificate Authority –G2

Starfield 2048-bit
Issuing CA
Go Daddy 2048-bit
Issuing CA
Starfield Services
Root CAStarfield Services
Root CA – G2
1

Second Generation (G2) Starfield Root CA. Serves as the“trust anchor” for the future Starfield PKI hierarchy for
any certificates other than those sold under the Go Daddy
brand. Issues any future CAs for different types of PKI
services except those used with the Go Daddy brand.
Serves as a trusted root for time stamping certificates.
Second Generation (G2) Starfield Root CA. Serves as the“trust anchor” for the future Starfield PKI hierarchy for
any certificates other than those sold under the Go Daddy
brand. Issues any future CAs for different types of PKI
services except those used with the Go Daddy brand.
Serves as a trusted root for time stamping certificates.
Serves as the “trust anchor” for the Starfield PKI hierarchy
for any certificates sold under the Go Daddy brand. Issues
any new CAs for different types of PKI services sold under
the Go Daddy brand.
Second Generation (G2) Go Daddy Root CA. Serves as the“trust anchor” for the future Starfield PKI hierarchy for
any certificates sold under the Go Daddy brand. Issues
any future CAs for different types of PKI services soldunder the Go Daddy brand.
Issues SSL web server certificates to authenticatedorganizations and individuals.
Issues certificates to authenticated organizations andindividuals.
Issues Go Daddy branded certificates to authenticatedorganizations and individuals.
Serves as a trusted root for time stamping certificates.
Also reserved for general purpose usage in the future.
Reserved for future use.

Starfield acquired the ValiCert Class 2 Policy Validation Authority from ValiCert, Inc. in June 2003.

1.3.2 REGISTRATION AUTHORITIESRegistration Authorities (RAs) evaluate and either approve or reject Subscriber certificate managementtransactions (including certificate requests, renewal and re-key requests, and revocation requests).
Starfield serves as the sole RA for the Starfield PKI.
For the Starfield Root CAs the Subscribers are Subordinate CAs that are under the control of Starfield.
Accordingly, the RA function for these CAs is performed manually by authorized Starfield PKI personnel.
For the Starfield Issuing CAs, the RA function is performed by Starfield using a combination of automatedand manual processes.

1.3.3 END ENTITIESEnd Entities include Subscribers and Relying Parties.

For the Root CAs, the Subscribers include subordinate CAs. For Starfield Issuing CAs, Subscribers typically
include organizations and individuals.

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

Relying Parties include any entity that may rely upon a Starfield certificate for purposes of determining
the organizational or individual identity of an entity providing a web site, data encryption, digital
signature verification, and user authentication.

1.3.4 APPLICABILITY

This CP/CPS is applicable to all certificates issued by Starfield CAs within the Starfield PKI. This document
defines the specific communities for which a specific class or type of certificate is applicable, specificStarfield PKI practices and requirements for the issuance and management of such certificates, and theintended purposes and uses of such certificates.

1.4 CONTACT DETAILSThis CP/CPS is administered by the Starfield Governance and Policy Authority Committee. Contact information
is listed below:
Starfield Technologies, LLC
14455 N. Hayden Road, Suite 219
Scottsdale, AZ 85260
Phone: 480-505-8800
Fax: 480-505-8865
E-mail: practices@starfieldtech.com
The Starfield Governance and Policy Authority Committee consists of representatives from executive
management, corporate security, PKI operations, and legal.

2

GENERAL PROVISIONS
2.1 OBLIGATIONS
2.1.1 STARFIELD GOVERNANCE AND POLICY AUTHORITY COMMITTEEOBLIGATIONS
Obligations of the Starfield Governance and Policy Authority Committee (GPAC) include:• Approving and maintaining this CP/CPS• Interpreting adherence to this CP/CPS• Specifying the content of public-key certificates• Resolving or causing resolution of disputes related to this CP/CPS• Remaining current regarding security threats and ensuring that appropriate actions are taken tocounteract significant threats.

2.1.2 CERTIFICATION AUTHORITY OBLIGATIONS

Obligations of the CAs within the Starfield PKI include:• Generating, issuing and distributing public key certificates• Distributing CA certificates• Generating and publishing certificate status information (such as CRLs)• Maintaining the security, availability, and continuity of the certificate issuance and CRL signing functions
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

• Providing a means for Subscribers to request revocation• Revoking public-key certificates• Periodically demonstrating internal or external audited compliance with this CP/CPS.

2.1.3 REPOSITORY OBLIGATIONSIn providing Repository services, obligations of the Starfield PKI include:• Storing and distributing public-key certificates (where relevant)• Storing and distributing certificate status information (such as CRLs and/or online certificate status)• Storing and distributing this CP/CPS and subsequent updates.
• Storing and distributing the Relying Party and Subscriber agreements.

2.1.4 REGISTRATION AUTHORITY OBLIGATIONS

Obligations of the Registration Authorities (RAs) within the Starfield PKI include:• Obtaining a public-key from the Subscriber• Identifying and authenticating Subscribers in accordance with this CP/CPS• Verifying that the Subscriber possesses the asymmetric private key corresponding to the public-key
submitted for certification• Receiving, authenticating and processing certificate revocation requests• Providing suitable training to personnel performing RA functions.

2.1.5 SUBSCRIBER OBLIGATIONS

Obligations of Subscribers within the Starfield PKI include:• Generating or causing to be generated one or more asymmetric key pairs• Submitting public keys and credentials for registration• Providing information to the RA that is accurate and complete to the best of the Subscribers’ knowledge
and belief regarding information in their certificates and identification and authentication information• Taking appropriate measures to protect their private keys from compromise• Promptly reporting loss or compromise of private key(s) and inaccuracy of certificate information• Using its key pair(s) in compliance with this CP/CPS.

2.1.6 RELYING PARTY OBLIGATIONS

Obligations of Relying Parties within the Starfield PKI include:• Confirming the validity of Subscriber public-key certificates• Verifying that Subscriber possesses the asymmetric private key corresponding to the public-key
certificate (e.g., through digital signature verification)• Using the public-key in the Subscriber’s certificate in compliance with this CP/CPS.

2.2 LIABILITY
2.2.1 WARRANTIES AND L IMITATIONS ON WARRANTIESThe warranties, disclaimers of warranty, and limitations of liability among Starfield, its Resellers, and theirrespective Customers within the Starfield PKI are set forth and governed by the agreements among them.
This CPS 2.2.1 relates only to the warranties that certain CAs (Starfield CAs) must make to end-Subscribers
receiving Certificates from them and to Relying Parties, the disclaimers of warranties they shall make to
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

those Subscribers and Relying Parties, and the limitations of liability they can place on those Subscribers
and Relying Parties.
Starfield uses, and (where required) Resellers shall use, Subscriber agreements and Relying party
agreements in accordance with CPS 2. These Subscriber agreements shall meet the requirements
imposed by Starfield (in the case of Resellers). Requirements that Subscriber agreements containwarranties, disclaimers, and limitations of liability below apply to those Resellers that use Subscriber
agreements. Starfield agrees to such requirements in its Subscriber agreements. Starfield’s practices
concerning warranties, disclaimers, and limitations in Relying Parties agreements apply to Starfield. Notethat terms applicable to Relying Parties shall also be included in Subscriber agreements, in addition to
Relying party agreements, because subscribers often act as Relying Parties as well.
Applicants, Subscribers, and Relying Parties acknowledge and agree that operations in relation toStarfield Certificates and Starfield Certificate Applications are dependent on the transmission of
information over communication infrastructures such as, without limitation, the Internet, telephone andtelecommunications lines and networks, servers, firewalls, proxies, routers, switches, and bridges("Telecommunication Equipment") and that this Telecommunication Equipment is not under the controlof Starfield or any independent third-party RA operating under a Starfield CA, or any Resellers, Comarketers, or any subcontractors, distributors, agents, suppliers, employees, or directors of any of theforegoing. Neither Starfield nor any independent third-party RA operating under a Starfield RA, or any
Resellers, Co-marketers, or any subcontractors, distributors, agents, suppliers, employees, or directors of
any of the foregoing shall be liable for any error, failure, delay, interruption, defect, or corruption in
relation to a Starfield Certificate, a Starfield CRL, a Starfield OCSP Response, or a Starfield Certificate
Application to the extent that such error, failure, delay, interruption, defect, or corruption is caused bysuch Telecommunication Equipment.

2.2.1.1
STARFIELD CERTIFICATION AUTHORITY WARRANTIES TO SUBSCRIBERS
AND RELYING PARTIES• Starfield warrants that it is providing the Certificate Service with reasonable skill and care
• Starfield warrants that to the best of its knowledge there are no material misrepresentations of fact
in the Certificates known to or originating from the entities approving the Certificate Applications or
issuing the Certificates• Starfield warrants that there are no informational errors in the Certificates introduced by theentities that approved the Certificate Applications or issued the Certificates as a result of failing to
exercise reasonable care in managing the Certificate Applications or creating the Certificates• Starfield warrants that their Certificates meet all of the material requirements of this CPS• Starfield warrants that the Certificates, the revocation services and its use of a repository conformto this CPS in all material respects

2.2.1.2

LOSS LIMITATIONSTHE TOTAL CUMULATIVE LIABILITY OF STARFIELD, ANY INDEPENDENT THIRD-PARTY RA OPERATINGUNDER A STARFIELD CA, ANY RESELLERS, OR CO-MARKETERS, OR ANY SUBCONTRACTORS,DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR DIRECTORS OF ANY OF THE FOREGOING TO ANYAPPLICANT, SUBSCRIBER, RELYING PARTY OR ANY OTHER PERSON, ENTITY, OR ORGANIZATIONARISING OUT OF OR RELATING TO ANY STARFIELD CERTIFICATE OR ANY SERVICES PROVIDED IN
RESPECT TO STARFIELD CERTIFICATES, INCLUDING ANY USE OR RELIANCE ON ANY STARFIELDCERTIFICATE, SHALL NOT EXCEED (A) TEN THOUSAND UNITED STATES DOLLARS ($10,000.00) FOR
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

EACH MEDIUM ASSURANCE CERTIFICATE ("MEDIUM ASSURANCE CUMULATIVE DAMAGE LIMIT"); (B)ONE HUNDRED FIFTY THOUSAND UNITED STATES DOLLARS ($150,000.00) FOR EACH HIGHASSURANCE CERTIFICATE ("HIGH ASSURANCE CUMULATIVE DAMAGE LIMIT"); OR (C) TWO HUNDREDFIFTY THOUSAND UNITED STATES DOLLARS ($250,000.00) FOR EACH EXTENDED VALIDATIONCERTIFICATE ("EXTENDED VALIDATION CUMULATIVE DAMAGE LIMIT") (COLLECTIVELY, “CUMULATIVEDAMAGE LIMITS”). THESE CUMULATIVE DAMAGE LIMITS SHALL APPLY PER STARFIELD CERTIFICATEREGARDLESS OF THE NUMBER OF TRANSACTIONS OR CAUSES OF ACTION ARISING OUT OF OR
RELATED TO SUCH STARFIELD CERTIFICATE OR ANY SERVICES PROVIDED IN RESPECT TO SUCHSTARFIELD CERTIFICATE. THE FOREGOING LIMITATIONS SHALL APPLY TO ANY LIABILITY WHETHERBASED IN CONTRACT (INCLUDING FUNDAMENTAL BREACH), TORT (INCLUDING NEGLIGENCE),
LEGISLATION OR ANY OTHER THEORY OF LIABILITY, INCLUDING ANY DIRECT, INDIRECT, SPECIAL,STATUTORY, PUNITIVE, EXEMPLARY, CONSEQUENTIAL, RELIANCE, OR INCIDENTAL DAMAGES.
STARFIELD, ANY INDEPENDENT THIRD-PARTY RA OPERATING UNDER A STARFIELD CA, OR DIRECTORSOF ANY OF THE FOREGOING SHALL NOT BE
LIABLE TO ANY SUBSCRIBER, RELYING PARTY, OR ANY OTHER PERSON, ENTITY, OR ORGANIZATIONFOR ANY LOSSES, COSTS, EXPENSES, LIABILITIES, DAMAGES, CLAIMS OR SETTLEMENT AMOUNTSARISING OUT OF OR RELATING TO ANY PROCEEDING OR ALLEGATION THAT A STARFIELD CERTIFICATEOR ANY INFORMATION CONTAINED IN A STARFIELD CERTIFICATE INFRINGES, MISAPPROPRIATES,DILUTES, UNFAIRLY COMPETES WITH, OR OTHERWISE VIOLATES ANY PATENT, TRADEMARK,COPYRIGHT, TRADE SECRET, OR ANY INTELLECTUAL PROPERTY RIGHT OR OTHER RIGHT OF ANYPERSON, ENTITY, OR ORGANIZATION IN ANY JURISDICTION. SHOULD LIABILITY ARISING OUT OF OR
RELATING TO A STARFIELD CERTIFICATE OR ANY SERVICES PROVIDED IN RESPECT TO A STARFIELDCERTIFICATE EXCEED THE CUMULATIVE DAMAGE LIMITS, THE AMOUNTS AVAILABLE UNDER THE
CUMULATIVE DAMAGE LIMITS SHALL BE APPORTIONED FIRST TO THE EARLIEST CLAIMS TO ACHIEVE
FINAL DISPUTE RESOLUTION UNLESS OTHERWISE ORDERED BY A COURT OF COMPETENTJURISDICTION. IN NO EVENT SHALL STARFIELD OR ANY INDEPENDENT THIRD-PARTY RA OPERATINGUNDER ANY STARFIELD CERTIFICATION AUTHORITY, OR ANY RESELLERS, CO-MARKETERS, OR ANY
SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR DIRECTORS OF ANY OF THE
FOREGOING BE OBLIGATED TO PAY MORE THAN THE CUMULATIVE DAMAGE LIMITS FOR ANYSTARFIELD CERTIFICATE OR ANY SERVICES PROVIDED IN RESPECT TO ANY STARFIELD SERVER
CERTIFICATE REGARDLESS OF APPORTIONMENT AMONG CLAIMANTS. STARFIELD, INDEPENDENTTHIRD-PARTY RAs OPERATING UNDER A STARFIELD CERTIFICATION AUTHORITY, RESELLERS, COMARKETERS, OR ANY SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR
DIRECTORS OF ANY OF THE FOREGOING SHALL NOT BE LIABLE FOR ANY INCIDENTAL, SPECIAL,STATUTORY, PUNITIVE, EXEMPLARY, INDIRECT, RELIANCE, OR CONSEQUENTIAL DAMAGES(INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS, LOSS OF BUSINESSOPPORTUNITIES, LOSS OF GOODWILL, LOSS OF PROFITS, BUSINESS INTERRUPTION, LOSS OF DATA,LOST SAVINGS OR OTHER SIMILAR PECUNIARY LOSS) WHETHER ARISING FROM CONTRACT(INCLUDING FUNDAMENTAL BREACH), TORT (INCLUDING NEGLIGENCE), LEGISLATION OR ANY OTHER
THEORY OF LIABILITY. THESE LIMITATIONS SHALL APPLY NOTWITHSTANDING THE FAILURE OF
ESSENTIAL PURPOSE OF ANY LIMITED REMEDY STATED HEREIN AND EVEN IF STARFIELD OR ANY
INDEPENDENT THIRD-PARTY OPERATING UNDER A STARFIELD CERTIFICATION AUTHORITY, OR ANYRESELLERS, CO-MARKETERS, OR ANY SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS,EMPLOYEES, OR DIRECTORS OF ANY OF THE FOREGOING HAVE BEEN ADVISED OF THE POSSIBILITY OF
THOSE DAMAGES. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THESE LIMITATIONS SET FORTHABOVE MAY NOT APPLY TO CERTAIN APPLICANTS, SUBSCRIBERS, RELYING PARTIES, OR OTHERPERSONS, ENTITIES, OR ORGANIZATIONS. THE DISCLAIMERS OF REPRESENTATIONS, WARRANTIES,AND CONDITIONS AND THE LIMITATIONS OF LIABILITY IN THIS STARFIELD CERTIFICATION PRACTICE
STATEMENT CONSTITUTE AN ESSENTIAL PART OF THE STARFIELD CPS, ANY SUBSCRIPTIONAGREEMENTS, AND ANY RELYING PARTY AGREEMENTS. ALL APPLICANTS, SUBSCRIBERS, RELYINGPARTIES, AND OTHER PERSONS, ENTITIES, AND ORGANIZATIONS ACKNOWLEDGE THAT BUT FOR
THESE DISCLAIMERS OF REPRESENTATIONS, WARRANTIES, AND CONDITIONS AND LIMITATIONS OF
LIABILITY, STARFIELD WOULD NOT ISSUE STARFIELD CERTIFICATES TO SUBSCRIBERS AND NEITHERSTARFIELD NOR ANY INDEPENDENT THIRD-PARTY REGISTRATION AUTHORITIES OPERATING UNDER A
STARFIELD CERTIFICATION AUTHORITY, NOR ANY RESELLERS, CO-MARKETERS, OR ANY
SUBCONTRACTORS, DISTRIBUTORS, AGENTS, SUPPLIERS, EMPLOYEES, OR DIRECTORS OF ANY OF THE
FOREGOING WOULD PROVIDE SERVICES IN RESPECT TO STARFIELD CERTIFICATES AND THAT THESE
PROVISIONS PROVIDE FOR A REASONABLE ALLOCATION OF RISK.
In addition, Starfield is not liable for any loss:• of CA or RA services due to war, natural disasters or other uncontrollable forces;• incurred between the time a certificate is revoked and the next scheduled issuance of a CRL;
• due to unauthorized use of certificates issued by the Starfield PKI, or use of certificates beyond theprescribed use defined by this CP/CPS;• arising from the negligent or fraudulent use of certificates or CRLs issued by the Starfield PKI; or• due to disclosure of personal information contained within certificates.

