Federal Public Key Infrastructure 101

Introduction

Welcome to the Federal Public Key Infrastructure (FPKI) Guides! In these guides, you will find commonly used links, tools, tips, and information for the FPKI.

What Is the Federal PKI?

The Federal PKI is a network of certification authorities (CAs) that issue:

• PIV credentials and person identity certificates
• PIV-Interoperable credentials and person identity certificates
• Other person certificates
• A small number of federal enterprise device identity certificates

The participating certification authorities and the policies, processes, and auditing of all the participants are collectively referred to as the Federal Public Key Infrastructure (FPKI or Federal PKI).

The Federal PKI includes U.S. federal, state, local, tribal, territorial, and international governments, as well as commercial organizations, that work together to provide services for the benefit of the federal government.

Use the FPKI Graph to see the relationships between the certification authorities in the Federal PKI ecosystem. It graphically depicts how each certification authority links to another through cross-certificates, subordinate certificates, or bridge CAs.

What Is an Example of an Identity Certificate?

A PIV certificate is a simple example. Although there are many types of identity certificates, it’s easiest to explain PIV certificates since you might have one:

• Identity certificates are issued and digitally signed by a certification authority.
• The certification authority that issued and digitally signed your PIV certificates is called an intermediate certification authority. The intermediate certification authority’s certificate was issued by another certification authority.
• This process of issuing and signing continues until there is one certification authority that is called the root certification authority.

The full process of proving identity when issuing certificates, auditing the certification authorities, and the cryptographic protections of the digital signatures establish the basis of trust.

For the U.S. federal government Executive Branch agencies, there is one root certification authority, called the Federal Common Policy Certification Authority (COMMON), plus dozens of intermediate certification authorities and bridged certification authorities. See a graph of the Federal PKI, including the business communities.

Why Should Agencies Use Certificates from the Federal PKI?

All federal agencies should use the Federal PKI for:

• Facilities access, network authentication, and some application authentication for applications based on a risk assessment
• Document sharing and digital signatures
• Signed and encrypted email communications across federal agencies

The Federal PKI provides four core technical capabilities:

The Four Core Federal PKI Capabilities

• Trust with federal agencies and industry
• Support for technical non-repudiation
• Authentication and encryption
• Digital signatures

These four core capabilities are made possible by leveraging digital certificates; their policies, standards, and processes; and a mission-critical trust infrastructure.

Why Is the Federal PKI Important?

The Federal PKI is important to federal agencies, other government entities, and businesses that need access to federal facilities or participate in delivering federal government services.

Where Can I Find the Policies and Standards?

• X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework is the certificate policy for the U.S. Federal Root Certification Authority.
• Common Policy X.509 Certificate and Certificate Revocation List (CRL) Profiles specifies certificate and CRL extensions profiles for certificates and CRLs issued under COMMON.
• X.509 Certificate Policy for the Federal Bridge Certification Authority (FBCA) is the certificate policy for the FBCA.
• X.509 Certificate and CRL Extensions Profile for the FBCA specifies certificate and CRL extensions profiles for Federal PKI infrastructure systems.
• X.509 Certificate and CRL Extensions Profile for PIV-I Cards specifies certificate and CRL extensions profiles for use with Personal Identity Verification Interoperable (PIV-I) cards.
• OMB Circular A-130, Managing Information as a Strategic Resource (2016) establishes general policy for the planning, budgeting, governance, acquisition, and management of federal information, personnel, equipment, funds, IT resources, and supporting infrastructure and services.

Certification Authorities

A certification authority is a system that issues digital certificates. These digital certificates are based on cryptography and follow the X.509 standards defined for information security.

The Federal PKI (FPKI) is a network of certification authorities (CAs) that are either root, intermediate, or issuing CAs.

Any CA in the FPKI may be referred to as a Federal PKI CA. The two highest level CAs in the FPKI hierarchy are the FPKI Trust Infrastructure CAs, which are operated and managed by the Federal PKI Management Authority (FPKIMA) Program Office:

• Federal Common Policy Certification Authority
• Federal Bridge Certification Authority
• All Federal PKI Certification Authorities

COMMON serves as the root and trust anchor for the intermediate and issuing CAs operated by federal government Executive Branch agencies.

Federal Common Policy Certification Authority

The Federal Common Policy CA may be referred to as the FCPCAG2, or as COMMON in documents. As the FPKI root and trust anchor for the federal government, the FCPCAG2 supports government person trust and a small number of agency intranet enterprise devices, to include Personal Identity Verification (PIV) credentials. The FCPCA’s design enables any certificate issued by any FPKI CA to validate its certificate path to a single root CA.

