WIXLIB

CA named “Ministero della Difesa - CA di Firma Digitale” performs lifetime emissions andmanagement.Policy OIDs for certificates issued for holders derive from policies published by the ETSI withineIDAS regulations. See section 7.1 for details regarding relevant profiles.DescriptionOIDBasic OID for the Ministry of Defence1.3.6.1.4.1.14031Basis for former old PKI Difesa (CPS)1.3.6.1.4.1.14031.1Policy of the former PKI Difesa as defined 4031.1.1Basis for the new PKI Difesa (CPS)1.3.6.1.4.1.14031.2Policy of the new PKI Difesa as defined 6.1.4.1.14031.2.1OID of the Signature CA certificate1.3.6.1.4.1.14031.2.1.1OID of the OCSP certificate for the Signature CA1.3.6.1.4.1.14031.2.1.1.1OID of the User’s signature certificate with no usage limitation1.3.6.1.4.1.14031.2.1.1.2OID of User’s signature certificate with usage limitation1.3.6.1.4.1.14031.2.1.1.32OID of Test Remote Signature certificate1.3.6.1.4.1.14031.2.1.1.4OID of Remote Signature certificate1.3.6.1.4.1.14031.2.1.1.5OID of Users’ Signature certificate for testing purposes1.3.6.1.4.1.14031.2.1.1.6OID of the Automatic (Remote) Signature certificate1.3.6.1.4.1.14031.2.1.1.8Policy of the new eIDAS PKI as defined in https://pki.difesa.it/tsp1.3.6.1.4.1.14031.2.1OID of CPS for eIDAS signature service in Italian1.3.6.1.4.1.14031.2.1.1.100OID of CP for eIDAS signature service in Italian1.3.6.1.4.1.14031.2.1.1.101OID of the Terms and Condition document for the eIDAS signature servicein Italian1.3.6.1.4.1.14031.2.1.1.102OID of the PKI Disclosure Statement for the eIDAS signature service inItalian and English1.3.6.1.4.1.14031.2.1.1.103OID of CPS for eIDAS signature service in English1.3.6.1.4.1.14031.2.1.1.200OID of CP for eIDAS signature service in English1.3.6.1.4.1.14031.2.1.1.201OID of the Terms and Condition document for the eIDAS signature servicein English1.3.6.1.4.1.14031.2.1.1.202OID of the eIDAS Signature User’s certificate with no usage limitation1.3.6.1.4.1.14031.2.1.1.12OID of the eIDAS signature certificate with usage limitation31.3.6.1.4.1.14031.2.1.1.13OID of the Remote eIDAS Signature certificate for testing Purposes1.3.6.1.4.1.14031.2.1.1.14OID of the Remote Signature certificate1.3.6.1.4.1.14031.2.1.1.152 It should be noted that up to 30 June 2017, OID 1.3.6.1.4.1.14021.2.1.1.3 has been used3 It should be noted that from 1st July 2017 to 22 June 2020, OID 1.3.6.1.4.1.14021.2.1.1.13 has been usedNo Doc.: EN-CP–DS01 - 1.3.6.1.4.1.14031.2.1.1.201 Copyright 2016, Ministero della DifesaInizialiMinistero DifesaInizialiMinistero della Difesa9 di 61

DescriptionOIDOID of Users’ eIDAS Signature certificate for testing Purposes1.3.6.1.4.1.14031.2.1.1.16OID of the Automatic (S.G.D.) eIDAS Signature certificate1.3.6.1.4.1.14031.2.1.1.18OID of the Automatic (S.M.D. COR) eIDAS Signature certificate1.3.6.1.4.1.14031.2.1.1.19OID of the certificate of Digital Seal eIDAS1.3.6.1.4.1.14031.2.1.1.23OID of the certificate of Digital Seal AUTOREMOTE eIDAS1.3.6.1.4.1.14031.2.1.1.28In compliance with recommendations contained in [AGID LG11] section 4, i.e. “Linee guidacontenente le Regole Tecniche e Raccomandazioni.”, starting from December 2019, the QTSP isinserting the attribute CertificatePolicies (OID 2.5.29.32) a further PolicyIdentifier element withvalue agIDcert (OID 1.3.76.16.6), which represents “When included into a Rec. ITU-T X.509electronic certificate, it means that all the recommendations issued by the Agency for Digital Italyare fulfilled”.1.3PKI participantsThis section provides introductory information regarding Certification Authorities and relying partiesof the PKI Difesa.1.3.1Certification authoritiesThe Certification Authority is the third, and reliable, party that issues certificates and signs themwith its own private key (CA key). The CA designated to issue signature certificates and managecertificate status is called signature CA.Within this service, the capacity of Signature CA is performed by the Minister of Defence/StatoMaggiore Difesa – Comando per le Operazioni in Rete identified as follows:Legal personSTATO MAGGIORE DELLA DIFESA – COMANDO per le Operazioni inReteAddressVia Stresa 31b00187 ROMELegal RepresentativeCommander of Comando per le Operazioni in ReteTax code97355240587ISO Object Identifier1.3.6.1.4.1.14031General Websitewww.difesa.itCertification Centre Websitehttps://pki.difesa.it/tsp.Email addressinfo pkiff@smd.difesa.itDirectory Serverldap://ldappkiff.difesa.itNo Doc.: EN-CP–DS01 - 1.3.6.1.4.1.14031.2.1.1.201 Copyright 2016, Ministero della DifesaInizialiMinistero DifesaInizialiMinistero della Difesa10 di 61