2.2.1.3

HAZARDOUS ACTIVITIESStarfield Certificates and the services provided by Starfield in respect to Starfield Certificates are notdesigned, manufactured, or intended for use in or in conjunction with hazardous activities or uses
requiring fail-safe performance, including the operation of nuclear facilities, aircraft navigation orcommunications systems, air traffic control, medical devices or direct life support machines. Starfield
and any independent third-party RA operating under a Starfield CA, and any Resellers, Co-marketers,
and any subcontractors, distributors, agents, suppliers, employees, or directors of any of theforegoing specifically disclaim any and all representations, warranties, and conditions with respect tosuch uses, whether express, implied, statutory, by usage of trade, or otherwise.
2.2.1.4

OTHER
Without limitation, neither Starfield nor any independent third-party RAs operating under a StarfieldCA, nor any Resellers or Co-marketers, or any subcontractors, distributors, agents, suppliers,
employees, or directors of any of the foregoing shall be liable to any Applicants,
Subscribers, Relying Parties or any other person, entity, or organization for any losses, costs,
expenses, liabilities, damages, claims, or settlement amounts arising out of or relating to use of aStarfield Certificate or any services provided in respect to a Starfield Certificate if:(i) the Starfield Certificate was issued as a result of errors, misrepresentations, or other acts oromissions of a Subscriber or of any other person, entity, or organization;(ii) the Starfield Certificate has expired or has been revoked;(iii) the Starfield Certificate has been modified or otherwise altered;

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

(iv) the Subscriber failed to stop using a Starfield Certificate after the information contained in such
Starfield Certificate changed or after circumstances changed so that the information contained insuch Starfield Certificate became misleading or inaccurate;(v) a Subscriber breached the Starfield CPS or the Subscriber's Subscription Agreement, or a Relying
Party breached the Starfield CPS or the Relying Party's Relying Party Agreement;(vi) the Private Key associated with the Starfield Certificate has been Compromised; or(vii) the Starfield Certificate is used other than as permitted by the Starfield CPS or is used incontravention of applicable law.

2.2.2 DISCLAIMER OF WARRANTIESSTARFIELD, ITS CAS, ITS RESELLERS, CO-MARKETERS, SUBCONTRACTORS, DISTRIBUTORS, AGENTS,
SUPPLIERS, AND EMPLOYEES MAKE NO REPRESENTATIONS AND EXPRESSLY DISCLAIM ALL WARRANTIESOF ANY KIND EXCEPT THE LIMITED WARRANTY IN SECTION 2.2.1.1, WHETHER EXPRESS OR IMPLIED,INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, NON-INFRINGEMENT, TITLE, SATISFACTORY TITLE, AND ALSO INCLUDINGWARRANTIES THAT ARE STATUTORY OR BY USAGE OF TRADE. STARFIELD MAKES NO WARRANTY THATITS SERVICE(S) WILL MEET ANY EXPECTATIONS, OR THAT THE SERVICE(S) WILL BE UNINTERRUPTED,TIMELY, SECURE, OR ERROR FREE, OR THAT DEFECTS WILL BE CORRECTED. STARFIELD DOES NOTWARRANT, NOR MAKE ANY REPRESENTATIONS REGARDING THE USE, OR RESULTS OF, ANY OF THE
SERVICES WE PROVIDE, IN TERMS OF THEIR CORRECTNESS, ACCURACY, RELIABILITY, OR OTHERWISE.

2.2.3 SUBSCRIBER LIABILITY
2.2.3.1

SUBSCRIBER WARRANTIES
Subscribers are obligated by Starfield’s Subscriber Agreements to warrant that, among other things:• All digital signatures created using the private key corresponding to the public key listed in theCertificate belong to that Subscriber and the Certificate has been accepted and is functional – it has
not expired or been revoked - at the time the digital signature is created,• No unauthorized users have had access to the Subscriber's private key,
• All representations in the Certificate Application by the Subscriber are true,• The information from the Subscriber in the Certificate is true,• Any usage of the Certificate is for authorized and lawful reasons only, consistent with this CPS,
• The Subscriber is not a CA but is an end-user Subscriber and is not using the private key
corresponding to any public key listed in the Certificate for purposes of digitally signing any
Certificate (or any other format of certified public key) or CRL, as a CA or otherwise (with the
exception of signing code with a Code Signing Certificate), and• The Subscriber is not using the Certificate Service in any way that infringes upon the rights of third
parties.
• The Subscriber is not using their Code Signing Certificate to digitally sign hostile code, including
spyware or other malicious software (malware) downloaded without user consent.
These requirements shall be in other Subscriber Agreements.

2.2.3.2

PRIVATE KEY COMPROMISE

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

The Subscriber Agreements provide that if Subscribers fail to meet the PKI requirements and theirprivate key is compromised, they are solely responsible for any loss or damage resulting from such
failure.

2.2.4 OTHER EXCLUSIONSNo stipulation.

2.3 FINANCIAL RESPONSIBILITY

Subscribers and Relying Parties shall be responsible for the financial consequences to such Subscribers, Relying
Parties, and to any other persons, entities, or organizations for any transactions in which such Subscribers or
Relying Parties participate and which use Starfield Certificates or any services provided in respect to Starfield
Certificates. Starfield makes no representations and gives no warranties or conditions regarding the financial
efficacy of any transaction completed utilizing a Starfield Certificate or any services provided in respect toStarfield Certificates and neither Starfield nor any independent third-party RA operating under a Starfield CA,
nor any Resellers, Co-marketers, nor any subcontractors, distributors, agents, suppliers, employees, ordirectors of any of the foregoing shall have any liability except as explicitly set forth herein in respect to theuse of or reliance on a Starfield Certificate or any services provided in respect to Starfield Certificates.

2.3.1 INDEMNIFICATION BY SUBSCRIBERS AND R ELYING PARTIES
2.3.1.1

INDEMNIFICATION BY SUBSCRIBERS
Starfield's Subscriber Agreement and other Subscriber Agreements shall require Subscribers toindemnify, to the extent permitted by law, Starfield and any non-Starfield CAs or RAs against
any and all liabilities, losses, costs, expenses, damages, claims, and settlement amounts (including
reasonable attorney’s fees, court costs, and expert’s fees) arising out of or relating to any use or
reliance by a Relying Party on any Starfield Certificate or any service provided in respect to Starfield
Certificates, including:• Any false statement, omission or misrepresentation of fact that the Subscriber has put on the
Subscriber's Certificate Application,• Any modification made by the Subscriber to the information contained in a Starfield Certificate,• The use of a Starfield Certificate other than as permitted by the Starfield CPS, the Subscription
agreement, any Relying Party agreement, and applicable law,
• The Subscriber's failure to use a secure system, protect the Subscriber's private key, or to otherwise
take the precautions necessary to prevent the compromise, loss, disclosure, modification, or
unauthorized use of the Subscriber's private key, or• The Subscriber's use of a name (including without limitation within a common name, domain name,or e-mail address) that infringes upon the Intellectual Property Rights of a third party.
2.3.1.2

INDEMNIFICATION BY RELYING PARTIES
Starfield's Subscriber Agreements and Relying Party Agreements shall require Relying Parties toindemnify Starfield and any non-Starfield CAs or RAs against, to the extent permitted by law,
any and all liabilities, losses, costs, expenses, damages, claims, and settlement amounts (including
reasonable attorney’s fees, court costs, and expert’s fees) arising out of or relating to any use or

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

reliance by a Relying Party on any Starfield Certificate or any service provided in respect to Starfield
Certificates, including:• Any failure by the Relying Party to perform the obligations of a Relying Party,• Lack of proper validation of a Starfield Certificate by a Relying Party,• Use of a Starfield Certificate other than as permitted by the Starfield CPS, the Subscription
agreement, any Relying Party agreement, and applicable law,
• Failure by a Relying Party to exercise reasonable judgment in the circumstances in relying on a
Starfield Certificate.
• Reliance by a Relying Party on a Certificate that is not reasonable under the circumstances, or• The failure of a Relying Party to check the status of such Certificate to determine if it is expired or
revoked.

2.3.2 FIDUCIARY RELATIONSHIPS

Starfield is not the agent, fiduciary, trustee, or other representative of Subscribers or Relying Parties.
Starfield’s Subscriber agreements and Relying party agreements shall disclaim, to the extent permitted bylaw, any fiduciary relationship between Starfield or a non-Starfield CA or RA, and between a Subscriber or
Relying party.

2.3.3 ADMINISTRATIVE PROCESSESNo stipulation.

2.4 INTERPRETATION AND ENFORCEMENT
2.4.1 GOVERNING LAW

The laws of the state of Arizona, USA, shall govern the enforceability, construction, interpretation, andvalidity of this CPS, subject to any limits appearing in applicable law, and regardless of contract or otherchoice of law provisions and without the requirement to establish a commercial nexus in Arizona, USA.
The choice of law is made to create uniform procedures and interpretation for all Starfield PKI
participants, no matter where they are located.
This governing law provision applies only to this CPS. Agreements incorporating the CPS by reference may
have their own governing law provisions, provided that this CPS 2.4.1 governs the enforceability,
construction, interpretation, and validity of the terms of the CPS separate and apart from the remaining
provisions of any such agreements, subject to any limitations appearing in applicable law.
Any applicable national, state, local and foreign laws, rules, regulations, ordinances, decrees, and orders
including, but not limited to, restrictions on exporting or importing software, hardware, or technicalinformation shall apply to this CPS.

2.4.2 SEVERABILITY, SURVIVAL, MERGER AND NOTICEThis CP/CPS shall be binding on all successors of the parties.

If any provision of this CP/CPS is found to be unenforceable, the remaining provisions shall be interpreted
to best carry out the reasonable intent of the parties. It is expressly agreed that every provision of thisCopyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

CP/CPS that provides for a limitation of liability or exclusion of damages, disclaimer or limitation of any
warranties, promises or other obligations, is intended to be severable and independent of any otherprovision and is to be enforced as such.
This CPS shall be interpreted consistently with what is commercially reasonable in good faith under thecircumstances and considering its international scope and uniform application. Failure by any person to
enforce a provision of this CP/CPS will not be deemed a waiver of future enforcement of that or any otherprovision.
Any notice, demand, or request pertaining to this CP/CPS shall be communicated either using email
consistent with this CP/CPS, or in writing. Electronic communications shall be effective when received by
the intended recipient.

2.4.3 DISPUTE RESOLUTION PROCEDURES

In the event of any dispute involving the services or provisions covered by this CP/CPS, the aggrievedparty shall notify Starfield management regarding the dispute. Starfield management will involve theappropriate Starfield personnel to resolve the dispute.

