Check of references; Check of credit/financial records. The period of investigation must cover at least the last five years for each area, except the residence check which must cover at least the last three years. Regardless of the date of award, the highest educational degree shall be verified. Factors revealed in a background that may be considered grounds for rejecting candidates for Trusted Positions or for taking action against an existing Trusted Person may include but is not limited to the following: Misrepresentations made by the candidate or Trusted Person Highly unfavorable or unreliable personal references Certain criminal convictions Indications of a lack of financial responsibility Training Requirements All personnel performing duties with respect to the operation of the CA or RA receive comprehensive training. Training shall be conducted in the following areas: CA (or RA) security principles and mechanisms; All PKI software versions in use on the CA (or RA) system; All PKI duties they are expected to perform; Disaster recovery and business continuity procedures; and Stipulations of this policy. Retraining Frequency and Requirements All individuals responsible for PKI roles shall be made aware of changes in the CA or RA operation. Any significant change to the operations shall have a training (awareness) plan, and the execution of such plan shall be documented. Examples of such changes are CA software or hardware upgrade, changes in automated security systems, and relocation of equipment. Documentation shall be maintained identifying all personnel who received training and the level of training completed. Job Rotation Frequency and Sequence No stipulation. Sanctions for Unauthorized Actions The CA take appropriate administrative and disciplinary actions against personnel who have performed actions involving the CA or its RA that are not authorized in this CP, CPSs, or other published procedures. Independent Contractor Requirements Contractors fulfilling trusted roles are subject to all personnel requirements stipulated in this policy. PKI vendors who provide any services shall establish procedures to ensure that any subcontractors perform in accordance with this policy and the CPS. Documentation Supplied to Personnel The CA shall make available to its personnel the CP they support, the CPS, and any relevant statues, policies, or contracts. Other technical, operations, and administrative documents (e.g.: Administrator Manual, User Manual, etc.) shall be provided in order for the trusted personnel to perform their duties.
Criticality shall be set to FALSE. Subject Key Identifier Extension Table 9 shows the subjectKeyIdentifier extension settings for AeroMACS CA certificates and specifies that all AeroMACS Root and CA certificates: Shall include the subjectKeyIdentifier extension Shall set the criticality of the subjectKeyIdentifier extension to FALSE calculate the keyIdentifier of the subjectKeyIdentifier per Method 1 Table 9: subjectKeyIdentifier Extension for AeroMACS CA Certificates Field Format Criticality Value Comment subjectKeyIdentifier FALSE { id-ce 14 } Included in all CA certificates keyIdentifier OCTET STRING <key identifier> Calculated per Method 1. Device Certificates shall not include the subjectKeyIdentifier extension. Basic Constraints Extension Table 10 shows the basicConstraints extension settings for AeroMACS Root CA certificates and specifies that all AeroMACS Root CA certificates: include the basicConstraints extension Shall set the criticality of the basicConstraints extension to TRUE Shall set the cA field of the basicConstraints extension to TRUE Table 10: basicConstraints Extension for AeroMACS Root CA Certificates Field Format Criticality Value Comment basicConstraints TRUE { id-ce 19 } Included in all Root certificates cA BOOLEAN TRUE Set pathLenConstraint INTEGER Not Set Table 11 shows the basicConstraints extension settings for AeroMACS CA certificates and specifies that all AeroMACS CA certificates: include the basicConstraints extension Shall set the criticality of the basicConstraints extension to TRUE Shall set the cA field of the basicConstraints extension set to TRUE Shall set the pathLenConstraint field of the basicConstraints to “0” (zero) Table 11: basicConstraints Extension for AeroMACS CA Certificates Format Criticality Value Comment
Abbreviations and Acronyms This specification uses the following abbreviations: AIA Authority Information Access APPA AeroMACS PKI Policy Authority AWG Aviation Working Group CA Certification Authority CN Common Name CP Certificate Policy CPS Certification Practice Statement CRA Certificate Requesting Account CRL Certificate Revocation List CSR Certificate Signing Request CSA Certificate Status Authority CSS Certificate Status Services DR Demand Response DRAS Demand Response Automation Server ECC Elliptic Curve Cryptography FIPS Federal Information Processing Standards id-at X.500 attribute types. (OID value: 2.5.4) id-ce Object Identifier for Version 3 certificate extensions. (OID value: 2.5.29) IETF Internet Engineering Task Force ISO Independent System Operators LSVA Logical Security Vulnerability Assessment MAC Media Access Control MFG Manufacturer OCSP Online Certificate Status Protocol OID Object Identifier PA Policy Authority PKCS Public-Key Cryptography Standard PKI Public Key Infrastructure PKIX Public Key Infrastructure X.509 RA Registration Authority RFC Request for comment RSA Rivest, Shamir, Adelman