Target releaseRelease 1.1
Document owner
ReviewerLead designer



Goals

The Policy Generator (PG) is an intrinsically central SCMS component that maintains and signs updates to the Global Policy File (GPF) and the Global Certificate Chain File (GCCF). In addition, the PG is required to sign Local Policy Files (LPFs) at the request of RAs who want to set local policy values or reduce the volume of information that they distribute to their EEs. When signing LPFs, the PG is responsible for validating that critical global information has not been removed and that all local policy adjustments comply with the global policy.

The figure shows the request-response relationships of the PG. This diagram explicitly includes the TCotSCMSM, which is the only authority that is able to define changes to global policy, which in turn will be distributed through the GPF. The TCotSCMSM is also the conduit through which new PCA certificate chains can be communicated for addition to the GCCF. Updates to the CRL downloaded from the CRL store might trigger updates to the GCCF in case it contains a revoked certificate.

Procedure

The PG is an intrinsically central component, so there will only be one instance of the PG in the SCMS. When adding or replacing the PG, the TCotSCMSM must ensure that all RAs are aware of the FQDN of the PG and that they are allowed to access to the PG. This will likely be done in cooperation with local ICA Managers who operate each RA.

Prior to initiating this process, the new PG must be set up according to the Setup Policy Generator use case.

End State

After completing this use case, the PG will be configured with the following values:


PG ValueNotes
CRL Store FQDN

The PG needs to download the latest CRL on a regular basis in order to remove revoked certificates from the GCCF.


After completing this use case, RAs will be configured with the following values:


RA ValueNotes
PG FQDNEvery RA in the SCMS must be able to contact the PG to request signatures on LPFs and to download the latest GPF and GCCF.


Special Cases

The procedure defined above applies when a new PG is initially added to the SCMS. Changes required for replacing a PG are required based on the reason for the replacement.

Assumptions

Requirements