Since the RAOs can have multiple certificate policies, the gateway takes the data in from the form and makes a best match against the policies it has. For most installations, Baltimore recommends using a separate RA and RAO specifically for the gateway, so it's easier to control policy enforcement. We created several policies required for different clients. For example, we created a certificate that also contained the Netscape certificate extensions and required users to enter their employee ID numbers and verify the pictures. Enforcement and auditing of the data are outside the scope of UniCERT and lie with the organization.
User registration is straightforward.
The RA then generates the public and private key pairs and stores them in a file for users to import into their applications. If the policy requires multiple administrators to vet a certificate, the request is held in a queue until the required number of RAOs has approved it. Likewise, if a certificate is to be revoked, the same number of RAOs is required to sign off on the revocation. Baltimore Technologies has made a great effort in UniCERT to ease some of the more onerous management burdens, such as customizing the PKI and creating certificate policies. Additionally, the modular nature of the UniCERT system means its licensing costs can quickly add up for a large organization.