ETSI TS 119 412-1-2018 Electronic Signatures and Infrastructures (ESI) Certificate Profiles Part 1 Overview and common data structures (V1 2 1).pdf

1、 ETSI TS 119 412-1 V1.2.1 (2018-05) Electronic Signatures and Infrastructures (ESI); Certificate Profiles; Part 1: Overview and common data structures G1G2G3G4G5G6G3G7G8G9G10G11G2G3G6G12G6G3G7G1G6G13G5G9ETSI ETSI TS 119 412-1 V1.2.1 (2018-05)2 Reference RTS/ESI-0019412-1v121 Keywords e-commerce, ele

2、ctronic signature, security, trust services ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The

3、 present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization o

4、f ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware t

5、hat the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following servic

6、es: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shal

7、l not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. ETSI 2018. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are trademarks of ETSI registered for the benefit of its Members. 3GPPTM and LTET

8、Mare trademarks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. oneM2M logo is protected for the benefit of its Members. GSMand the GSM logo are trademarks registered and owned by the GSM Association. ETSI ETSI TS 119 412-1 V1.2.1 (2018-05)3 Contents Intell

9、ectual Property Rights . 4G1Foreword 4G1Modal verbs terminology . 4G1Introduction 5G11 Scope . 6G12 References . 6G12.1 Normative references . 6G12.2 Informative references . 6G13 Definitions and abbreviations 7G13.1 Definitions . 7G13.2 Abbreviations 7G14 ETSI EN 319 412 certificate profiles 7G14.1

10、 General approach . 7G14.2 Overview of other parts of ETSI EN 319 412 . 8G14.2.1 ETSI EN 319 412-2 . 8G14.2.2 ETSI EN 319 412-3 . 8G14.2.3 ETSI EN 319 412-4 . 8G14.2.4 ETSI EN 319 412-5 . 8G15 Common data structures 9G15.1 Semantics identifiers 9G15.1.1 General . 9G15.1.2 ASN.1 module 9G15.1.3 Natur

11、al person semantics identifier .10G15.1.4 Legal person semantics identifier10G1Annex A (informative): Change History 12G1History . 13G1ETSI ETSI TS 119 412-1 V1.2.1 (2018-05)4 Intellectual Property Rights Essential patents IPRs essential or potentially essential to normative deliverables may have be

12、en declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“

13、, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referen

14、ced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Trademarks The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners. ETSI claims no ownership of these exce

15、pt for any which are indicated as being the property of ETSI, and conveys no right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does not constitute an endorsement by ETSI of products, services or organizations associated with those trademark

16、s. Foreword This Technical Specification (TS) has been produced by ETSI Technical Committee Electronic Signatures and Infrastructures (ESI). The present document is part 1 of a multi-part deliverable covering the Certificate Profiles, as identified below: Part 1: “Overview and common data structures

17、“; Part 2: “Certificate profile for certificates issued to natural persons“; Part 3: “Certificate profile for certificates issued to legal persons“; Part 4: “Certificate profile for web site certificates“; Part 5: “QCStatements“. Modal verbs terminology In the present document “shall“, “shall not“,

18、“should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citatio

19、n. ETSI ETSI TS 119 412-1 V1.2.1 (2018-05)5 Introduction ITU and ISO issued standards for certification of public keys in Recommendation ITU X.509 | ISO/IEC 9594-8 i.3 which are used for the security of communications and data for a wide range of electronic applications. Regulation (EU) No 910/2014

20、i.9 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC defines requirements on specific types of certificates named “qualified certificates“. Implementatio

21、n of Directive 1999/93/EC i.1, superseded by the Regulation (EU) No 910/2014 i.9, and deployment of certificate infrastructures throughout Europe as well as in countries outside of Europe, have resulted in a variety of certificate implementations for use in public and closed environments, where some

22、 are declared as qualified certificates while others are not. Applications need support from standardized and interoperable identity certificates profiles, in particular when applications are used for electronic signatures, authentication and secure electronic exchange in open environments and inter

23、national trust scenarios, but also when certificates are used in local application contexts. This multi-part deliverable aims to maximize the interoperability of systems issuing and using certificates both in the European context under the Regulation (EU) No 910/2014 i.9 and in the wider internation

24、al environment. ETSI ETSI TS 119 412-1 V1.2.1 (2018-05)6 1 Scope The present document provides an overview of the Recommendation ITU-T X.509 | ISO/IEC 9594-8 i.3 based certificate profiles and the statements for EU Qualified Certificates specified in other parts of ETSI EN 319 412 i.4 to i.7. It spe

25、cifies common data structures that are referenced from other parts of ETSI EN 319 412 i.4 to i.7. The profiles specified in this multi-part deliverable aim to support both the Regulation (EU) No 910/2014 i.9 and use of certificates in a wider international context. Within the European context, it ai

26、ms to support both EU Qualified Certificates and other forms of certificate. 2 References 2.1 Normative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For

27、non-specific references, the latest version of the referenced document (including any amendments) applies. Referenced documents which are not found to be publicly available in the expected location might be found at https:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause

28、 were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are necessary for the application of the present document. 1 IETF RFC 3739: “Internet X.509 Public Key Infrastructure: Qualified Certificates Profile“. 2 ISO 3166: “Codes for th

