I am thinking about how to design and structure CP and CPS for multiple CAs build in a hierarchical manner and compliant to RFC 3647.
The structure of CAs in build from one Root CA to multiple subordinate CAs each serving different PKI service and certificate profiles:
Root CA --> CP0 and CPS0
- Sub CA 1 --> CP1 and CPS1
- issuing VPN certificates
- Sub CA 2 --> CP2 and CPS2
- issuing client certificates
- issuing RA certificates
- Sub CA 3 --> CP3 and CPS3
- issuing certificates for authentication with custom extension
- Sub CA 4 --> CP4 and CPS4
- issuing certificates for devices
- Sub CA 5 --> CP5 and CPS5
- issuing certificates for payment cards
- issuing certificates for payment authorization
- issuing certificates for merchant access
- etc...
Now I know what is OID and how to define CP in certificate together with URL to CPS. Currently only Root CA has defined "any policy" with OID 2.5.29.32.0. Every subordinate CA has its own definition of OID and therefore should have its own CP and CPS for PKI services it provides. But with growing number of Sub CAs it is really hard to maintain all of these CP and CPS.
What is the best practice how to handle complex PKI environments point of view of CP and CPS?
Should I start using OID on certificate profile level and not on Sub CA? And in that case create one or two CP with the definition of all OIDs related to certificates that can be issued?
In that case there can be one CP with:
- CP --> OID1
- issuing VPN certificates --> OID2
- issuing client certificates --> OID3
- issuing RA certificates --> OID4
- issuing certificates for authentication with custom extension --> OID5
- issuing certificates for devices --> OID6
- issuing certificates for payment cards --> OID7
- issuing certificates for payment authorization --> OID8
- issuing certificates for merchant access --> OID9
So I can maintain only one version of CP and several version of CPS related to PKI services different from each other or also only one CPS for whole environment?