2.5 FEES
2.5.1 CERTIFICATE ISSUANCE OR RENEWAL FEES

Starfield and Customers may charge end-user Subscribers for the issuance, management, and renewal of
Certificates.

2.5.2 CERTIFICATE ACCESS FEES

Starfield reserves the right to charge a fee for making a Certificate available in a repository or otherwise.

2.5.3 STATUS INFORMATION ACCESS OR REVOCATION FEES

Starfield does not charge a fee as a condition of making the CRLs required by CPS §4.4.9 available in a
repository or otherwise available to Relying Parties. Starfield reserves the right to charge a fee forproviding customized CRLs, OCSP services, or other value-added revocation and status information
services. Starfield does not permit access to revocation information, Certificate status information, or
time stamping in its repository by third parties that provide products or services that utilize such
Certificate status information without Starfield’s prior express written consent.

2.5.4 FEES FOR OTHER SERVICES SUCH AS POLICY INFORMATION

Starfield does not charge a fee for accessing this CPS or the CP. However, any use of the CPS for purposes
other than viewing the document, including reproduction, redistribution, modification, or creation ofderivative works, may be subject to a license agreement with the entity holding the copyright to the
document.

2.5.5 REFUND POLICY

The following refund policy is in effect:
Starfield employs strict practices and policies in its certification operations and in issuing certificates. If for
any reason a Subscriber is not completely satisfied with the certificate that has been issued to the
Subscriber, the Subscriber may ask Starfield to revoke the certificate within 30 days of issuance for arefund, minus any fees. Following the initial 30 day period, a Subscriber may ask Starfield to revoke the
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

certificate and provide a refund if Starfield has breached a warranty or other material obligation under
this CPS relating to the Subscriber or the subscriber's certificate. After Starfield revokes the subscriber's
certificate, Starfield will promptly credit the Subscriber's credit card account (if the certificate was paid forvia credit card) or otherwise reimburse the Subscriber via check, for the full amount minus fees, of theamount paid for the certificate. To request a refund, please call customer service at +1 (480) 505-8855.
This refund policy is not an exclusive remedy and does not limit other remedies that may be available tosubscribers.

2.6 PUBLICATION AND REPOSITORY
2.6.1 PUBLICATION OF CA INFORMATIONThis CP/CPS is published in the Starfield repository at http://www.starfieldtech.com/repository/
in accordance with the provisions of §8 of this CPS.

2.6.2 FREQUENCY OF PUBLICATIONThis CP/CPS is published in accordance with §2.6.1. CRLs are published in accordance with §4.4.9.

2.6.3 ACCESS CONTROLS

Read access to the Starfield repository is unrestricted. Write access to the repository is restricted toauthorized Starfield PKI personnel through the use of appropriate logical access controls.

2.6.4 REPOSITORIESThe Starfield repository shall contain the current and historical versions of this CP/CPS, a fingerprint of theStarfield Root CAs, current CRLs for the Starfield CAs, and other information relevant to Subscribers andRelying Parties.
Starfield also maintains a database of issued certificates and CRLs to which access is restricted toauthorized Starfield PKI personnel.
The Starfield Repository is located at http://www.starfieldtech.com/repository

2.7 COMPLIANCE AUDIT
2.7.1 FREQUENCY OF ENTITY COMPLIANCE AUDITThe Starfield PKI is subject to an annual WebTrust for Certification Authorities (WebTrust for CAs)
examination. The Starfield PKI is also subject to an annual WebTrust for Extended
Validation (WebTrust for EV) examination, as it relates to the issuance of Extended Validation certificatesfrom the Starfield issuing CAs.

2.7.2 IDENTITY /QUALIFICATIONS OF AUDITOR

Auditors demonstrating proficiency in public key infrastructure technology, information security tools
and techniques, security auditing, and the third-party attestation function shall perform the annual
WebTrust for CAs and WebTrust for EV examinations. The audit firm must be currently licensed to
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

perform WebTrust for CA audits and WebTrust EV Program audits, be a member of the American Instituteof Certified Public Accountants (AICPA), and maintain professional liability/errors & omissions insurancewith policy limits of at least one million United States Dollars ($1,000,000.00) in coverage.

2.7.3 AUDITOR'S RELATIONSHIP TO AUDITED PARTY

The entity that performs the annual audit shall be organizationally independent of Starfield.

2.7.4 TOPICS COVERED BY AUDITThe scope of the annual audit shall include the requirements of this CP/CPS, CA environmental controls,
CA key management, and certificate life cycle management.

2.7.5 ACTIONS TAKEN AS A RESULT OF AN AUDIT DEFICIENCY

Significant deficiencies identified during the compliance audit will result in a determination of actions to
be taken. The Starfield Governance and Policy Authority Committee makes this determination with input
from the auditor. Starfield Management is responsible for ensuring that corrective action plans arepromptly developed and corrective action is taken within a period of time commensurate with thesignificance of such matters identified.
Should a severe deficiency be identified that might compromise the integrity of the Starfield PKI, Starfield
Management will consider, with input from the auditor, whether suspension of Starfield PKI operations iswarranted. Should a severe deficiency be identified that might compromise the integrity of a particular
CA, Starfield PKI Management will assess whether suspension of the particular CA’s operations iswarranted.

2.7.6 COMMUNICATION OF RESULTS

Compliance audit results are communicated to Starfield Management and others deemed appropriate byStarfield Management.

2.8 CONFIDENTIALITY
2.8.1 TYPES OF INFORMATION TO BE KEPT CONFIDENTIAL

Sensitive Starfield PKI information must remain confidential to Starfield. The following information isconsidered confidential to Starfield and may not be disclosed:• Starfield PKI policies, procedures and technical documentation supporting this CP/CPS• Subscriber registration records, including:- Certificate applications, whether approved or rejected- Proof of identification documentation and details- Certificate information collected as part of the registration records, beyond that which is
required to be included in Subscriber certificates• Audit trail records• Any private key within the Starfield PKI hierarchy• Compliance audit results except for WebTrust for CAs audit reports which may be published at thediscretion of Starfield Management

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

2.8.2 TYPES OF INFORMATION NOT CONSIDERED CONFIDENTIAL
This CP/CPS and Certificates and CRLs issued by Starfield are not considered confidential.

2.8.3 DISCLOSURE OF CERTIFICATE REVOCATION INFORMATION

Subscriber certificate status information is made available to Relying Parties through the use of CRLs and
OCSP. The transactional records and other information leading up to a certificate revocation are
considered confidential information.

2.8.4 RELEASE TO LAW ENFORCEMENT OFFICIALS

As a general principle, no document or record (including registration records) belonging to or controlled
by the Starfield PKI is released to law enforcement agencies or officials except where the law enforcement
official is properly identified and where the release of specific information is:• required by applicable laws or regulations• pursuant to a subpoena or order of a court or other government or regulatory authority with which
Starfield is legally obligated to comply• pursuant to a demand made by any government regulatory agency or authority with jurisdiction overStarfield.

2.8.5 RELEASE AS PART OF CIVIL DISCOVERY

As a general principle, no document or record belonging to or controlled by the Starfield PKI is released toany person except where:• a properly constituted instrument requiring production of the information is produced and• the person requiring production is a person authorized to do so by a court of law and is properly
identified.

2.8.6 DISCLOSURE UPON OWNER'S REQUESTNo stipulation.

2.8.7 OTHER INFORMATION RELEASE CIRCUMSTANCESNo stipulation.

2.9 INTELLECTUAL PROPERTY RIGHTSIntellectual Property Rights among Starfield PKI Participants other than Subscribers and Relying Parties aregoverned by the applicable agreements among such Starfield PKI Participants. The following subsections of
CPS 2.9 apply to Intellectual Property Rights in relation to Subscribers and Relying Parties.

2.9.1 PROPERTY RIGHTS IN CERTIFICATES AND R EVOCATIONINFORMATIONThe Intellectual Property Rights pertaining to the Certificates of CAs and revocation information that areissued by CAs shall be retained by those CAs. Provided the Certificates are reproduced in full and that useof such Certificates is subject to the Relying Party agreement, Starfield and Subscribers grant permission
to reproduce and distribute the Certificates on a nonexclusive royalty-free basis. Starfield and Subscribers
shall grant permission to use revocation information to perform Relying Party functions subject to theapplicable Relying party agreement or any other applicable agreements.

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

2.9.2 PROPERTY RIGHTS IN THE AGREEMENT

Starfield PKI Participants acknowledge that Starfield retains all Intellectual Property Rights in and to thisCPS.

2.9.3 PROPERTY RIGHTS TO NAMES

Certificate applicants retain all rights, if they have any, in any trademark, service mark, or trade namecontained in any Certificate Application and distinguished name within any Certificate issued to them.
Starfield retains all rights it has in any trademark, service mark, trade name, or other identifying trade
symbols that it owns.

2.9.4 PROPERTY RIGHTS IN KEYS AND KEY MATERIALAll Key Pairs corresponding to Certificates of CAs and end-user Subscribers are the property of those CAs
and end-users, regardless of where they are stored physically, and those persons retain all Intellectual
Property Rights in and to those key pairs. Without limiting the generality of the foregoing, Starfield’s RootCA Public keys and the root Certificates containing them are the property of Starfield. Starfield grants
licenses to software and hardware manufacturers to reproduce such root Certificates to place copies intrustworthy hardware devices or software. Finally, without limiting the generality of the foregoing, Secret
Shares of a CA’s private key are the property of the CA, and the CA retains all Intellectual Property Right inand to such Secret Shares.
The following are the property of Starfield:• This CPS• Starfield-specified Certificate Policies• Policies and procedures supporting the operation of the Starfield PKI• Starfield-specified Object Identifiers (OIDs)• Certificates and CRLs issued by Starfield CAs• Distinguished Names (DNs) used to represent entities within the Starfield PKI• CA and infrastructure key pairs.

3

IDENTIFICATION AND AUTHENTICATION
3.1 INITIAL REGISTRATION
3.1.1 TYPES OF NAMESAll certificate holders require either a Distinguished Name in the Subject field that is in compliance with
the X.500 standard for Distinguished Names, or a set of Subject Alternative Name values in the Subject
Alternative Name extension. In the case where subject identity information is contained solely in the
Subject Alternative Name extension, the Subject field of the certificate shall be empty. The Starfield PKI
approves naming conventions for the creation of distinguished names and Subject Alternative Namevalues for certificate applicants.
The Issuer and Subject Distinguished Name fields for Certificates issued by Starfield are populated inaccordance with §7.1.

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

3.1.2 NEED FOR NAMES TO BE MEANINGFULFor Starfield PKI certificates that contain a Distinguished Name in the Subject field, said DistinguishedNames shall be meaningful. For Starfield PKI certificates with an empty Subject field, any information
contained in the Subject Alternative Name extension may or may not be meaningful depending on thetype and intended use of the certificate..

3.1.3 RULES FOR INTERPRETING VARIOUS NAME FORMS
Name forms are interpreted in accordance with §3.1.1 and 3.1.2.

3.1.4 UNIQUENESS OF NAMESDistinguished Names of Extended Validation and High Assurance SSL certificates are to be unambiguous
and unique within the Starfield CA’s domain, except in the case of a single Subscriber who is permitted tohave multiple active certificates with identical Subject Distinguished Names. Multiple Medium Assurance
and Code Signing certificates containing the same Subject Distinguished Name are permitted within theStarfield CA’s domain.
No stipulation is made of the uniqueness of any naming information contained within the custom
certificate types specified in §7.1.6.

3.1.5 NAME CLAIM DISPUTE RESOLUTION PROCEDURE

Certificate Applicants are prohibited from using names in their Certificate Applications that infringe uponothers’ Intellectual Property Rights. Starfield does not verify whether a Certificate Applicant has
Intellectual Property rights in the name appearing in a Certificate Application nor does Starfield arbitrate,
mediate, prosecute, or otherwise resolve any dispute concerning the ownership of any domain name,trade name, trademark, or service mark. Starfield may, without liability to any Certificate applicant, rejector suspend any Certificate application because of such dispute.

3.1.6 RECOGNITION, AUTHENTICATION AND ROLE OF TRADEMARKS
See §3.1.5.

3.1.7 METHOD TO PROVE POSSESSION OF PRIVATE KEY

The Subscriber’s certificate request must contain the public key to be certified and be digitally signed withthe corresponding private key.

3.1.8 DOMAIN NAME ACCESS VERIFICATION

Verification of domain name access is performed when a domain name is first requested for a certificate
in a given customer account.
Verification of domain name access is performed when a Subscriber requests the renewal of a certificate,but only if the previous verification was performed more than 13 months prior to the renewal request.
(see §3.4).
For Subscriber Certificates issued prior to August 8, 2011 at 0700 UTC:
Once a certificate has been issued, no further verification of the domain name(s) within the certificate is
performed during the validity period of the issued certificate.
For Subscriber Certificates issued on or after August 8, 2011 at 0700 UTC:
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

Once a certificate has been issued, re-verification of domain name access is conducted in accordance with
§3.8.

3.1.9 MEDIUM ASSURANCE AUTHENTICATIONFor Medium Assurance Subscribers, Starfield verifies the following:• the individual requesting the certificate has access to the domain name(s) that are specified in thecertificate application

3.1.10 HIGH ASSURANCE AUTHENTICATION FOR INDIVIDUAL SUBSCRIBERS
For High Assurance Individual Subscribers, Starfield verifies the following:• the individual requesting the certificate has access to the domain name(s) that are specified in thecertificate application• the identity of the individual named in the certificate application

3.1.11 HIGH ASSURANCE AUTHENTICATION FOR ORGANIZATIONALSUBSCRIBERS

All For High Assurance Organizational Subscribers, Starfield verifies the following:• the individual requesting the certificate has access to the domain name(s) that are specified in thecertificate application• the individual requesting the certificate is authorized to do so by the organization named in thecertificate• the organization name represents an organization currently registered with a government authority
In the case of a small business/sole proprietorship that is not registered with a government authority,
Starfield will optionally include the entity’s “doing business as” (DBA) name in an informational,
unauthenticated “organizational unit” (OU) field.

