4.2 KiB
4.2 KiB
DBIS AS4 Settlement PKI/CA Model
Date: 2026-01-19
Version: 1.0.0
1. Overview
This document defines the Public Key Infrastructure (PKI) and Certificate Authority (CA) model for the DBIS AS4 Settlement System.
2. Certificate Authority Model
2.1 DBIS Root CA
- Purpose: Root certificate authority for DBIS AS4 Settlement
- Validity: 20 years
- Key Size: RSA 4096 or ECDSA P-384
- HSM Backed: Yes (hardware security module)
2.2 DBIS Intermediate CA
- Purpose: Intermediate CA for issuing member certificates
- Validity: 10 years
- Key Size: RSA 4096 or ECDSA P-384
- HSM Backed: Yes
2.3 Member Certificates
- Purpose: Member AS4 endpoint certificates
- Validity: 1-2 years (configurable)
- Key Size: RSA 2048 or ECDSA P-256
- HSM Backed: Recommended for production
2.4 External CA Support
- Members may use recognized external CAs
- Certificate pinning required
- Fingerprint validation required
- Approved CA list maintained by DBIS
3. Certificate Types
3.1 TLS Certificates
- Purpose: Mutual TLS for AS4 transport
- Subject Alternative Names: Required for endpoint URLs
- Key Usage: Digital Signature, Key Encipherment
- Extended Key Usage: Server Authentication, Client Authentication
3.2 Signing Certificates
- Purpose: Message-level signatures (XMLDSig/JWS)
- Key Usage: Digital Signature, Non-Repudiation
- Extended Key Usage: Code Signing (for message signing)
3.3 Encryption Certificates
- Purpose: Message encryption (XML Encryption/JWE)
- Key Usage: Key Encipherment, Data Encipherment
- Extended Key Usage: Email Protection (for message encryption)
4. Certificate Lifecycle
4.1 Issuance
- Member submits Certificate Signing Request (CSR)
- DBIS validates member identity
- Certificate issued by DBIS CA or external CA
- Certificate distributed securely
- Certificate registered in Member Directory
4.2 Validation
- Certificate chain validation
- Certificate pinning (fingerprint matching)
- Revocation checking (OCSP/CRL)
- Expiration monitoring
4.3 Rotation
- Automatic rotation 30 days before expiration
- Manual rotation on compromise
- Grace period for certificate updates
- Rollback procedures defined
4.4 Revocation
- Immediate revocation on compromise
- Revocation list (CRL) published
- OCSP responder available
- Member Directory updated immediately
5. Certificate Pinning
5.1 Fingerprint Storage
- SHA-256 fingerprint stored in Member Directory
- Fingerprint validation on every connection
- Mismatch results in connection rejection
5.2 Pinning Policy
- Strict pinning: Exact fingerprint match required
- No fallback to certificate chain validation
- Exception: Certificate rotation window (7 days)
6. Key Management
6.1 HSM Integration
- Root CA keys: HSM-backed (hardware security module)
- Intermediate CA keys: HSM-backed
- Member keys: HSM-backed (recommended)
6.2 Key Generation
- Keys generated in HSM (never exported)
- Key backup: Encrypted, stored securely
- Key recovery: Per security policy
6.3 Key Custody
- Separation of duties
- Multi-person authorization for CA operations
- Audit trail for all key operations
7. Security Controls
7.1 Access Control
- Role-based access to CA operations
- Multi-factor authentication required
- Audit logging for all operations
7.2 Physical Security
- HSM in secure data center
- Access controls and monitoring
- Environmental controls
7.3 Operational Security
- Certificate issuance requires approval
- Revocation requires immediate action
- Monitoring and alerting for anomalies
8. Compliance
8.1 Standards
- X.509 v3 certificates
- RFC 5280 compliance
- CA/Browser Forum Baseline Requirements (where applicable)
8.2 Audit
- Certificate lifecycle audit trail
- Regular security audits
- Compliance reporting
9. Member Directory Integration
9.1 Certificate Registry
- Member certificates stored in Member Directory
- Fingerprints indexed for fast lookup
- Certificate status tracked (active, expired, revoked)
9.2 Discovery
- Members query directory for peer certificates
- Certificate updates propagated automatically
- Version control for certificate history
End of Document