Customer certificate policy and practice

Customer certificates

The Layer8 Basic Assurance Hardware Customer certificate family supports approved organizations and their authorized users with certificates for authentication and document signing.

The family has separate root, policy, authentication and document-signing authorities. Subscriber private keys are created and kept on the user's device, with distinct keys for authentication and document signing.

Policy and practice

What customers should expect

• Requests require an active organization membership, the service entitlement and approval by a separate authorized person.
• Authentication and document signing use separate on-device keys. Subscriber private keys are not exported or escrowed.
• A production leaf certificate has a maximum actual lifetime of 42 days, including backdating. Fresh-key renewal for a full 42-day certificate starts on day 31.
• Enrollment and renewal use an approved certificate profile and include checks for the relevant device and application.

Trust and status

Issuer certificates, revocation lists and online certificate status provide the information applications use to establish trust and check certificate status. The Layer8 status site shows monitored service conditions.

Contact Layer8 to discuss customer certificates.