3.1.12 HIGH ASSURANCE AUTHENTICATION FOR CODE SIGNING
SUBSCRIBERS

For High Assurance Code Signing Subscribers, Starfield verifies the following:• the individual requesting the certificate is authorized to do so by the organization named in thecertificate• the organization name represents an organization currently registered with a government authority

3.1.13 UNIFIED COMMUNICATIONS CERTIFICATE AUTHENTICATION

The individual requesting the certificate is confirmed to have access to every fully qualified domain nameincluded in the Subject Common Name or Subject Alternative Name fields of a UCC certificate. Only one
Individual (as described in §3.1.10) or one Organization (as described in §3.1.11) is authenticated for eachHigh Assurance UCC certificate.

3.1.14 EXTENDED VALIDATION AUTHENTICATIONFor Extended Validation Subscribers, Starfield verifies the following in accordance with the CA/Browser
Forum Guidelines for the Issuance and Management of Extended Validation Certificates:• Legal Existence and Identity• Assumed Name (optional)
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

• Physical Existence• Operational Existence (if records indicate that the organization is less than three years old)
• Domain ownership or exclusive right to use• Name, title, and authority of contract signer, and certificate approver

3.1.15 CUSTOM CERTIFICATE AUTHENTICATION

Starfield may issue certificates designed for use in a specific peer-to-peer application. These certificatesare designed for use only in that application and steps are taken to ensure that they will not function forstandard uses such as SSL or code signing. For certificates issued for a specialized usage, Starfield verifies
the following:• information contained in the certificate that identifies a person or organization has been validated• the requestor possesses a valid license key for the product on which the certificate will be used

3.2 ROUTINE RE-KEY

Routine re-key of CAs is performed in accordance with §4.8.
Subscribers are permitted to submit an unlimited number of requests to re-key any valid Certificate during thevalidity period of the Certificate.

3.3 RE-KEY AFTER REVOCATIONIn the event that a Starfield CA certificate must be revoked, the CA will be re-keyed in accordance with §4.8 or
terminated in accordance with §4.10.
The process for re-key after revocation of a Subscriber certificate is complete re-enrollment, which requires
the generation of a new Subscriber key pair and the re-performance of the initial Subscriber identification andauthentication procedures specified in §3.1.8 -- 3.1.15.

3.4 CERTIFICATE RENEWAL

Certificate renewal, defined as the process whereby a new certificate with an extended validity period iscreated for an existing Distinguished Name, is permitted for CA Certificates.
Subscribers are permitted to reuse a previous certificate request to replace an expiring or expired Certificate.
Where the Subscriber holds a Certificate and the initial Subscriber identification and authentication process(as described in §3.1.8 -- 3.1.15) has been performed within the previous 13 months, Starfield may
authenticate a renewal certificate request using a shared secret.

3.5 REVOCATION REQUEST

Subscriber certificate revocation requests may be submitted by the Subscriber via an online certificate
revocation request page. Such requests are authenticated using a shared secret.
If the revocation request cannot be authenticated using a shared secret, the RA must perform sufficient
procedures to authenticate the revocation request in accordance with Starfield’s revocation request
processing procedures.

3.6 SUSPENSION REQUEST
See §4.4.

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

3.7 REQUEST TO RELEASE SUSPENSION
See §4.4.

3.8 RE-VERIFICATION OF SUBSCRIBER INFORMATIONThis §3.8 only applies to Subscriber Certificates issued on or after August 8, 2011 at 0700 UTC.
For Subscriber Certificates with a validity period of thirty-nine (39) months or less, no re-verification of any
Subscriber information is performed during the validity period of the Certificate.
For Subscriber Certificates with a validity period of more than thirty-nine (39) months, all Subscriber
information that is required for the issuance of the Certificate will be re-verified at least every thirty-six (36)months during the validity period of the Certificate.
If any required Subscriber information has not been verified within the past thirty-nine (39) months, the (endentity, non-CA) Certificate(s) relying on that information will be revoked.

4 OPERATIONAL REQUIREMENTS
4.1 CERTIFICATE APPLICATION

Certificate applications must include all information required by the relevant Starfield certificate applicationform.

4.2 CERTIFICATE ISSUANCE

Certificates are generated, issued and published only after the RA performs the required identification andauthentication steps in accordance with §3.1.8 -- 3.1.15.

4.3 CERTIFICATE ACCEPTANCE

A Subscriber’s receipt of a certificate and subsequent use of the key pair and certificate constitute certificate
acceptance. By accepting a certificate, the Subscriber:• Agrees to be bound by the continuing responsibilities, obligations and duties imposed by this CP/CPS,• Agrees to be bound by the Subscribing Party agreement, and• Represents and warrants that to its knowledge no unauthorized person has had access to the private key
associated with the certificate, and• Represents and warrants that the certificate information it has supplied during the registration process istruthful and has been accurately and fully published within the certificate.

4.4 CERTIFICATE SUSPENSION AND REVOCATION

Starfield supports certificate revocation for all Starfield CAs. Starfield does not support certificate suspension.

4.4.1 CIRCUMSTANCES FOR REVOCATIONA certificate may be revoked under any or all of the following circumstances:• The Subscriber or authorized Reseller on behalf of the Subscriber requests certificate revocation inaccordance with §3.5.
• The certificate subject can be shown to have violated the stipulations of this CP/CPS, or compromise thesecurity or integrity of the Starfield PKI.
• The Subscriber can be shown to have violated the stipulations of the Subscriber Agreement.
• Compromise of the Subscriber’s private key is known or suspected.
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

• The authenticated organization or individual name in the Subject field of the Subscriber’s certificate
changes before the certificate expires.
• The Subscriber fails to pay any invoice from Starfield within forty-five (45) days of receiving it.

4.4.2 WHO CAN REQUEST REVOCATION

Subscriber certificate revocation can be initiated by the Subscriber, Starfield, or authorized Resellers.

4.4.3 PROCEDURE FOR REVOCATION REQUEST

Subscriber certificate revocation requests are authenticated using a shared secret or in accordance with
Starfield’s revocation request processing procedures.

4.4.4 REVOCATION R EQUEST GRACE PERIOD

Starfield validates automated revocation requests (i.e., where a shared secret is correctly provided) on
receipt. Starfield commences the validation of non-automated revocation requests within one business
day of receipt.
Starfield immediately processes authenticated revocation requests. A certificate’s revoked status isreflected on a CRL published within seven days of the processing of an authenticated revocation request.
Revoked certificates are listed in the CRL until the certificate expires, with the exception of Code Signing
certificates which are retained on the CRL after certificate expiration.

4.4.5 CIRCUMSTANCES FOR SUSPENSION
Not applicable.

4.4.6 WHO CAN REQUEST SUSPENSION
Not applicable.

4.4.7 PROCEDURE FOR SUSPENSION REQUEST
Not applicable.

4.4.8 LIMITS ON SUSPENSION PERIOD
Not applicable.

4.4.9 CRL ISSUANCE FREQUENCY

CRLs for Starfield CAs are issued in accordance with the following table.
CA Type
CRL Publication Frequency
Root CAs
Every 365 days or less and upon certificate revocation
Issuing CAs
Every 7 days of less4.4.10 CRL CHECKING REQUIREMENTS

Relying Parties are required to check certificate status using the applicable CRL and/or OCSP before
relying upon a certificate.

4.4.11 ONLINE REVOCATION/STATUS CHECKING AVAILABILITYOCSP responses for Starfield CAs are issued in accordance with the following table.

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

CA Type
Root CAs
Issuing CAs

OCSP Update Frequency
Every 365 days or less and upon certificate revocation if OCSP is enabled for the Root CA
Every 4 days of less4.4.12 ONLINE REVOCATION CHECKING REQUIREMENTS
No stipulation.

4.4.13 OTHER FORMS OF REVOCATION ADVERTISEMENTS AVAILABLE
No stipulation.

4.4.14 CHECKING REQUIREMENTS FOR OTHER FORMS OF REVOCATIONADVERTISEMENTS
No stipulation.

4.4.15 SPECIAL REQUIREMENTS FOR KEY COMPROMISE

There is no deviation from the certificate revocation procedures specified above when the revocation of a
Subscriber certificate is due to private key compromise.
In addition to the procedures specified above, if deemed necessary, Starfield uses commerciallyreasonable efforts to notify potential Relying Parties if Starfield discovers, or has reason to believe, that
there has been a compromise of a Starfield CA private key.

4.5 CERTIFICATE PROBLEM REPORTING AND RESPONSE

Starfield supports certificate revocation for all Starfield CAs. Starfield does not support certificate suspension.

4.5.1 REPORTING

The Starfield PKI allows Subscribers, Relying Parties, Application Software Vendors, and other third parties
to report complaints or suspected Private Key compromise, EV Certificate misuse, or other types of fraud,
compromise, misuse, or inappropriate conduct related to EV Certificates via email or telephone as
published in the Starfield repository.

4.5.2 INVESTIGATION

Starfield will begin investigation of all certificate problem reports within twenty-four (24) hours anddecide whether revocation or other appropriate action is warranted based on at least the following
criteria:(i) The nature of the alleged problem;(ii) Number of Certificate Problem Reports received about a particular EV
Certificate or website;(iii)The identity of the complainants (for example, complaints from a law enforcement official that a website is engaged in illegal activities have more weight than a complaint from a consumer alleging they neverreceived the goods they ordered); and(iv) Relevant legislation in force.

4.5.3 RESPONSE
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

Starfield maintains a continuous 24/7 ability to respond to any high priority certificate problem reports
and to revoke certificates in accordance with §4.4 and/or report the problem to law enforcement officials.

4.6 SECURITY AUDIT PROCEDURES

Starfield supports certificate revocation for all Starfield CAs. Starfield does not support certificate suspension.

4.6.1 TYPES OF EVENTS RECORDEDThe Starfield PKI logs the following events:• Significant CA key life cycle management events including CA key generation backup, storage, archival,and destruction and other cryptographic device lifecycle management events• CA and Subscriber certificate life cycle management events- Requests for certificates, renewal, re-key, and revocation- Successful or unsuccessful processing of requests- Generation and issuance of certificates- Revocation of certificates- Issuance of CRLs and generation of OCSP entries- All verification activities required by applicable guidelines- Date, time, phone number used, persons spoken to, and end results of verification telephone
calls• Security-sensitive operating system events - Successful and unsuccessful PKI system access attempts;- PKI and security system actions performed;- Security profile changes;- System crashes, hardware failures, and other anomalies;- Firewall and router activities; and- Entries to and exits from CA facility• CA facility entry/exit.
• Separation of validation duties between multiple RAs for Extended Validation certificates

4.6.2 REQUIRED DATA ELEMENTS

All audit logs include, at a minimum:• Date and time of entry• Identity of the persona and entity making the journal entry• Description of entry

4.6.3 FREQUENCY OF PROCESSING LOG
Audit logs are reviewed on an as-needed basis.

4.6.4 RETENTION PERIOD FOR AUDIT LOG
Audit logs are retained as follows:
Log Type
Logs of CA key management activity
CA system logs of certificate management activity
Operating system logs
Physical access system logs
Manual logs of physical accessVideo recording of CA facility access

Retention Period
30 years
30 years
5 years
5 years
5 years
90 days

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

4.6.5 PROTECTION OF AUDIT LOG

Production and archived logical and physical audit logs are protected using a combination of physical andlogical access controls.

4.6.6 AUDIT LOG BACKUP PROCEDURES
Audit logs are backed up on a periodic basis.

4.6.7 AUDIT COLLECTION SYSTEM (INTERNAL VS . EXTERNAL)

Automated audit data is generated and recorded at the application, network, and operating system level.
Manually generated audit data is recorded by Starfield employees.

4.6.8 NOTIFICATION TO EVENT-CAUSING SUBJECT

Where an event is logged by the audit collection system, no notice is required to be given to the individual
or system that caused the event.

4.6.9 VULNERABILITY ASSESSMENTS

Starfield performs periodic vulnerability assessments of its PKI environment. The results of suchassessments are used to enhance the security of the environment.

4.7 RECORDS ARCHIVAL

The Starfield PKI maintains an archive of relevant records for each CA.

4.7.1 TYPES OF EVENTS RECORDED

Starfield maintains an archive of logs that include the recorded events specified in §4.6.1.

4.7.2 RETENTION PERIOD FOR ARCHIVE

Starfield archives and retains audit logs in accordance with §4.6.4.

4.7.3 PROTECTION OF ARCHIVE
See §4.6.5.

4.7.4 ARCHIVE BACKUP PROCEDURES

Starfield maintains copies of its archived records at separate locations.

4.7.5 REQUIREMENTS FOR TIME-STAMPING OF RECORDS

Starfield PKI system clocks are synchronized with a third party time source. Automated journal entries
include a system generated date and time field. Manual journal entries include a manually entered date
and time field.

4.7.6 ARCHIVE COLLECTION SYSTEM (INTERNAL OR EXTERNAL)No stipulation.

4.7.7 PROCEDURES TO OBTAIN AND VERIFY ARCHIVE INFORMATIONNo stipulation.

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

4.8 KEY CHANGEOVER

Starfield CAs will stop issuing certificates and will be re-keyed or terminated before the maximum key usage
period for certificate signing is reached in accordance with §6.3.2. The CA will continue to sign and publish
CRLs until the end of the CA certificate lifetime. The key changeover or CA termination process will be
performed such that it causes minimal disruption to Subscribers and Relying Parties. Affected entities will be
notified prior to the planned key changeover.

4.9 COMPROMISE AND DISASTER RECOVERYTo enable the recovery its PKI operations in the event of a disaster, Starfield has implemented the following:• Secure storage of backup cryptographic hardware modules containing copies of the Starfield CA private keys
at an alternate location• Secure storage of the requisite activation materials at an alternate location• Secure storage of backups of system, data, and configuration information• Secured disaster recovery site where operations can be restored in the event of a disaster at Starfield’s
primary location• Disaster recovery plan
• Periodic disaster recovery plan testing.
Starfield has implemented a combination of physical, logical and procedural controls to guard against CA key
compromise. In the event of a known or suspected CA key compromise, Starfield management will assess thesituation and determine the appropriate course of action.

4.10

CA TERMINATIONIn the event that it is necessary to terminate the operation of a Starfield CA, Starfield management will planand coordinate the termination process with its Subscribers and Relying Parties such that the impact of thetermination is minimized. Starfield will provide as much prior notice as is practicable and reasonable to
Subscribers and Relying Parties and preserve relevant records for a period of time deemed fit for functional
and legal purposes. Relevant certificates will be revoked no later than the time of the termination.