29、e representation of names of countries and their subdivisions“. 3 ETSI TS 119 495: “Electronic Signatures and Infrastructures (ESI); Sector Specific Requirements; Qualified Certificate Profiles and TSP Policy Requirements under the payment services Directive (EU) 2015/2366“. 2.2 Informative referenc

30、es References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the referenced document (including any amendments) applies. NOTE:

31、 While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are not necessary for the application of the present document but they assist the user with regard to a particular subject area. i.1

32、 Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures. i.2 ETSI EN 319 401: “Electronic Signatures and Infrastructures (ESI); General Policy Requirements for Trust Service Providers“. i.3 Recommendation ITU-T X.509

33、| ISO/IEC 9594-8: “Information technology - Open Systems Interconnection - The Directory: Public-key and attribute certificate frameworks“. i.4 ETSI EN 319 412-2: “Electronic Signatures and Infrastructures (ESI); Certificate Profiles; Part 2: Certificate Profile for certificates issued to natural pe

34、rsons“. i.5 ETSI EN 319 412-3: “Electronic Signatures and Infrastructures (ESI); Certificate Profiles; Part 3: Certificate Profile for certificates issued to legal persons“. ETSI ETSI TS 119 412-1 V1.2.1 (2018-05)7 i.6 ETSI EN 319 412-4: “Electronic Signatures and Infrastructures (ESI); Certificate

35、Profiles; Part 4: Certificate Profile for web site certificates“. i.7 ETSI EN 319 412-5: “Electronic Signatures and Infrastructures (ESI); Certificate Profiles; Part 5: QCStatements“. i.8 IETF RFC 5246: “The Transport Layer Security (TLS) Protocol Version 1.2“. i.9 Regulation (EU) No 910/2014 of the

36、 European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC. i.10 Recommendation ITU-T X.520 (10/2012): “Information technology - Open Systems Interconnection - The Direc

37、tory: Selected attribute types“. i.11 IETF RFC 5280: “Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile“. i.12 Council Directive 2006/112/EC of 28 November 2006 on the common system of value added tax. i.13 Directive (EU) 2015/2366 of the European Par

38、liament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present

39、document, the terms and definitions given in ETSI EN 319 401 i.2 and the following apply: EU Qualified Certificate: qualified certificate that is stated to be in accordance with Annex I, III or IV of the Regulation (EU) No 910/2014 i.9 or annex I of the Directive 1999/93/EC i.1 whichever is in force

40、 at the time of issuance 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply: ASN.1 Abstract Syntax Notation 1 CA Certification Authority OID Object Identifier TLS Transport Layer Security protocol NOTE: As specified in IETF RFC 5246 i.8. TSP Trust Service P

41、rovider UN United Nations 4 ETSI EN 319 412 certificate profiles 4.1 General approach All the certificate profiles specified in ETSI EN 319 412 are based upon IETF RFC 5280 i.11 for generic profiling of Recommendation ITU-T X.509 | ISO/IEC 9594-8 i.3. The certificate profiles specify profiles for bo

42、th EU Qualified Certificates and non-qualified certificates as relevant. Reference is made to ETSI EN 319 412-5 i.7 for requirements relating to G1G2G3G4G5G4G6G7G6G8G4G9. ETSI ETSI TS 119 412-1 V1.2.1 (2018-05)8 4.2 Overview of other parts of ETSI EN 319 412 4.2.1 ETSI EN 319 412-2 Electronic Signat

43、ures and Infrastructures (ESI); Certificate Profiles; Part 2: Certificate profile for certificates issued to natural persons. Scope: This part specifies the requirements on certificate content for TSPs issuing certificates to natural persons. It provides a certificate profile, which facilitates inte

44、roperability of certificates issued to natural persons for the purposes of supporting digital signatures, peer entity authentication, data authentication as well as data confidentiality. It specifies a profile for both EU Qualified Certificates as specified in the Regulation (EU) No 910/2014 i.9, an

45、d non-qualified certificates. When certificates for natural persons are issued as EU Qualified Certificates, it makes reference to ETSI EN 319 412-5 i.7 for requirements relating to G1G2G3G4G5G4G6G7G6G8G4G9. 4.2.2 ETSI EN 319 412-3 Electronic Signatures and Infrastructures (ESI); Certificate Profile

46、s; Part 3: Certificate profile for certificates issued to legal persons. Scope: This part specifies the requirements on certificate content for TSPs issuing certificates to legal persons. It provides a certificate profile, which facilitates interoperability of certificates issued to legal persons fo

47、r the purposes of supporting digital signatures, peer entity authentication, data authentication as well as data confidentiality. It specifies a profile for both EU Qualified Certificates and non-qualified certificates. When certificates for legal persons are issued as EU Qualified Certificates, it

48、makes reference to ETSI EN 319 412-5 i.7 for requirements relating to G1G2G3G4G5G4G6G7G6G8G4G9. 4.2.3 ETSI EN 319 412-4 Electronic Signatures and Infrastructures (ESI); Certificate Profiles; Part 4: Certificate profile for web site certificates. Scope: This part specifies the requirements on certifi

49、cate content for TSPs issuing website certificates for sites that are accessed via the TLS protocol i.8. It provides a certificate profile, which enables interoperability of website certificates issued to legal or natural persons. It specifies a profile for both EU Qualified Certificates and non-qualified certificates. When certificates for web site authentication are issued as EU Qualified Certificates, it makes reference to ETSI EN 319 412-5 i.7 for requirements relating to G1G2G3G4G5G4G6G7G6G8G4G9