FP6−2004−Infrastructures−6-SSA-026409 E-infrastructure shared between Europe and Latin America Madrid, Kick-off Meeting, 30.01.2006 39 CA profile: Operational requirements The private key of the CA must be protected with a pass phrase –of at least 15 characters –known only by specific personnel of the Certification Authority –except in the case of an HSM where an equivalent level of security must be maintained –some CAs protect the private key with two passwords known by two different persons so that for signing operations the agreement of both persons is necessary Copies of the encrypted private key must be kept on offline mediums in secure places where access is controlled –access controlled means that only CA authorized personnel should be able to have access to the CA private key (even in encrypted format) –for instance maintenance or cleaning personnel must be accompanied at all times when in the room where the keys are stored or the machines installed –preferably the CA keys should be stored in fire-proof safes –an off-site backup is advisable –the offline mediums should be preferably read only
{}