5 PHYSICAL, PROCEDURAL AND PERSONNEL SECURITYCONTROLS
5.1 PHYSICAL CONTROLS
5.1.1 SITE LOCATION AND CONSTRUCTION

Starfield PKI systems are hosted and managed using secure facilities in the Scottsdale, Arizona area withmultiple levels of physical access controls.

5.1.2 PHYSICAL ACCESS

Production Starfield PKI systems are housed in a secure facility requiring two factor authentication anddual control access to any physical device in the CA environment. Physical access to the CA facility is

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

automatically logged and video recorded on a 24x7 basis. Physical access to the CA facility is monitored
24x7 by onsite security personnel.

5.1.3 POWER AND AIR CONDITIONING

The supply of power to Starfield CA systems is protected through the use of UPS systems and generators.
Climate control systems have been implemented to ensure that the temperature within the CA facility is
maintained within reasonable operating limits.

5.1.4 WATER EXPOSURESThe CA hosting facility has been verified to reside outside of any designated 100-year flood plain.

5.1.5 FIRE PREVENTION AND PROTECTION

The Starfield CA hosting facility is equipped with a smoke detection system and a pre-action dry pipe fire
suppression system.

5.1.6 MEDIA STORAGE

Media containing production software, production data, and system audit information is stored secured
with appropriate physical and logical access controls designed to limit access to authorized personnel.

5.1.7 OFFSITE BACKUP

Offsite backup media are stored in a physically secure manner using a bonded third party storage facility.

5.1.8 WASTE DISPOSAL

Sensitive documents and materials are shredded before disposal. Media used to collect or transmit
sensitive information are rendered unreadable before disposal. Other waste is disposed of in accordancewith Starfield’s normal waste disposal requirements.
Cryptographic devices, smart cards, and other devices that may contain private keys or keying material
are physically destroyed or zeroized in accordance the manufacturers’ guidance prior to disposal.

5.2 PROCEDURAL CONTROLSThe Starfield PKI maintains an archive of relevant records for each CA.

5.2.1 TRUSTED ROLESAll Starfield personnel involved in the operation of the Starfield PKI are considered to serve in “trusted
roles.” Within the Starfield PKI, the following trusted roles exist:• Security, responsible for establishing and monitoring compliance with security policies, procedures, andstandards.
• Engineering/Architecture, responsible for the design and development of Starfield PKI systems.
• PKI Operations, responsible for administering, maintaining and monitoring the systems supporting theStarfield PKI.
• Key Management, responsible for management of cryptographic materials.
• RA Operations, responsible for processing certificate requests and revocation requests.

5.2.2 NUMBER OF PERSONS REQUIRED PER TASK
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

Cryptographically sensitive operations within the Starfield PKI such as CA key generation, CA key recovery,
CA key activation and CA system configuration require the participation of multiple “trusted” individuals
in accordance with §6.2.2. Other operations may require only one trusted individual.

5.2.3 IDENTIFICATION AND AUTHENTICATION FOR EACH ROLE

Each person performing a trusted role within the Starfield PKI must be authorized by management toperform such functions and must satisfy the personnel requirements specified in §5.3.

5.3 PERSONNEL CONTROLSThe Starfield PKI maintains an archive of relevant records for each CA.

5.3.1 BACKGROUND, QUALIFICATIONS, EXPERIENCE, AND CLEARANCEREQUIREMENTS

The recruitment and selection practices for Starfield PKI personnel take into account the background,
qualifications, experience, and clearance requirements of each position, which are compared against the
profiles of potential candidates.

5.3.2 BACKGROUND CHECK PROCEDURES

Background checks are performed prior to their commencement of employment with Starfield. Suchchecks include identity verification and checks of character references, employment, education andcriminal record. Starfield employees are also required to complete a drug screening.
Starfield employees are required to sign a nondisclosure agreement and are required to adhere toStarfield PKI policies and procedures.

5.3.3 TRAINING REQUIREMENTS

All Starfield PKI personnel receive on the job training covering:• Basic PKI concepts• This CP/CPS• Documented Starfield PKI security and operational policies and procedures• The use and operation of PKI system software.
• Common threats to the validation process including phishing and other social engineering tactics

5.3.4 RETRAINING FREQUENCY AND REQUIREMENTS

Starfield PKI personnel receive formal or informal training on the use of deployed PKI products andStarfield PKI policies and procedures, upon hire and as necessary. Security awareness campaigns are
ongoing.

5.3.5 JOB ROTATION FREQUENCY AND SEQUENCE
No stipulation.

5.3.6 SANCTIONS FOR UNAUTHORIZED ACTIONSIn accordance with corporate polices, appropriate disciplinary actions will be taken for unauthorized
actions or other violations of Starfield PKI policies and procedures.

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

5.3.7 CONTRACTING PERSONNEL REQUIREMENTS

Starfield PKI may employ contractors as necessary. Where contractors are used by the Starfield PKI, they
are subject to background check procedures comparable to those specified in §5.3.1 and §5.3.2.

5.3.8 DOCUMENTATION SUPPLIED TO PERSONNEL

Starfield PKI personnel are required to read this CP/CPS. They are also provided with Starfield PKI policies,
procedures, and other documentation relevant to their job functions.

6 TECHNICAL SECURITY CONTROLS
6.1 KEY PAIR GENERATION
6.1.1 KEY PAIR GENERATION

CA key pair generation uses cryptographic modules that meet the requirements of §6.2.1 and requires theparticipation of multiple trusted employees.
Subscriber key pair generation is performed by the Subscriber.

6.1.2 PRIVATE KEY DELIVERY TO ENTITY

Starfield CA key pairs do not require delivery as they are generated and managed by the Starfield PKI. As
Subscriber key pairs are generated by the Subscriber, there is no private key transportation requirement.

6.1.3 PUBLIC KEY DELIVERY TO CERTIFICATE ISSUER

CA certificate requests are generated and processed by Starfield employees using a controlled processthat requires the participation of multiple trusted individuals. CA certificate requests are PKCS #10
requests and accordingly contain the requesting CA’s public key and are digitally signed by the requesting
CA’s private key.
For Subscriber certificate requests, the Subscriber’s public key is submitted to the CA using a certificate
request signed with the Subscriber’s private key. This mechanism ensures that:• the public key has not been modified during transit and• the sender possesses the private key corresponding to the transferred public key.

6.1.4 CA PUBLIC KEY DELIVERY TO USERSThe Starfield Root CA is made available to Relying Parties through its inclusion in common browser
software.
The Starfield Root CA certificates may also be downloaded from the Starfield repository. A 160-bit SHA-1
hash and/or a 256-bit SHA-256 hash of the Starfield Root CA certificates are posted in the Starfield
repository so that users may verify the authenticity of the Starfield Root CA certificates.

6.1.5 KEY SIZES

Starfield CA key pairs are 1024 bit or higher RSA keys. Subscriber key pairs are 1024 bit or higher RSA
keys.
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

6.1.6 PUBLIC KEY PARAMETERS GENERATION AND QUALITY CHECKING
Not applicable.

6.1.7 HARDWARE/SOFTWARE KEY GENERATION

Starfield CA key pairs are generated in and protected by hardware security modules certified to FIPS 140-1
level 3.
Subscriber key pairs are generated and stored in hardware or software. It is recommended that the
Subscriber use a FIPS 140-1 certified cryptographic module for key generation.

6.1.8 KEY USAGE PURPOSES
Key pairs may be used as follows:
EntityRoot CAs
Issuing CAs
Subscriber

Permitted Key Usage
Signing of certificates for Subordinate CAs and other purposes as required for the Starfield
PKI and CRLs.
Signing of certificates for Subscribers and other purposes as required for The Starfield PKI
and CRLs.
Server authentication, digital signature, key encipherment, data encryption.

The key usage extension is set in accordance with the certificate profile requirements specified in §7.1.

6.2 KEY PAIR GENERATION
6.2.1 STANDARDS FOR CRYPTOGRAPHIC MODULE

The Starfield PKI uses cryptographic modules that are certified to FIPS 140-1 Level 3 and meet industry
standards for random number and prime number generation.

6.2.2 STANDARDS FOR CRYPTOGRAPHIC MODULE

The Root CA is operated in offline mode. The participation of multiple trusted employees is required toperform sensitive CA private key operations (including hardware security module (HSM) activation, SubCA certificate signing, CRL signing, CA key backup, and CA key recovery). This is enforced by:• requiring 3 of 5 shareholders to present their assigned activation materials to activate the hardware
security module• requiring 3 individuals to physically access the hardware security module• requiring 1 or more individuals with sufficient CA system privileges
The Issuing CA is operated in online mode. The participation of multiple trusted employees is required toperform sensitive CA private key operations (including HSM activation, CA key backup, and CA key
recovery). This is enforced by:• requiring 3 of 8 shareholders to present their assigned activation materials to activate the hardware
security module• requiring 2 individuals to physically access the online HSM• requiring 3 individuals to physically access activation materials required (for CA key backup andrecovery).
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

6.2.3 PRIVATE KEY ESCROWThe escrow of CA and Subscriber private keys, for purposes of access by law enforcement or any otherreason, is not supported by the Starfield PKI.

6.2.4 PRIVATE KEY BACKUP AND ARCHIVAL

Backup copies of CA private keys are stored in encrypted form using cryptographic modules that meet therequirements specified in §6.2.1.
Once a CA has reached the end of its maximum usage period as defined in §6.3.2, HSMs containing the CA
private key will be zeroized and/or securely destroyed.
Subscriber private keys are not backed up or archived by the Starfield PKI.

6.2.5 PRIVATE KEY ENTRY INTO CRYPTOGRAPHIC MODULE

CA private keys are generated and used only within hardware cryptographic modules meeting therequirements of §6.2.1. The private key exists outside hardware cryptographic modules only in encryptedform.

6.2.6 METHOD OF ACTIVATING PRIVATE KEYS

Hardware modules used for CA private key protection utilize an activation mechanism as described in§6.2.2.
Subscriber private keys should be protected with a pass phrase.

6.2.7 METHOD OF DEACTIVATING PRIVATE KEY

CA private keys are de-activated by ending the session with the HSM device.

6.2.8 METHOD OF DESTROYING PRIVATE KEY

CA private key destruction requires the participation of multiple trusted Starfield employees and approval
from Starfield management. When CA key destruction is required, CA private keys will be completely
destroyed through zeroization and/or physical destruction of the device in accordance with
manufacturers’ guidance.

6.3 OTHER ASPECTS OF KEY PAIR MANAGEMENT
6.3.1 PUBLIC KEY ARCHIVAL

Copies of CA and Subscriber certificates are archived in accordance with §4.7.

6.3.2 USAGE PERIODS FOR THE PUBLIC AND PRIVATE KEYS

For Starfield PKI CAs and Subscribers, key and certificate usage periods meet the following requirements.
EntityRoot CAs
Issuing CAs
Subscribers

Maximum Key Usage
Period (for certificate
signing)*
15 years
20 years
N/A

Maximum Key Usage
Period (for CRL signing)

Maximum Certificate
Validity Period

20 years
25 years
N/A

30 years
20 years
10 years (or maximum

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

allowed in applicableguidelines)*** Maximum Key Usage Period does not apply to certificates that serve an infrastructure purpose, such as
OCSP Responder certificates or Timestamp Authority certificates.
** As of June 2, 2009, the maximum validity period available for new subscriber certificate purchases is 5
years.

6.4 ACTIVATION DATA

HSMs used for CA private key protection are configured to require multiple key shareholders as described in§6.2.2. The activation materials are used only when needed and stored in a secure site when not in use.

6.5 COMPUTER SECURITY CONTROLS
6.5.1 PUBLIC KEY ARCHIVAL

Starfield’s systems maintaining CA software and data files are secure from unauthorized access. In
addition, access to production servers is limited to those individuals with a valid business reason for suchaccess.
Starfield’s production network is separate from other components. This separation prevents network
access except through specific application processes. Starfield has sophisticated access control
technologies in place to protect the production network from unauthorized internal and external accessand to limit network activities accessing production systems.

6.5.2 COMPUTER SECURITY RATING
No stipulation.

6.6 LIFE CYCLE TECHNICAL CONTROLS
6.6.1 SYSTEM DEVELOPMENT CONTROLSAll CA software is developed in accordance with documented Starfield Software Development Lifecycle
processes. Approvals are required at all stages of development by the Starfield Governance and Policy
Authority Committee. All code is verified, using digital signatures and hashing, before being deployed into
the production CA environment.

6.6.2 SECURITY MANAGEMENT CONTROLSStarfield has tools and processes in place to control and monitor the configurations of the CA systems.
Starfield validates the integrity of all software before release into production.

6.6.3 LIFE CYCLE SECURITY RATINGS
No stipulations

6.7 NETWORK SECURITY CONTROLSThe Starfield network is secured through the use of preventative (properly configured routers and firewalls)
and detective controls (monitoring systems). Starfield performs all CA and RA functions using networks
secured in accordance with the Starfield Operations Guide to ensure the systems are secure.
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

6.8 CRYPTOGRAPHIC MODULE ENGINEERING CONTROLSThe Starfield PKI uses cryptographic modules that meet the requirements of §6.2.1.