At least one commercial vendors includes the FCPCAG2 root certificate in their commercial-off-the-shelf (COTS) products’ [trust stores]0(#fpki-third-party-trust). This enables federal government systems to trust person and enterprise device certificates issued by FPKI CAs. It is possible to add the FCPCAG2 root certificate to trust stores for government-managed devices and servers, if it’s not available by default.

Federal Bridge Certification Authority

The current Federal Bridge Certification Authority (FBCA) is the Federal Bridge CA G4.

The FBCA is a PKI bridge or link between the FCPCA and other CAs that comprise the FPKI network and that may operate under comparable but different certificate policies. The FBCA provides a means to map these certificate policies and CAs and allow certificates to validate to the FCPCA root certificate.

The CAs with certificates signed by the Federal Bridge CA G4 are cross-certified. These CAs have established a trust relationship with the FPKI and are audited annually for conformance to the certificate policies. This cross-certification process has extended the reach of the FPKI well beyond the boundaries of the federal government.

All Federal PKI Certification Authorities

A CA that is part of the FPKI is called a participating certification authority.

For historical records, we might label or identify CA systems using a category that shows when the system was established and for what types of communities it is or was used.

We realize all the acronyms and labels may be confusing and welcome your input to help us improve, add information over time, and simplify where needed.

Certificate Types within the Federal PKI

The overarching policies of the Federal PKI are the Federal Common Policy Framework and the Federal Bridge Certificate Policy. For federal agencies that utilize a PKI Shared Service Provider, this is a list of common certificate types available from all PKI Shared Service Provider. Please check with your individual provider if they support your specific need.

Code signing certificates are not allowed under the Federal Common Certificate Policy.

FPKI Third Party Trust

The Federal Common Policy leverages third party trust stores or public trust store to ensure interoperability of federally-issued digital certificates.

What Is a Trust Store?

Millions of public key certificates are issued to people and devices around the world. Certificates constantly change as some are revoked and others are issued—far too many for you to maintain an up-to-date list.

Every software program that interacts with a certificate either has a native trust store or uses the trust store of the operating system. A trust store is a list of root, intermediate, and sometimes user certificates that are trusted by the operating system or application to process transactions. When you are presented with a person or device certificate from a PIV credential, website, email, or some other digital item, your application will automatically check whether the certificate has a valid path to one of the certificates in its trust store. This type of trust store is sometimes called a private trust store. An application that uses PKI certificates will say in its documentation which trust store is used and how to configure it with either public or private certificates.

What Is a Public Trust Store?

A vendor may also have a public trust program that allows PKI operators to submit their roots for distribution within the vendor’s trust store. Certificates distributed by an application may be called “public certificates” while certificates distributed by your agency or a partner may be called “private certificates.”

A public trust store program refers to the collection of root certification authority (CA) certificates that are included and distributed by default in many operating systems, browsers, or applications (referred to as application trust store for simplicity). The public root CAs contained in these trust stores must comply with the root stores requirements, including any specific compliance requirements such as a third party audit or specific operational requirements. For more information on public certificates, see the CIO Council policy on HTTPS.

What Are the Most Common Public Trust Stores?

Operating systems, browsers, and some commercial software operate public trust stores.

The table below lists some common public trust stores. All applications that use PKI use a trust store, but not all applications’ trust stores are managed by a formal program. The applications in this table manage a formal program. If the Federal Common Policy CA G2 (FCPCAG2) (i.e., COMMON) root certificate is included in a trust store and distributed by default, the Includes FCPCAG2 (COMMON)? column below will say Yes.

What Federal PKI Certificate Policies Are Trusted by Adobe and How Do I View Them?

A common question is which certificate policy object identifiers (OIDs) are trusted? The Federal PKI certificate policy OIDs trusted by Adobe are:

Federal PKI certificates may be used for digitally signing documents between federal agencies and with business partners. Adobe is just one option used for digital signatures.

Do the following to view and verify which Federal PKI certificate policy OIDs are trusted by Adobe Acrobat:

1. Open Adobe Acrobat.
2. Select Edit > Preferences > Signatures > Identities & Trusted Certificates > More.
3. Choose Trusted Certificates from the left-hand sidebar.
4. Choose Federal Common Policy CA and then the Certificate Details tab.
5. Choose the Certificate Viewer window, and click the Policies tab to see Policy Restrictions.
6. In Certificate Policies, you will see a comma-separated list of policy OIDs.