# DBIS AS4 Settlement PKI/CA Model

**Date**: 2026-01-19  
**Version**: 1.0.0

---

## 1. Overview

This document defines the Public Key Infrastructure (PKI) and Certificate Authority (CA) model for the DBIS AS4 Settlement System.

## 2. Certificate Authority Model

### 2.1 DBIS Root CA

- **Purpose**: Root certificate authority for DBIS AS4 Settlement
- **Validity**: 20 years
- **Key Size**: RSA 4096 or ECDSA P-384
- **HSM Backed**: Yes (hardware security module)

### 2.2 DBIS Intermediate CA

- **Purpose**: Intermediate CA for issuing member certificates
- **Validity**: 10 years
- **Key Size**: RSA 4096 or ECDSA P-384
- **HSM Backed**: Yes

### 2.3 Member Certificates

- **Purpose**: Member AS4 endpoint certificates
- **Validity**: 1-2 years (configurable)
- **Key Size**: RSA 2048 or ECDSA P-256
- **HSM Backed**: Recommended for production

### 2.4 External CA Support

- Members may use recognized external CAs
- Certificate pinning required
- Fingerprint validation required
- Approved CA list maintained by DBIS

## 3. Certificate Types

### 3.1 TLS Certificates

- **Purpose**: Mutual TLS for AS4 transport
- **Subject Alternative Names**: Required for endpoint URLs
- **Key Usage**: Digital Signature, Key Encipherment
- **Extended Key Usage**: Server Authentication, Client Authentication

### 3.2 Signing Certificates

- **Purpose**: Message-level signatures (XMLDSig/JWS)
- **Key Usage**: Digital Signature, Non-Repudiation
- **Extended Key Usage**: Code Signing (for message signing)

### 3.3 Encryption Certificates

- **Purpose**: Message encryption (XML Encryption/JWE)
- **Key Usage**: Key Encipherment, Data Encipherment
- **Extended Key Usage**: Email Protection (for message encryption)

## 4. Certificate Lifecycle

### 4.1 Issuance

1. Member submits Certificate Signing Request (CSR)
2. DBIS validates member identity
3. Certificate issued by DBIS CA or external CA
4. Certificate distributed securely
5. Certificate registered in Member Directory

### 4.2 Validation

- Certificate chain validation
- Certificate pinning (fingerprint matching)
- Revocation checking (OCSP/CRL)
- Expiration monitoring

### 4.3 Rotation

- Automatic rotation 30 days before expiration
- Manual rotation on compromise
- Grace period for certificate updates
- Rollback procedures defined

### 4.4 Revocation

- Immediate revocation on compromise
- Revocation list (CRL) published
- OCSP responder available
- Member Directory updated immediately

## 5. Certificate Pinning

### 5.1 Fingerprint Storage

- SHA-256 fingerprint stored in Member Directory
- Fingerprint validation on every connection
- Mismatch results in connection rejection

### 5.2 Pinning Policy

- Strict pinning: Exact fingerprint match required
- No fallback to certificate chain validation
- Exception: Certificate rotation window (7 days)

## 6. Key Management

### 6.1 HSM Integration

- Root CA keys: HSM-backed (hardware security module)
- Intermediate CA keys: HSM-backed
- Member keys: HSM-backed (recommended)

### 6.2 Key Generation

- Keys generated in HSM (never exported)
- Key backup: Encrypted, stored securely
- Key recovery: Per security policy

### 6.3 Key Custody

- Separation of duties
- Multi-person authorization for CA operations
- Audit trail for all key operations

## 7. Security Controls

### 7.1 Access Control

- Role-based access to CA operations
- Multi-factor authentication required
- Audit logging for all operations

### 7.2 Physical Security

- HSM in secure data center
- Access controls and monitoring
- Environmental controls

### 7.3 Operational Security

- Certificate issuance requires approval
- Revocation requires immediate action
- Monitoring and alerting for anomalies

## 8. Compliance

### 8.1 Standards

- X.509 v3 certificates
- RFC 5280 compliance
- CA/Browser Forum Baseline Requirements (where applicable)

### 8.2 Audit

- Certificate lifecycle audit trail
- Regular security audits
- Compliance reporting

## 9. Member Directory Integration

### 9.1 Certificate Registry

- Member certificates stored in Member Directory
- Fingerprints indexed for fast lookup
- Certificate status tracked (active, expired, revoked)

### 9.2 Discovery

- Members query directory for peer certificates
- Certificate updates propagated automatically
- Version control for certificate history

---

**End of Document**
