SPECIFIC DOCUMENTATION FOR WEBSITE CERTIFICATES

SPECIFIC DOCUMENTATION FOR WEBSITE CERTIFICATES

 _{IZENPE 2015}

2 OF 17_2015_v1.0

1 Introduction

This document includes the Specific Documentation for certificates issued by Ziurtapen eta Zerbitzu Enpresa-Empresa de Certificación y Servicios, Izenpe, S.A. (henceforth Izenpe) for different types of websites.

The purpose of this document is to detail and complete for this type of certificates the information provided in a more generic form in the Izenpe Certification Practice Statement, in the specific documents of the CA/Browser Forum (Baseline Requirements and EV guidelines for issuing certificates for websites) and in the ETSI specifications (www.etsi.org).

Thus, Izenpe adheres to the following certification policies established by ETSI: • DVCP (Domain Validation Certificates Policy): in the “DV SSL” certificates.

• OVCP (Organizational Validation Certificates Policy): in the “OV SSL” and “Office” certificates. • EVCP (Extended Validation Certificates Policy): in the “EV Office” and “EV SSL” certificates. In the scope of the Google Certificate Transparency project, the EV SSL and EV Office certificates issued will be published in the Izenpe CT Log service and that of other log server providers with which Izenpe has signed agreements in order to comply with Google requirements.

1.1 Description of certificates

Izenpe issues these certificates to enable subscribers to offer added security to their web services. As for the type of certificate issued by Izenpe,

SSL ELECTRONIC OFFICE

DV SSL Office

OV SSL EV Office

EV SSL

The purpose of this type of certificate is to establish data communications in web servers with SSL/TLS.

They enable the exchange of encrypted communication between the user and website, facilitating the keys needed to encrypt the information sent over the Internet.

− SSL CERTIFICATES,

Depending on the validation the certificate can be,

DOMAIN VALIDATED SSL (DV SSL),

This certificate, considered a non-qualified certificate, is used to verify the ownership of the domain that hosts the website, providing a reasonable guarantee to the Internet browser user.

These certificates remain valid for 1, 2, or 3 years.

3 OF 17_2015_v1.0

This certificate, considered non-qualified, is used to validate the domain ownership and the organization, providing the Internet browser user with a reasonable guarantee that the website being accessed belongs to the organization identified in the certificate.

These certificates remain valid for 1, 2, or 3 years.

VALIDATION EXTENDED SSL (EV SSL),

This certificate, considered non-qualified, is used to validate the domain ownership and the organization, providing the Internet browser user with a robust guarantee that the website being accessed belongs to the organization identified in the certificate.

These certificates remain valid for 1 or 2 years.

− _{ELECTRONIC OFFICE CERTIFICATES}

IZENPE, in accordance with Act 11/2007, of 22 June, on Electronic Access of Citizens to Public Services, issues the following types of certificates:

ELECTRONIC OFFICE,

This is a certificate issued with the authentication identifying the Public Administration, government agency or entity that owns the office.

According to the assurance levels defined in the Identification and digital signature scheme, the Electronic Office certificate issued by IZENPE holds an intermediate level. These certificates remain valid for 1, 2, or 3 years

ELECTRONIC OFFICE WITH EXTENDED VALIDATION EV (EV Office),

In addition to the characteristics defined in the Electronic Office certificate, extended validation (EV) provides a higher level of authentication for Public Administration, government agency or administrative entity owing to a more exhaustive validation.

According to the assurance levels defined in the Identification and digital signature scheme, the Electronic Office certificate issued by IZENPE holds an intermediate level.

4 OF 17_2015_v1.0

1.2 Identification

In order to identify certificates, IZENPE has assigned them the following object identifiers (OID).

CERTIFICATE OID DV SSL 1.3.6.1.4.1.14777.1.2.4 OV SSL 1.3.6.1.4.1.14777.1.2.1 EV SSL 1.3.6.1.4.1.14777.6.1.1 Electronic office 1.3.6.1.4.1.14777.1.1.3 EV Electronic office 1.3.6.1.4.1.14777.6.1.2

1.3 Community and scope of use

− Certificate applicant, person applying for the certificate in the name of an organization.

− _{Certificate subscriber, organization identified in the certificate.}

Scope of use The certificates will be used in the scope of the competences of the organization/Public Administration, government agency or entity holding the certificate.

1.4 General provisions

IZENPE, either directly or through the User Entities with which it has signed the corresponding legal agreement, checks the identity and any other personal information concerning certificate applicants and subscribers.

The legal instrument between the parties will include compliance with the indications in the CA/Browser Forum documents.

Certificate subscriber obligations

The subscriber's obligations are specified in the Certification Practice Statement in the section on Obligations of the Subscriber.