7 CERTIFICATE AND CRL PROFILES
7.1 CERTIFICATE PROFILES
7.1.1 ROOT CAS

The following certificate profile is used for the Starfield ValiCert Root CA.
Field
Description
Version
V1
Serial Number
1 (0x1)Signature Algorithm Identifier
sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerE = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Valid From
June 26, 1999 00:19:54 GMT
Valid To
June 26, 2019 00:19:54 GMT
Subject
E = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Subject Public Key Information
RSA (1024 bits)
The following certificate profile is used for the Starfield Class 2 Certification Authority.
Field
Description
Version
V3
Serial Number
0 (0x0)Signature Algorithm Identifier
sha1RSA
Issuer
OU=Starfield Class 2 Certification Authority
O=Starfield Technologies, Inc.
C=US
Valid From
June 29, 2004 17:39:16 GMT
Valid To
June 29, 2034 17:39:16 GMT
Subject
OU=Starfield Class 2 Certification Authority
O=Starfield Technologies, Inc.
C=US
Subject Public Key Information
RSA (2048 bits)
Extensions:
Basic Constraints
Subject Type=CA
Path Length Constraint=None
Authority Key Identifier
KeyID: bf 5f b7 d1 ce dd 1f 86 f4 5b 55 ac dc d7 10 c2 0e a9 88 e7
Certificate Issuer:
Directory Address:
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldSubject Key Identifier

Description
OU=Starfield Class 2 Certification Authority
O=Starfield Technologies, Inc.
C=US
Certificate SerialNumber=00
bf 5f b7 d1 ce dd 1f 86 f4 5b 55 ac dc d7 10 c2 0e a9 88 e7

The following certificate profile is used for the Starfield Root Certificate Authority – G2.
Field
Description
Version
V3
Serial Number
0 (0x0)Signature Algorithm Identifier
sha256RSA
Issuer
CN=Starfield Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
Valid From
September 1, 2009 00:00:00 GMT
Valid To
December 31, 2037 23:59:59 GMT
Subject
CN=Starfield Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
Subject Public Key Information
RSA (2048 bits)
Extensions:
Basic Constraints (critical)
Subject Type=CA
Path Length Constraint=None
Key Usage (critical)
keyCertSign, cRLSign
Subject Key Identifier
7c 0c 32 1f a7 d9 30 7f c4 7d 68 a3 62 a8 a1 ce ab 07 5b 27
The following certificate profile is used for the Go Daddy Class 2 Certification Authority.
Field
Description
Version
V3
Serial Number
0 (0x0)Signature Algorithm Identifier
sha1RSA
IssuerOU=Go Daddy Class 2 Certification Authority
O=The Go Daddy Group, Inc.
C=US
Valid From
June 29, 2004 17:06:20 GMT
Valid To
June 29, 2034 17:06:20 GMT
Subject
OU=Go Daddy Class 2 Certification Authority
O=The Go Daddy Group, Inc.
C=US
Subject Public Key Information
RSA (2048 bits)
Extensions:
Basic Constraints
Subject Type=CA
Path Length Constraint=None
Authority Key Identifier
KeyID=d2 c4 b0 d2 91 d4 4c 11 71 b3 61 cb 3d a1 fe dd a8 6a d4 e3Certificate Issuer:
Directory Address:
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldSubject Key Identifier

Description
OU=Go Daddy Class 2 Certification Authority
O=The Go Daddy Group, Inc.
C=US
Certificate SerialNumber=00
d2 c4 b0 d2 91 d4 4c 11 71 b3 61 cb 3d a1 fe dd a8 6a d4 e3

The following certificate profile is used for the Go Daddy Root Certificate Authority – G2.
Field
Description
Version
V3
Serial Number
0 (0x0)Signature Algorithm Identifier
sha256RSA
Issuer
CN=Go Daddy Root Certificate Authority - G2
O=GoDaddy.com, Inc.
L=Scottsdale
S=Arizona
C=US
Valid From
September 1, 2009 00:00:00 GMT
Valid To
December 31, 2037 23:59:59 GMT
Subject
CN=Go Daddy Root Certificate Authority - G2
O=GoDaddy.com, Inc.
L=Scottsdale
S=Arizona
C=US
Subject Public Key Information
RSA (2048 bits)
Extensions:
Basic Constraints (critical)
Subject Type=CA
Path Length Constraint=None
Key Usage (critical)
keyCertSign, cRLSign
Subject Key Identifier
3a 9a 85 07 10 67 28 b6 ef f6 bd 05 41 6e 20 c1 94 da 0f de
The following certificate profile is used for the Starfield Services Root Certification Authority.
Field
Description
Version
V3
Serial Number
0 (0x0)Signature Algorithm Identifier
sha1RSA
Issuer
CN= Starfield Services Root Certification Authority
OU=http://certificates.starfieldtech.com/repository/
O=Starfield Technologies, Inc.
L=Scottsdale
ST=Arizona
C=US
Valid From
June 2, 2008 00:00:00 GMT
Valid To
December 31, 2029 23:59:59 GMT
Subject
CN= Starfield Services Root Certification Authority
OU=http://certificates.starfieldtech.com/repository/
O=Starfield Technologies, Inc.
L=Scottsdale
ST=Arizona
C=US
Subject Public Key Information
RSA (2048 bits)
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldExtensions:
Key Usage (critical)
Basic Constraints (critical)
Authority Key Identifier
Subject Key Identifier

Description
keyCertSign, cRLSign
Subject Type=CA
Path Length Constraint=Noneb4 c6 7f 1a 43 cc 9b 75 5d 2f c4 4b f2 8b 98 10 e9 f1 51 10
b4 c6 7f 1a 43 cc 9b 75 5d 2f c4 4b f2 8b 98 10 e9 f1 51 10

The following certificate profile is used for the Starfield Services Root Certificate Authority – G2.
Field
Description
Version
V3
Serial Number
0 (0x0)Signature Algorithm Identifier
sha256RSA
Issuer
CN=Starfield Services Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
Valid From
September 1, 2009 00:00:00 GMT
Valid To
December 31, 2037 23:59:59 GMT
Subject
CN=Starfield Services Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
Subject Public Key Information
RSA (2048 bits)
Extensions:
Basic Constraints (critical)
Subject Type=CA
Path Length Constraint=None
Key Usage (critical)
keyCertSign, cRLSign
Subject Key Identifier
9c 5f 00 df aa 01 d7 30 2b 38 88 a2 b8 6d 4a 9c f2 11 91 83

7.1.2 ISSUING CA

The following certificate profile is used for the Starfield Issuing CA.
Field
Description
Version
V3
Serial Number
260 (0x104)
Signature Algorithm Identifier sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerE = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Valid From
January 14, 2004 21:05:21 GMT
Valid To
January 9, 2024 21:05:21 GMT
Subject
E=practices@starfieldtech.com
CN = Starfield Secure Certification Authority
OU=http://www.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L = Scottsdale
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldSubject Public Key Information
Extensions:
Key Usage
Basic Constraints
CRL Distribution Points

Certificate Policies

Authority Information AccessSubject Key Identifier

Description
S = Arizona
C = USRSA (1024 bits)
keyCertSign, cRLSign
Subject Type=CA
Path Length Constraint=None
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = http://certificates.starfieldtech.com/repository/root.crl[1]Certificate Policy:
Policy Identifier=2.16.840.1.113733.1.7.23.3[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://www.starfieldtech.com/repository[1]Authority Info Access
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com
ac 55 de b7 ea 13 eb fc 98 68 e2 53 60 1e f1 25 3e 8c ee e7

The following certificate profile is used for the Go Daddy 2048-bit Issuing CA.
Field
Description
Version
V3
Serial Number
769 (0x301)
Signature Algorithm Identifier
sha1RSA (OID: 1.2.840.113549.1.1.5)
Issuer
OU = Go Daddy Class 2 Certification Authority
O = The Go Daddy Group, Inc.
C = US
Valid From
November 16, 2006 01:54:37 GMT
Valid To
November 16, 2026 01:54:37 GMT
Subject
serialNumber = 07969287
CN = Go Daddy Secure Certification Authority
OU=http://certificates.godaddy.com/repository
O = GoDaddy.com, Inc.
L = Scottsdale
S = Arizona
C = US
Subject Public Key Information
RSA (2048 bit) (OID: 1.2.840.113549.1.1.1)
Extensions:
Key Usage (critical)
keyCertSign, cRLSign
Basic Constraints (critical)
Subject Type=CA
Path Length Constraint=0
CRL Distribution Points
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = http://certificates.godaddy.com/repository/gdroot.crl
Certificate Policies[1]Certificate Policy:
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldAuthority Information Access

Authority Key Identifier
Subject Key Identifier

Description
Policy Identifier=anyPolicy (OID: 2 5 29 32 0)[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository[1]Authority Info Access
Access Method=On-line Certificate Status Protocol(1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.godaddy.com
KeyID=d2 c4 b0 d2 91 d4 4c 11 71 b3 61 cb 3d a1 fe dd a8 6a d4 e3
fd ac 61 32 93 6c 45 d6 e2 ee 85 5f 9a ba e7 76 99 68 cc e7

The following certificate profile is used for the Starfield 2048-bit Issuing CA.
Field
Description
Version
V3
Serial Number
513 (0x201)
Signature Algorithm Identifier sha1RSA (OID: 1.2.840.113549.1.1.5)
Issuer
OU = Starfield Class 2 Certification Authority
O = Starfield Technologies, Inc.
C = US
Valid From
November 16, 2006 01:15:40 GMT
Valid To
November 16, 2026 01:15:40 GMT
Subject
serialNumber = 10688435
CN = Starfield Secure Certification Authority
OU=http://certificates.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L = Scottsdale
S = Arizona
C = US
Subject Public Key Information RSA (2048 bit) (OID: 1.2.840.113549.1.1.1)
Extensions:
Key Usage (critical)
keyCertSign, cRLSign
Basic Constraints (critical)
Subject Type=CA
Path Length Constraint=0
CRL Distribution Points
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = http://certificates.starfieldtech.com/repository/sfroot.crl
Certificate Policies[1]Certificate Policy:
Policy Identifier=anyPolicy (OID: 2 5 29 32 0)[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository
Authority Information Access[1]Authority Info Access
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com
Authority Key Identifier
KeyID=bf 5f b7 d1 ce dd 1f 86 f4 5b 55 ac dc d7 10 c2 0e a9 88 e7
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldSubject Key Identifier

Description
49 4b 52 27 d1 1b bc f2 a1 21 6a 62 7b 51 42 7a 8a d7 d5 56

7.1.3 BRIDGE CA CERTIFICATES

The following certificate profile is used for the certificate which cross certifies the Go Daddy Class 2
Certification Authority with the ValiCert Class 2 Policy Validation Authority root.
Field
Description
Version
V3
Serial Number
269 (0x10D)
Signature Algorithm Identifier sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerE = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Valid From
June 29, 2004 17:06:20 GMT
Valid To
June 29, 2024 17:06:20 GMT
Subject
OU=Go Daddy Class 2 Certification Authority
O=The Go Daddy Group, Inc.
C=US
Subject Public Key Information RSA (2048 bits)
Extensions:
Key Usage
keyCertSign, cRLSign
Basic Constraints
Subject Type=CA
Path Length Constraint=None
CRL Distribution Points
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = http://certificates.godaddy.com/repository/root.crl
Authority Information Access[1]Authority Info Access
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.godaddy.com
Certificate Policies[1]Certificate Policy:
Policy Identifier=anyPolicy (OID: 2 5 29 32 0)[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository
Authority Key Identifier
Certificate Issuer:
Directory Address:
E = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Certificate SerialNumber=01
Subject Key Identifierd2 c4 b0 d2 91 d4 4c 11 71 b3 61 cb 3d a1 fe dd a8 6a d4 e3Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

The following certificate profile is used for the certificate which cross certifies the Starfield Class 2
Certification Authority with the ValiCert Class 2 Policy Validation Authority root.
Field
Description
Version
V3
Serial Number
268 (0x10C)
Signature Algorithm Identifier sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerE = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Valid From
June 29, 2004 17:39:16 GMT
Valid To
June 29, 2024 17:39:16 GMT
Subject
OU=Starfield Class 2 Certification Authority
O=Starfield Technologies, Inc.
C=US
Subject Public Key Information RSA (2048 bits)
Extensions:
Key Usage (critical)
keyCertSign, cRLSign
Basic Constraints (critical)
Subject Type=CA
Path Length Constraint=None
CRL Distribution Points
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = http://certificates.starfieldtech.com/repository/root.crl
Authority Information Access[1]Authority Info Access
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com
Certificate Policies[1]Certificate Policy:
Policy Identifier=anyPolicy (OID: 2 5 29 32 0)[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository
Authority Key Identifier
Certificate Issuer:
Directory Address:
E = info@valicert.com
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Certificate SerialNumber=01
Subject Key Identifierbf 5f b7 d1 ce dd 1f 86 f4 5b 55 ac dc d7 10 c2 0e a9 88 e7

7.1.4 END ENTITY SSL CERTIFICATES

The following certificate profile is used for Go Daddy branded Subscriber Certificates. At a minimum, thefollowing fields will be populated as described, in accordance with IETF RFC 2459.
Field
Description
Version
V3
Serial Number
unique value for each certificate issued by the Issuing CA
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldSignature Algorithm Identifier
IssuerValid From
Valid To
Subject (Medium Assurance
Certificates)

Subject (High Assurance
Certificates)

Subject (Extended Validation
Certificates)

Subject Public Key Information
Extensions:
Key Usage (critical)
Basic Constraints (critical)
Extended Key Usage
CRL Distribution Points

Description
sha1RSA (OID: 1.2.840.113549.1.1.5)
serialNumber = 07969287
CN = Go Daddy Secure Certification Authority
OU=http://certificates.godaddy.com/repository
O = GoDaddy.com, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of Certificate issuance
One to ten years after Certificate issuance (depending on SSL certificatetype).
CN = domain name of Subscriber’s web site (may be fully qualified,wildcard, contain no periods, or IP address reserved for internal use)
OU = “Domain Control Verified” or similar text indicating the assurance
level of the certificate.
O = domain name of Subscriber’s web site (may be fully qualified,wildcard, contains no periods, or IP address reserved for internal use)
CN = domain name of Subscriber’s web site (may be fully qualified,wildcard, contains no periods, or IP address reserved for internal use)
OU = (if supplied in the subscriber's certificate request) The value of thefirst OU field requested by the customer. This data is not verified.
O = Subscriber’s organization or individual name
L = City/town
S = State
C = Country
serialNumber= Registration number assigned by incorporating authority
or date of incorporation or registration
jurisdictionOfIncorporationCountryName= Country of incorporation orregistration
jurisdictionOfIncorporationStateOrProvinceName= State ofincorporation or registration (if applicable)
jurisdictionOfIncorporationLocalityName= City/town of incorporation orregistration (if applicable)businessCategory=vetting category used to issue certificate as defined in
the CA/Browser Forum Guidelines for the Issuance and Management ofExtended Validation Certificates
CN = domain name of Subscriber’s web site
O = Subscriber’s full legal organization name. An assumed name or DBA
may also be included
L = City/town of place of businessS = State of place of business
C = Country of place of business
RSA (1024 bits or higher. 2048 bits or higher for Extended Validation
certificates)
Digital Signature, Key Encipherment(A0)Subject Type= End Entity
Path Length Constraint =None
Server Authentication (1.3.6.1.5.5.7.3.1)
Client Authentication (1.3.6.1.5.5.7.3.2)
CRL Distribution Point