The Commander of the Comando per le Operazioni in Rete is also a Trust Services Provider forDefence.The Certification Authority is a Root-CA that directly issues certificates for holders, it doesn’t issueSubCA certificates and it is not involved in Cross-Certification processes.NOTE – On 9 March 2020, the department in whitch QTSP is located, has changed its name to CORCommand with deed of 4 March 20201.3.2Registration authoritiesThe Registration Authority (RA) is the person, structure, or organization that: Accepts and validates issuance requests, and manages certificates;Registrates the applicant and the organization he/she belongs to;Authorizes the CA to issue the required digital certificate;Provides personnel with the digital certificate and the information required.This activity is carried out for digital signature certificates comprised in the Modello ATe (MilitaryID)/Mod. ATE by the Local Registration Authority (LRA) and by the Card Management System (CMS)of the Ministry of Defence.For automatic signature certificates the Defence Computer Protocol System Manager operates asRA.For remote signature certificates, the PKI Difesa Certification Centre directly carries out RA tasks.1.3.3SubscribersAll Defence personnel and personnel of public administration bodies that have signed a cooperationagreement. For activities, directly or indirectly pertaining to the digital signature services definedin this document, Defence has provided its own employees with a digital signature in view of thejob performed within the activities provided for in this document.End users, namely certificate subscribers will be physical persons who require a certificate and whohold the corresponding private key.1.3.4Relying partiesRelying parties are all subjects relying on information comprised in the certificate to validate thedocuments signed by holders.1.3.5Other participantsPersonnel in charge of administering and supervising the certification service are organized incompliance with Art. 38, par. 1 of the Decree of the President of the Council of Ministers dated 22/2/2013.In particular, the following profiles are established:No Doc.: EN-CP–DS01 - 1.3.6.1.4.1.14031.2.1.1.201 Copyright 2016, Ministero della DifesaInizialiMinistero DifesaInizialiMinistero della Difesa11 di 61

Security manager;Certification and Time Validation Service Manager;System Technical Administration ManagerTechnical and Logistic Services Manager;Audits and Inspections Manager.In compliance with the above-mentioned decree, the same subject cannot be tasked to performmore than one function amongts those (art. 38/2, Decree of the President of the Council of Ministersof 22/02/2013).Within the organizational functions of the certification service, the Certification and TimeValidation Manager is also the Head of the PKI Difesa Certification Centre and, as its delegate,reports to the Trust Services Provider as regards the application of current regulations for thecertification process, appropriate operation of technical services and correct management ofservice.The following profiles are also involved in the certification process:1.4 Local Manager, a professional profile employed in the organization that requires thequalified certificates to be issued for the Holder. Data Processing Operator, a professional profile employed in the organization that supportsthe prospective certificate holder in submitting the data required for the certificates to beissued. He/she is in charge of identifying correctly the prospective holder. User (any real or immaterial organization that uses a qualified certificate to check thevalidity of the digital signature or authentication. ECertificate usageThe CA of the Ministry of Defence – eIDAS Digital Signature CA uses its key pair to: Sign issued digital certificates:Sign issued Certification Revocation Lists (CRLs).The holder of the restricted usage signature certificate comprised in the Modello ATe (MilitaryID)/Mod. ATE and remote signature HSM uses its key pair to: Sign a digital document in the formats provided for by current regulations in compliancewith usage limitations defined in the certificate itself.The holder of the unrestricted usage signature certificate comprised in the Modello ATe (MilitaryID)/Mod. ATE and remote signature HSM uses its key pair to: Sign a digital document in the formats provided for by current regulations.The holder of the automatic signature certificate in the automatic signature HSM uses its key pairto: Sign the inception of an IT process within his/her work context.The OCSP certificate of the Qualified Signature CA is used to:No Doc.: EN-CP–DS01 - 1.3.6.1.4.1.14031.2.1.1.201 Copyright 2016, Ministero della DifesaInizialiMinistero DifesaInizialiMinistero della Difesa12 di 61