5 OF 17_2015_v1.0

2

Operational Requirements

2.1 List of required documentation

Issue application duly completed and signed.

The applicant shall accept the applicable Terms of Use and Subscriber Contract on the date of signing the Application published on www.izenpe.com.

Organization tax code TIN. Accreditation,

CERTIFICATE

PUBLIC ADMINISTRATION/PUBLIC SECTOR OTHER ORGANIZATIONS

OV SSL Office

Proof of the organization's validity,

− Certification issued by

Secretary/Lawyer

− Or reference in the Official Gazette in the 39 months prior to the issue application.

Documentation not required in the case of a valid recognized corporate or entity certificate issued to the requesting organization by Izenpe, provided the certificate has been issued in the last 39 months.

Proof of theorganization's validity,

− Original certification from the corresponding Register.

− Or a simple notice.

Documentation not required in the case of a valid recognized corporate or entity certificate issued to the requesting organization by Izenpe, provided the certificate has been issued in the last 39 months.

EV SSL EV Office

Proof of the organization's validity and of the applicant's competence to perform administration acts or enter into contracts on behalf of the organization.

− _{Certification issued by}

Secretary/Lawyer.

− Or reference in the Official Gazette in the 13 months prior to the issue application.

Documentation not required in the case of a valid recognized corporate or entity certificate issued to the requesting organization by Izenpe, provided the certificate has been issued in the last 13 months.

Proof of the organization's validity and of the applicant's power to perform administration acts or enter into contracts on behalf of the organization,

− _{Original certification from the} corresponding Register.

− Or a simple notice.

Documentation not required in the case of a valid recognized corporate or entity certificate issued to the requesting organization by Izenpe, provided the certificate has been issued in the last 13 months.

6 OF 17_2015_v1.0

2.2 Procedure Request

TheAPPLICANT shall submit the Issue Application and required documentation,

− By post to: IZENPE, S.A., C/ BEATO TOMAS DE ZUMARRAGA, 71 -1ª PLANTA – 01008 VITORIA-GASTEIZ.

− By email to: [email protected].

− _{Or by completing the application provided for this purpose on the Izenpe website.}

By signing the Issue Application, the applicant agrees to the Terms of Use and the Subscriber Contract. Validation of documentation, DV SSL OV SSL EV SSL Office EV Office

Verification that the applicant is entitled to use the domain or subdomain • _{General domains (.com, .net, .org, .info, .biz, etc.): whois.icann.org}

.es domains: www.nic.es .eu domains: www.eurid.eu .eus domain: whois.nic.eus

The registrant should coincide with the applicant organization. If not, the applicant must provide proof of the subscriber's right to use the domains.

Email verification of the applicant's knowledge that the certificate is being processed.

Verification by the CAA if they are registered and in all cases compliance with RFC 6844 guidelines.

OV SSL EV SSL Office EV Office

Verification of postal address at, • Data Protection Agencies. • Telephone operator pages.

• Eudel, for towns in the Basque Country.

In the event of discrepancy between the documentation provided and the check run, Izenpe will verify that the address given on the Application is stable location of the applicant organization's operations.

In the case of OV SSL certificates wildcards will be allowed in subdomains or host names, provided the applicant entity can prove its legitimate control of the complete domain name. Otherwise the request will be rejected.

For example, *.co.uk or *.local cannot be issued, but *.example.com can be issued to the company Example, Inc.

EV SSL EV Office

Proof of the applicant's competence to perform administrative acts or enter into contracts on behalf of the organization.

Check that the landline (not mobile) number is relevant to the applicant entity. Sources of verification:

• _{Telephone operator pages, Data Protection Agencies or Eudel for municipalities in the} Basque Country.

• Subsequent verification by phone.

Verification that the domain does not appear on risk lists in, • _{The internal databases of Izenpe.}

7 OF 17_2015_v1.0

• And/or in the McAfee TrustedSource Web Database

Double signature for documentation verification by, • The Legal Office

• and the Technical Department

Validation of the verifications made by the Head of the Technical Department.

NOTE.

− _{Izenple may perform additional verifications such as: confirmation of the request by the} organisation or authorisation for the applicant to process the certificate in the name of the organization and the annual review of its compliance by means of external audit.

− _{In cases where the validation cannot be carried out as determined, this will be justified in} the documentation verification document.

− _{Once the documentation has been checked, Izenpe will report the verifications it has made} by way of a documentation verification document.

− _{Only on EV certificates is validation dual.}

− _{It will not be necessary to make the above verifications if the information has already been} validated within the previous 13 months for EVs and 39 months for the rest.