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldCertificate Policies (Medium
Assurance Certificates)

Certificate Policies (High
Assurance Certificates)

Certificate Policies (Extended
Validation Certificates)

Authority Information AccessSubject Alternative Name

Description
Distribution Point Name:
Full Name:
URL = <current CRL URL>
The specific URI will vary depending on certificate type and CRL scope.
[1]Certificate Policy:
Policy Identifier=2.16.840.1.114413.1.7.23.1[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository[1]Certificate Policy:
Policy Identifier=2.16.840.1.114413.1.7.23.2[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository[1]Certificate Policy:
Policy Identifier=2.16.840.1.114413.1.7.23.3[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository[1]Authority Info Access
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.godaddy.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
Alternative Name:
URL=http://certificates.godaddy.com/repository/gd_intermediate.crt
Optional. If included, set to:
1. DNS=fully qualified domain name of the Subscriber’s site, domainname remaining after removing “www.” from the left hand portion of
the fully qualified domain name.
And/or:
2. DNS=domain name of Subscriber’s site (may be fully qualified,wildcard or contain no periods), domain name of additional sites (maybe fully qualified, wildcard or contain no periods) which have undergone
the following verification step as part of the authentication process: theindividual requesting the certificate has access to the domain name(s)that are specified in the certificate application (per §3.1.13)

The following certificate profile is used for Starfield branded Subscriber Certificates. At a minimum, thefollowing fields will be populated as described, in accordance with IETF RFC 2459.
Field
Description
Version
V3
Serial Number
unique value for each certificate issued by the Issuing CA
Signature Algorithm Identifier sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerserialNumber = 10688435
CN = Starfield Secure Certification Authority
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldValid From
Valid To
Subject (Medium Assurance
Certificates)

Subject (High Assurance
Certificates)

Subject (Extended Validation
Certificates)

Subject Public Key Information
Extensions:
Key Usage (critical)
Basic Constraints (critical)
Extended Key Usage
CRL Distribution Points

Description
OU=http://certificates.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of Certificate issuance
One to ten years after Certificate issuance (depending on SSL certificatetype).
CN = domain name of Subscriber’s web site (may be fully qualified,wildcard, contain no periods, or IP address reserved for internal use)
OU = “Domain Control Verified” or similar text indicating the assurance
level of the certificate.
O = domain name of Subscriber’s web site (may be fully qualified,wildcard, contain no periods, or IP address reserved for internal use)
CN = domain name of Subscriber’s web site (may be fully qualified,wildcard, contain no periods, or IP address reserved for internal use)
OU = (if supplied in the subscriber's certificate request) The value of thefirst OU field requested by the customer. This data is not verified.
O = Subscriber’s organization or individual name
L = City/town
S = State
C = Country
serialNumber= Registration number assigned by incorporating authority
or date of incorporation or registration
jurisdictionOfIncorporationCountryName= Country of incorporation
jurisdictionOfIncorporationStateOrProvinceName= State ofincorporation (if applicable)
jurisdictionOfIncorporationLocalityName= City/town of incorporation (ifapplicable)businessCategory=vetting category used to issue certificate as defined in
the CA/Browser Forum Guidelines for the Issuance and Management ofExtended Validation Certificates
CN = domain name of Subscriber’s web site
O = Subscriber’s full legal organization name. An assumed name or DBA
may also be included
L = City/town of place of businessS = State of place of business
C = Country of place of business
RSA (1024 bits or higher. 2048 bits or higher for Extended Validation
certificates)
Digital Signature, Key Encipherment(A0)Subject Type=End Entity
Path Length Constraint=None
Server Authentication (1.3.6.1.5.5.7.3.1)
Client Authentication (1.3.6.1.5.5.7.3.2)
CRL Distribution Point
Distribution Point Name:
Full Name:
URL =<current CRL URI>
The specific URI will vary depending on certificate type and CRL scope.

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldCertificate Policies (Medium
Assurance Certificates)

Certificate Policies (High
Assurance Certificates)

Certificate Policies (Extended
Validation Certificates)

Authority Information AccessSubject Alternative Name

Description[1]Certificate Policy:
Policy Identifier=2.16.840.1.114414.1.7.23.1[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository[1]Certificate Policy:
Policy Identifier=2.16.840.1.114414.1.7.23.2[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository[1]Certificate Policy:
Policy Identifier=2.16.840.1.114414.1.7.23.3[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository[1]Authority Info Access
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
Alternative Name:
URL=http://certificates.starfieldtech.com/repository/sf_intermediate.crt
Optional. If included, set to:
1. DNS=fully qualified domain name of the Subscriber’s site, domainname remaining after removing “www.” from the left hand portion of
the fully qualified domain name.
And/or:
2. DNS=domain name of Subscriber’s site (may be fully qualified,wildcard or contain no periods), domain name of additional sites (maybe fully qualified, wildcard or contain no periods) which have undergone
the following verification step as part of the authentication process: theindividual requesting the certificate has access to the domain name(s)that are specified in the certificate application (per §3.1.13)

7.1.5 END ENTITY CODE SIGNING CERTIFICATES

The following certificate profile is used for Go Daddy branded Subscriber Certificates. At a minimum, thefollowing fields will be populated as described, in accordance with IETF RFC 2459.
Field
Description
Version
V3
Serial Number
unique value for each certificate issued by the Issuing CA
Signature Algorithm Identifier sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerserialNumber = 07969287
CN = Go Daddy Secure Certification Authority
OU=http://certificates.godaddy.com/repository
O = GoDaddy.com, Inc.
L = Scottsdale
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldValid From
Valid To
Subject

Subject Public Key Information
Extensions:
Key Usage (critical)
Basic Constraints (critical)
Extended Key Usage
Subject Key Identifier
Authority Key Identifier
CRL Distribution Points

Certificate Policies

Authority Information Access

Description
S = Arizona
C = US
Date and time of Certificate issuance
One to three years after Certificate issuance
CN = Subscriber's organization name
OU = (if supplied in the subscriber's certificate request) The value of thefirst OU field requested by the customer. This data is not verified.
O = Subscriber’s organization name
L = City/town
S = State
C = Country
RSA (1024 bits or higher)
Digital Signature, Key Encipherment
Subject Type=End Entity
Path Length Constraint=None
Code Signing (1.3.6.1.5.5.7.3.3) (all Code Signing certificates)
160-bit SHA1 hash of the public key contained within this certificate
160-bit SHA1 hash of the public key of the issuing certificate authority
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = <current CRL URI>
The specific URI will vary depending on certificate type and CRL scope.
[1]Certificate Policy:
Policy Identifier=2.16.840.1.114413.1.7.23.2[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository[1]Authority Info Access
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.godaddy.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
Alternative Name:
URL=http://certificates.godaddy.com/repository/gd_intermediate.crt

The following certificate profile is used for Starfield branded Subscriber Certificates. At a minimum, thefollowing fields will be populated as described, in accordance with IETF RFC 2459.
Field
Description
Version
V3
Serial Number
unique value for each certificate issued by the Issuing CA
Signature Algorithm Identifier sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerserialNumber = 10688435
CN = Starfield Secure Certification Authority
OU=http://certificates.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L = Scottsdale
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldValid From
Valid To
Subject

Subject Public Key Information
Extensions:
Key Usage (critical)
Basic Constraints (critical)
Extended Key Usage
Subject Key Identifier
Authority Key Identifier
CRL Distribution Points

Certificate Policies (High
Assurance Certificates)

Authority Information Access

Description
S = Arizona
C = US
Date and time of Certificate issuance
One to three years after Certificate issuance
CN = Subscriber's organization name
OU = (if supplied in the subscriber's certificate request) The value of thefirst OU field requested by the customer. This data is not verified.
O = Subscriber’s organization name
L = City/town
S = State
C = Country
RSA (1024 bits or higher)
Digital Signature, Key Encipherment
Subject Type=End Entity
Path Length Constraint=None
Code Signing (1.3.6.1.5.5.7.3.3) (all Code Signing certificates)
160-bit SHA1 hash of the public key contained within this certificate
160-bit SHA1 hash of the public key of the issuing certificate authority
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = <current CRL URI>
The specific URI will vary depending on certificate type and CRL scope.
[1]Certificate Policy:
Policy Identifier=2.16.840.1.114414.1.7.23.2[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository[1]Authority Info Access
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
Alternative Name:
URL=http://certificates.starfieldtech.com/repository/sf_intermediate.crt

7.1.6 END ENTITY CUSTOM CERTIFICATESThe Starfield PKI reserves the right to issue certificates specialized for particular purposes or applications.
These certificates may not conform to any established standard or RFC, but are rather intended for use incustom applications. Each such custom certificate profile will carry a unique policy OID in the Certificate
Policies extension that will map to a custom certificate profile listed in this section.

7.1.6.1

CUSTOM CERTIFICATE PROFILE TYPE 1
The following certificate profile is used for Go Daddy branded Subscriber Certificates.
Field
Description
VersionV3
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldSerial Number
Signature Algorithm Identifier
IssuerValid From
Valid To
Subject
Subject Public Key Information
Extensions:
Key Usage (critical)
Basic Constraints (critical)
Extended Key Usage (critical)
Subject Key Identifier
Authority Key Identifier
CRL Distribution Points

Certificate Policies

Authority Information AccessSubject Alternative Name(critical)

Description
unique value for each certificate issued by the Issuing CA
sha1RSA (OID: 1.2.840.113549.1.1.5)
serialNumber = 07969287
CN = Go Daddy Secure Certification Authority
OU=http://certificates.godaddy.com/repository
O = GoDaddy.com, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of Certificate issuance
Up to 5 years after Certificate issuance
Empty DER SEQUENCERSA (2048 bits or higher)
Digital Signature, Key Encipherment
Subject Type=End Entity
Path Length Constraint=None
1.3.6.1.4.1.33161.1.1
Server Authentication (1.3.6.1.5.5.7.3.1)
Client Authentication (1.3.6.1.5.5.7.3.2)
160-bit SHA1 hash of the public key contained within this certificate
160-bit SHA1 hash of the public key of the issuing certificate authority
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = <current CRL URI>
The specific URI will vary depending on certificate type and CRL scope.
[1]Certificate Policy:
Policy Identifier=2.16.840.1.114413.1.7.23.5[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.godaddy.com/repository/[1]Authority Info Access
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.godaddy.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
Alternative Name:
URL=http://certificates.godaddy.com/repository/gd_intermediate.crt
One or more uniformResourceIdentifier values

The following certificate profile is used for Starfield branded Subscriber Certificates.
Field
Description
Version
V3
Serial Number
unique value for each certificate issued by the Issuing CA
Signature Algorithm Identifier sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerserialNumber = 10688435
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldValid From
Valid To
Subject
Subject Public Key Information
Extensions:
Key Usage (critical)
Basic Constraints (critical)
Extended Key Usage (critical)
Subject Key Identifier
Authority Key Identifier
CRL Distribution Points

Certificate Policies

Authority Information AccessSubject Alternative Name(critical)

Description
CN = Starfield Secure Certification Authority
OU=http://certificates.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of Certificate issuance
Up to 5 years after Certificate issuance
Empty DER SEQUENCERSA (2048 bits or higher)
Digital Signature, Key Encipherment
Subject Type=End Entity
Path Length Constraint=None
1.3.6.1.4.1.33161.1.1
Server Authentication (1.3.6.1.5.5.7.3.1)
Client Authentication (1.3.6.1.5.5.7.3.2)
160-bit SHA1 hash of the public key contained within this certificate
160-bit SHA1 hash of the public key of the issuing certificate authority
CRL Distribution Point
Distribution Point Name:
Full Name:
URL = <current CRL URI>
The specific URI will vary depending on certificate type and CRL scope.
[1]Certificate Policy:
Policy Identifier=2.16.840.1.114414.1.7.23.5[1,1]Policy Qualifier Info:
Policy Qualifier Id=CPS
Qualifier:
http://certificates.starfieldtech.com/repository/[1]Authority Info Access
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name:
URL=http://ocsp.starfieldtech.com[2] Authority Info Access
Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
Alternative Name:
URL=http://certificates.starfieldtech.com/repository/sf_intermediate.crt
One or more uniformResourceIdentifier values

7.2 CRL PROFILES

CRLs MAY be either V1 or V2. When a V2 CRL is issued, additional fields may be present as shown in the tables
below.

7.2.1 ROOT CAS

The following CRL profile is used for the Starfield Root CA.
Field
Description
VersionV1 or V2 (0x1)Signature
sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerE = info@valicert.com
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number
Revoked Certificates

CRL Entry Extensions (V2 only andoptional for any given CRL entry)
CRL Reason CodeInvalidity Date

Description
CN = http://www.valicert.com/
OU = ValiCert Class 2 Policy Validation Authority
O = ValiCert, Inc.
L = ValiCert Validation Network
Date and time of CRL issuance.
365 days after This Update.
Unique value for each CRL issued by the Starfield Root CA
List of information regarding revoked certificates. CRL entries
include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time of certificate
revocation
One of the following reason codes:
unspecified(0)
keyCompromise(1)
cACompromise(2)affiliationChanged(3)
superseded(4)
cessationOfOperation (5)certificateHold(6)
removeFromCRL(8)privilegeWithdrawn(9)aACompromise(10)
A GeneralizedTime denoting the effective time when the given serial
number is to be considered invalid.

The following CRL profile is used for the Starfield Class 2 Certification Authority Root CA.
Field
Description
VersionV1 or V2 (0x1)Signature
sha1RSA (OID: 1.2.840.113549.1.1.5)
Issuer
OU=Starfield Class 2 Certification Authority
O=Starfield Technologies, Inc.
C=US
This Update (Effective Date)
Date and time of CRL issuance.
Next Update
365 days after This Update.
CRL extensions (V2 only)
CRL Number
Unique value for each CRL issued by the Starfield Class 2 Root CA
Authority Key Identifierbf 5f b7 d1 ce dd 1f 86 f4 5b 55 ac dc d7 10 c2 0e a9 88 e7
Revoked Certificates
List of information regarding revoked certificates. CRL entries
include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time of certificate
revocation
CRL Entry Extensions (V2 only andoptional for any given CRL entry)
CRL Reason CodeOne of the following reason codes:
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldInvalidity Date

Description
unspecified(0)
keyCompromise(1)
cACompromise(2)affiliationChanged(3)
superseded(4)
cessationOfOperation (5)certificateHold(6)
removeFromCRL(8)privilegeWithdrawn(9)aACompromise(10)
A GeneralizedTime denoting the effective time when the given serial
number is to be considered invalid.