Sign the answers to audit requests regarding the validity status of a signature certificate.Anything other than usage defined in paragraph 1.4 is considered a non-authorized use of thecertificate.Any improper use of certificates issued by the Ministry of Defence on the basis of this CP is notallowed and causes the certificate to be immediately cancelled should the circumstance madeknown.1.5Policy administrationPersonnel of the Certification Centre holds and keeps this document updated. In his/her capacity oflegal representative of the Certification Centre and Trust Services Provider, the Commander of theComando per le Operazioni in Rete approves the document.This CP is written, published and updated by the Certification Centre of the Ministry of Defence/StatoMaggiore Difesa - Comando per le Operazioni in Rete, via Stresa 31b, 00135 Rome.This document is also revised and updatet when changes are made to the organization (for example,for the change of one of the managers) or for changes in the rules of reference.For further information or details concerning this CP, please contact: The email address of the PKI Difesa certification centre info pkiff@smd.difesa.itVia the following link: https://servidesk.difesa.itThe following email address helpdesk@cor.difesa.it 39-06-46914444, for the Comando Comando per le Operazioni in Rete Help Desk, whichwill forward the request to the Certification CentreThis CP and the policies therein are assessed by a Certification Authority (CAB)This CP and the policies therein comply with the policies issued by the Ministry of Defence.This CP was read and validated in its relevant parts by the System Technical Operation Manager,the auditing manager, the security manager, the logistic and technical system manager. It wasapproved by the Comando per le Operazioni in Rete Headquarters Commander as trust servicesprovider for Defence.No Doc.: EN-CP–DS01 - 1.3.6.1.4.1.14031.2.1.1.201 Copyright 2016, Ministero della DifesaInizialiMinistero DifesaInizialiMinistero della Difesa13 di 61

1.6Definitions and acronymsThis paragraph includes a list of definitions of the terms that are used in this document, as well asa list of acronyms and their tal Italy Agency (formerlyrun by DigitPA)CA certificationItalian supervisory bodyCACertification AuthorityBody that issues the certficatesCMDCarta Multiservizi DifesaA smartcard that Defence personnel is provided with as a validelectronic ID that also contains the holder’s certificatesCMSCard Management SystemThe system issues ATe models for Defence personnel and forpersonnel belonging to public adminitration bodies that havesigned a cooperation agreement with Defence.Certificate PolicyA defined set of rules specifying the applicability of acertificate for a specific community and/or class of applicationswith specific security requirements.CPSCertification PracticeStatementA document that explains the practices and operationalprocesses of the CA whereby the Ministry of Defence issuesand manages qualified signature certificates.CRLCertificate Revocation ListThe list of revoked certificatesCSRCertificate Signing RequestCertificate requestDNDistinguished NameDRDisaster RecoveryInfrastructure back-up siteFIPSFederal InformationProcessing StandardShared rules and measures that US government departmentsmust comply withHSMHardware Security ModuleHardware module for safe storage of keys for cryptographicoperationsLDAPLightweight Directory AccessProtocolThe Directory Server where certificates are publishedLRALocal Registration AuthorityLocal body in charge of enrollment procedures. It identifiesand validates the subject requesting a certificateOCSPOn-line Certificate StatusProtocolVerification service for certificate statusOTPOne Time PasswordA password that is only valid for one access or transactionP.A.Public AdministrationPublic Administration BodiesP.D.S.PKI Disclosure StatementA document summing up the main concepts in the CP andCPS.PKIPublic Key InfrastructureEquipment and Personnel tasked to issue certificatesPrivate keyPrivate keyThe secret element of asymmetric cryptography based on keypairsPublic KeyPublic keyThe secret element of asymmetric cryptography based on keypairsRARegistration A

For data enrolment purposes and in view of issuing digital signature certificates, the PKI Difesa uses the issuing system of the Modello ATe (Military ID) called Card Management System (Registration Authority-R.A.) and of the relevant local organizations pertaining to the single services (Local Registration Authority - L.R.A.). 1.1 Overview