8 OF 17_2015_v1.0 PROCESO DE SOLICITUD Y EMISIÓN DE

CERTIFICADOS SSL EV Y SEDE EV S o lic it u d V a lid a c ió n ju rí d ic a V a lid a c ió n té c n ic a G e n e ra c ió n y e n tr e g a Responsable de Área Técnica Área Jurídica Solicitante Responsable de Seguridad Telemática o presencial Formulario de solicitud Completar formulario solicitud Envío a Izenpe documentación ¿Necesari o identificar ? Acreditación solicitante ¿Docume ntación OK? NO Acreditación organización Contacto con la entidad para la subsanación de errores Personación en RA NO SI Comprobaciones técnicas SI ¿OK? Contacto con entidad

para subsanación de errores NO Firma acta jurídica Firma acta técnica SI Validación expediente completo Sslicitud petición técnica Generación petición técnica ¿OK? Contacto con entidad

para subsanación de errores NO Emisión SI Envío certificado y contrato Prueba certificado y envío de hoja de entrega Archivo hoja entrega

2.3 Issue and delivery of the certificate

Izenpe will ask the Technical Manager indicated on the Issue Application to generate the technical request and submit it by e-mail to Izenpe.

If the Izenpe application is used, the Technical Manager will enter the technical request. Izenpe will send the certificate to the Technical Manager by email or via the application. The applicant must sign and return to Izenpe the Delivery and Acceptance Sheet.

2.4

Fee

Once the certificate is issued, the applicable fee is due.

The applicable fees are posted every year on the Izenpe website at www.izenpe.com and on the application provided for this purpose.

2.5 Verification of certificate

The signatory will have 15 working days from the date of issuance to make sure the certificate works properly; if operational defects are detected, Izenpe must be notified.

Only if operational defects are due to technical reasons, or to errors made by Izenpe in the data contained in the certificate, will Izenpe revoke the certificate and issue a new one at its own expense.

9 OF 17_2015_v1.0

2.6 Revocation of Certificates

The revocation of a certificate can be requested by: - The subscriber.

The following individuals are authorized to request the revocation of a certificate: The legal representative of the subscriber entity, the personnel manager or a third party authorized or either of the two.

- The applicant.

- Izenpe is authorized to request the revocation of end-entity subscriber certificates for technical reasons, as provided in the CPS.

Procedure

The person requesting revocation will process the Revocation Application through Izenpe. The certificate can be revoked at any time.

The applicant can revoke the certificate through the following channels: - In person:

o After scheduling an appointment with Izenpe at www.izenpe.com

o Or at the subscriber organization with whom Izenpe has subscribed the relevant legal instrument.

- Over the phone, by calling 902 542 542. The following are required for identification:

o Applicant ID

o Technical contact ID o Applicant email

o Fully qualified domain name (FQDN)

10 OF 17_2015_v1.0

- Or by post, submitting a signed and notarized revocation request.

Causes for revocation

Causes can be found in the Certification Practice Statement available at www.izenpe.com In addition, in the case of certificates regulated in this specific documentation Izenpe,

1. Will present the subscriber, third parties and Internet browsers with clear instructions on how to report complaints or suspicions of private key compromise, certificate misuse or other kinds of fraud, compromise, misuse or improper behaviour related to certificates.

2. Will investigate problem reports within the 24 hours of their receipt and will decide whether or not to revoke them, considering at least the following criteria:

- The nature of the case at hand;

- The number of problem reports received for a certificate or web page. - The identity of those making the complaint.

- Current legislation.

2.7 Renewal of the Certificate

To renew a certificate the applicant must follow the certificate issuance process established, taking into account that the verifications are valid for 13 months.

2.8 Audits and incidents

Criteria referring to audits and analysis of incidents,

Ways in which to present complaints or suggestions, - By phone: 902 542 542

- E-mail: [email protected]

- A complaint and suggestion form is available atwww.izenpe.com

- Completing the complaints or claims forms available at the registration points. Internal registry of incidents.

11 OF 17_2015_v1.0

Security incidents are managed by the Izenpe Security Committee. The annual auditing plan is performed in accordance with ETSI criteria.

IZENPE reports cases it considers as incidents (cases of fraud, phishing, etc.) on the Anti-PhisingWorkGroup website (www.apwg.org and makes sure prior to issuance that the applicant or representative does not appear in the Izenpe internal security incident database. In any case, Izenpe reserves the right to deny issuance of certificates in suspicious situations.

12 OF 17_2015_v1.0

3 Management of Changes

The modifications made to this document will be approved by the IZENPE Security Committee.

These modifications will be included in a Specific Documentation Update Document whose maintenance is guaranteed by Izenpe.

13 OF 17_2015_v1.0

4 Certificate profiles and revoked certificate lists

4.1 DV SSL certificate

14 OF 17_2015_v1.0

4.2 OV SSL certificate

15 OF 17_2015_v1.0

16 OF 17_2015_v1.0

17 OF 17_2015_v1.0