The following CRL profile is used for the Starfield Root Certificate Authority - G2.
Field
Description
VersionV1 or V2 (0x1)Signature
sha256RSA (OID: 1.2.840.113549.1.1.11)
Issuer
CN=Starfield Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
This Update (Effective Date)
Date and time of CRL issuance.
Next Update
365 days after This Update.
CRL extensions (V2 only)
CRL Number
Unique value for each CRL issued by the Starfield Root Certificate
Authority - G2
Authority Key Identifier
7c 0c 32 1f a7 d9 30 7f c4 7d 68 a3 62 a8 a1 ce ab 07 5b 27
Revoked Certificates
List of information regarding revoked certificates. CRL entries
include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time of certificate
revocation
CRL Entry Extensions (V2 only andoptional for any given CRL entry)
CRL Reason CodeOne of the following reason codes:
unspecified(0)
keyCompromise(1)
cACompromise(2)affiliationChanged(3)
superseded(4)
cessationOfOperation (5)certificateHold(6)
removeFromCRL(8)privilegeWithdrawn(9)aACompromise(10)Invalidity Date
A GeneralizedTime denoting the effective time when the given serial
number is to be considered invalid.

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

The following CRL profile is used for the Go Daddy Class 2 Root CA.
Field
Description
VersionV1 or V2 (0x1)Signature
sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerOU=Go Daddy Class 2 Certification Authority
O=The Go Daddy Group, Inc.
C=US
This Update (Effective Date)
Date and time of CRL issuance.
Next Update
365 days after This Update.
CRL extensions (V2 only)
CRL Number
Unique value for each CRL issued by the Go Daddy Class 2 Root CA
Authority Key Identifierd2 c4 b0 d2 91 d4 4c 11 71 b3 61 cb 3d a1 fe dd a8 6a d4 e3
Revoked Certificates
List of information regarding revoked certificates. CRL entries
include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time of certificate
revocation
CRL Entry Extensions (V2 only andoptional for any given CRL entry)
CRL Reason CodeOne of the following reason codes:
unspecified(0)
keyCompromise(1)
cACompromise(2)affiliationChanged(3)
superseded(4)
cessationOfOperation (5)certificateHold(6)
removeFromCRL(8)privilegeWithdrawn(9)aACompromise(10)Invalidity Date
A GeneralizedTime denoting the effective time when the given serial
number is to be considered invalid.
The following CRL profile is used for the Go Daddy Root Certificate Authority - G2.
Field
Description
VersionV1 or V2 (0x1)Signature
sha256RSA (OID: 1.2.840.113549.1.1.11)
Issuer
CN=Go Daddy Root Certificate Authority - G2
O=GoDaddy.com, Inc.
L=Scottsdale
S=Arizona
C=US
This Update (Effective Date)
Date and time of CRL issuance.
Next Update
365 days after This Update.
CRL extensions (V2 only)
CRL Number
Unique value for each CRL issued by the Go Daddy Root Certificate
Authority - G2
Authority Key Identifier
3a 9a 85 07 10 67 28 b6 ef f6 bd 05 41 6e 20 c1 94 da 0f de
Revoked Certificates
List of information regarding revoked certificates. CRL entries
include:Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldCRL Entry Extensions (V2 only andoptional for any given CRL entry)
CRL Reason CodeInvalidity Date

Description• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time of certificate
revocation
One of the following reason codes:
unspecified(0)
keyCompromise(1)
cACompromise(2)affiliationChanged(3)
superseded(4)
cessationOfOperation (5)certificateHold(6)
removeFromCRL(8)privilegeWithdrawn(9)aACompromise(10)
A GeneralizedTime denoting the effective time when the given serial
number is to be considered invalid.

The following CRL profile is used for the Starfield Services Root CA.
Field
Description
VersionV1 or V2 (0x1)Signature
sha1RSA (OID: 1.2.840.113549.1.1.5)
Issuer
CN= Starfield Services Root Certification Authority
OU=http://certificates.starfieldtech.com/repository/
O=Starfield Technologies, Inc.
L=Scottsdale
ST=Arizona
C=US
This Update (Effective Date)
Date and time of CRL issuance.
Next Update
365 days after This Update.
CRL extensions (V2 only)
CRL Number
Unique value for each CRL issued by the Starfield Services Root CA
Authority Key Identifierb4 c6 7f 1a 43 cc 9b 75 5d 2f c4 4b f2 8b 98 10 e9 f1 51 10
Revoked Certificates
List of information regarding revoked certificates. CRL entries
include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time of certificate
revocation
CRL Entry Extensions (V2 only andoptional for any given CRL entry)
CRL Reason CodeOne of the following reason codes:
unspecified(0)
keyCompromise(1)
cACompromise(2)affiliationChanged(3)
superseded(4)
cessationOfOperation (5)certificateHold(6)
removeFromCRL(8)Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldInvalidity Date

Description
privilegeWithdrawn(9)aACompromise(10)
A GeneralizedTime denoting the effective time when the given serial
number is to be considered invalid.

The following CRL profile is used for the Starfield Services Root Certificate Authority - G2.
Field
Description
VersionV1 or V2 (0x1)Signature
sha256RSA (OID: 1.2.840.113549.1.1.11)
Issuer
CN=Starfield Services Root Certificate Authority - G2
O=Starfield Technologies, Inc.
L=Scottsdale
S=Arizona
C=US
This Update (Effective Date)
Date and time of CRL issuance.
Next Update
365 days after This Update.
CRL extensions (V2 only)
CRL Number
Unique value for each CRL issued by the Starfield Services Root
Certificate Authority - G2
Authority Key Identifier
9c 5f 00 df aa 01 d7 30 2b 38 88 a2 b8 6d 4a 9c f2 11 91 83
Revoked Certificates
List of information regarding revoked certificates. CRL entries
include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time of certificate
revocation
CRL Entry Extensions (V2 only andoptional for any given CRL entry)
CRL Reason CodeOne of the following reason codes:
unspecified(0)
keyCompromise(1)
cACompromise(2)affiliationChanged(3)
superseded(4)
cessationOfOperation (5)certificateHold(6)
removeFromCRL(8)privilegeWithdrawn(9)aACompromise(10)Invalidity Date
A GeneralizedTime denoting the effective time when the given serial
number is to be considered invalid.

7.2.2 ISSUING CAS

The following CRL profile is used for the Starfield Issuing CA.
Field
Description
VersionV1 or V2 (0x1)Signature
sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerE=practices@starfieldtech.com
CN = Starfield Secure Certification Authority
OU=http://www.starfieldtech.com/repository
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldThis Update (Effective Date)
Next Update
CRL extensions (V2 only)
CRL Number
Authority Key Identifier
Revoked Certificates

CRL Entry Extensions (V2 only andoptional for any given CRL entry)
CRL Reason CodeInvalidity Date

Description
O = Starfield Technologies, Inc.
L = Scottsdale
S = Arizona
C = US
Date and time of CRL issuance.
No greater than 7 days after This Update
Unique value for each CRL issued by the Starfield Issuing CA
ac 55 de b7 ea 13 eb fc 98 68 e2 53 60 1e f1 25 3e 8c ee e7
List of information regarding revoked certificates. CRL entries
include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time of certificate
revocation
One of the following reason codes:
unspecified(0)
keyCompromise(1)
cACompromise(2)affiliationChanged(3)
superseded(4)
cessationOfOperation (5)certificateHold(6)
removeFromCRL(8)privilegeWithdrawn(9)aACompromise(10)
A GeneralizedTime denoting the effective time when the given serial
number is to be considered invalid.

The following CRL profile is used for the Starfield 2048-bit Issuing CA.
Field
Description
VersionV1 or V2 (0x1)Signature
sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerserialNumber (OID 2.5.4.5) = 10688435
CN = Starfield Secure Certification Authority
OU=http://certificates.starfieldtech.com/repository
O = Starfield Technologies, Inc.
L (OID 2.5.4.7) = Scottsdale
S (OID 2.5.4.8) = Arizona
C (OID 2.5.4.6) = USThis Update (Effective Date)
Date and time of CRL issuance.
Next Update
No greater than 7 days after This Update
CRL extensions (V2 only)
CRL Number
Unique value for each CRL issued by the Starfield 2048-bit Issuing CA
Authority Key Identifier
49 4b 52 27 d1 1b bc f2 a1 21 6a 62 7b 51 42 7a 8a d7 d5 56
Revoked Certificates
List of information regarding revoked certificates. CRL entries
include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time of certificate
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldCRL Entry Extensions (V2 only andoptional for any given CRL entry)
CRL Reason CodeInvalidity Date

Description
revocation
One of the following reason codes:
unspecified(0)
keyCompromise(1)
cACompromise(2)affiliationChanged(3)
superseded(4)
cessationOfOperation (5)certificateHold(6)
removeFromCRL(8)privilegeWithdrawn(9)aACompromise(10)
A GeneralizedTime denoting the effective time when the given serial
number is to be considered invalid.

The following CRL profile is used for the Go Daddy 2048-bit Issuing CA.
Field
Description
VersionV1 or V2 (0x1)Signature
sha1RSA (OID: 1.2.840.113549.1.1.5)
IssuerserialNumber (OID 2.5.4.5) = 07969287
CN = Go Daddy Secure Certification Authority
OU=http://certificates.godaddy.com/repository
O = GoDaddy.com, Inc.
L (OID 2.5.4.7) = Scottsdale
S (OID 2.5.4.8) = Arizona
C (OID 2.5.4.6) = USThis Update (Effective Date)
Date and time of CRL issuance.
Next Update
No greater than 7 days after This Update
CRL extensions (V2 only)
CRL Number
Unique value for each CRL issued by the Go Daddy 2048-bit IssuingCA
Authority Key Identifier
fd ac 61 32 93 6c 45 d6 e2 ee 85 5f 9a ba e7 76 99 68 cc e7
Revoked Certificates
List of information regarding revoked certificates. CRL entries
include:• Serial Number, identifying the revoked certificate• Revocation Date, including the date and time of certificate
revocation
CRL Entry Extensions (V2 only andoptional for any given CRL entry)
CRL Reason CodeOne of the following reason codes:
unspecified(0)
keyCompromise(1)
cACompromise(2)affiliationChanged(3)
superseded(4)
cessationOfOperation (5)certificateHold(6)
removeFromCRL(8)privilegeWithdrawn(9)
Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

FieldInvalidity Date

Description
aACompromise(10)
A GeneralizedTime denoting the effective time when the given serial
number is to be considered invalid.

8 SPECIFICATION ADMINISTRATION

8.1 SPECIFICATION CHANGE PROCEDURES

Modifications to this CP/CPS are approved by the Starfield Governance and Policy Committee and become
effective upon publication in the Starfield repository.

8.2 PUBLICATION AND NOTIFICATION POLICIESThis CP/CPS and subsequent revisions are published in the Starfield repository in accordance with §2.6.1.
Starfield may change this document at any time without prior notice.

8.3 CPS APPROVAL PROCEDURES
See §8.1.

9 DEFINITIONS• Certificate - digital record that contains information such as the Subscriber’s distinguished name and public key,
and the signer's signature and data
• Certificate Revocation List (CRL) – periodically published listing of all certificates that have been revoked for use
by Relying Parties• Certificate Signing Request (CSR) – a message sent to the certification authority containing the information
required to issue a digital certificate• Certification Authority (CA) – see §1.3.1• Code Signing Certificate – a certificate issued to an organization for the purpose of digitally signing software• Compromise - a loss, theft, disclosure, modification, unauthorized use, or other breach of security related to a
Private Key• Custom Certificate – a certificate profile defined for a specific, non-standard usage• Distinguished Name (DN) – a globally unique identifier representing a Subscriber• Extended Validation (EV) – certificate issued under the Guidelines for the Issuance and Management of Extended
Validation Certificates published by the CA/Browser Forum (http://www.cabforum.org)• Governance and Policy Authority Committee (GPAC) – the Starfield committee which creates and maintains thepolicies related to the Starfield Public Key Infrastructure. Also known as the Policy Authority Committee (PAC)• Hardware Security Module (HSM) –a specialized computer hardware system designed to securely store
encryption keys
• High Assurance – Starfield’s vetting process that verifies the identity of the individual or organization thatrequested the certificate and access to the domain• Medium Assurance – Starfield’s vetting process that verifies access to the domain• Online Certificate Status Protocol (OCSP) – A standardized query/response protocol whereby a client can request
the status of a given Certificate and be given a response that will indicate whether the Certificate is valid or
revoked.
• Policy Authority Committee – See Governance and Policy Authority Committee

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9

• Private Key – a confidential encrypted electronic data file that interfaces with a Public Key using the sameencryption algorithm, in order to verify Digital Signatures and encrypt files or messages• Public Key – an encrypted electronic data file that is publicly available for interfacing with a Private Key• Registration Authority (RA) – see §1.3.2• Relying Party – an individual or entity that acts in reliance on a Certificate or digital signature associated with a
Certificate• Relying Party Agreement – an agreement which specifies the stipulations under which a person or organizationacts as a Relying Party• Reseller – a person or organization which is given permission by Starfield to sell products to Subscribers• Starfield – Starfield Technologies, LLC, and its resellers• Starfield PKI - the Starfield Public Key Infrastructure that provides Certificates for individuals and entities.
• Subscriber – the individual or entity that has been issued a Certificate and is authorized to use the Private Key
that corresponds to the Public Key in the Certificate• Subscriber Agreement – an agreement which specifies the stipulations under which a person or organization acts
as a Subscriber• Unified Communications Certificate (UCC) – certificate that includes multiple fully qualified domain names in the
Subject Alternative Name extension.

Copyright © 2007-2011 Starfield Technologies, LLC All rights reserved.
Starfield CP-CPS V2.9