1. INTRODUCTION

1.1 Overview

This Certification Practice Statement (“CPS”) document outlines the certification services practices for Internet Security Research Group (“ISRG”) Public Key Infrastructure (“ISRG PKI”).

ISRG PKI services include, but are not limited to, issuing, managing, validating, revoking, and renewing Certificates in accordance with the requirements of the ISRG Certificate Policy (CP). It is recommended that readers familiarize themselves with the ISRG CP prior to reading this document.

ISRG PKI services are most commonly, but not necessarily exclusively, provided under the brand/trademark “Let’s Encrypt”.

The ISRG PKI conforms to the current version of the guidelines adopted by the Certification Authority/Browser Forum (“CAB Forum”) when issuing publicly trusted certificates, including the Baseline Requirements for the Issuance and Management of Publicly Trusted Certificates (“Baseline Requirements”). CAB Forum documents can be found at https://www.cabforum.org. If there is any conflict between this CPS and a relevant CAB Forum requirement or guideline, then the CAB Forum requirement or guideline shall take precedence.

Other documents related to the behavior and control of the ISRG PKI, such as a Subscriber Agreement and Privacy Policy, can be found at https://letsencrypt.org/repository/.

Per IETF PKIX RFC 3647, this CPS is divided into nine components that cover security controls, practices, and procedures for certification services provided by the ISRG PKI.

The following Certification Authorities are covered under this CPS:

This work is licensed under the Creative Commons Attribution 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/ or send a letter to Creative Commons, PO Box 1866, Mountain View, CA 94042, USA.

1.2 Document name and identification

This is the ISRG Certification Practices Statement. This document was approved for publication by the ISRG Policy Management Authority, and is made available at https://letsencrypt.org/repository/.

The following revisions have been made:

1.3 PKI participants

1.3.1 Certification authorities

ISRG is a CA that provides services including, but not limited to, issuing, managing, validating, revoking, and renewing publicly-trusted Certificates. These services are performed in accordance with the requirements of the ISRG Certificate Policy (CP) and this CPS. These services are provided to the general public with exceptions as deemed appropriate by ISRG management or in accordance with relevant law.

ISRG PKI services are most commonly, but not necessarily exclusively, provided under the brand/trademark “Let’s Encrypt”.

1.3.2 Registration authorities

ISRG serves as its own RA. RA services are not performed by third parties.

1.3.3 Subscribers

See definition of “Subscriber” in Section 1.6.1 Definitions.

1.3.4 Relying parties

See definition of “Relying Party” in Section 1.6.1 Definitions.

Relying Parties must verify the validity of certificates via CRL or OCSP prior to relying on certificates. CRL and OCSP location information is provided within certificates.

1.3.5 Other participants

Other participants include CAs that cross-sign or issue subordinates to the ISRG PKI.

ISRG PKI vendors and service providers with access to confidential information or privileged systems are required to operate in compliance with the ISRG CP.

1.4 Certificate usage

1.4.1 Appropriate certificate uses

No stipulation.

1.4.2 Prohibited certificate uses

Certificates may not be used:

• For any application requiring fail-safe performance such as a) the operation of nuclear power facilities b) air traffic control systems c) aircraft navigation systems d) weapons control systems e) any other system in which failure could lead to injury, death, or environmental damage.
• For software or hardware architectures that provide facilities for interference with encrypted communications, including but not limited to a) active eavesdropping (e.g., Man-in-the-middle attacks) b) traffic management of domain names or internet protocol (IP) addresses that the organization does not own or control. Note that these restrictions shall apply regardless of whether a relying party communicating through the software or hardware architecture has knowledge of its providing facilities for interference with encrypted communications.

Note that Certificates do not guarantee anything regarding reputation, honesty, or the current state of endpoint security. A Certificate only represents that the information contained in it was verified as reasonably correct when the Certificate was issued.

1.5 Policy administration

1.5.1 Organization administering the document

This CPS document is maintained by the ISRG PMA.

1.5.2 Contact person

The ISRG PMA can be contacted at:

Policy Management Authority
Internet Security Research Group
1 Letterman Drive, Suite D4700
San Francisco, CA 94129

Certificate revocation requests can be made via the ACME API. Please see Section 4.9.3 for more information.

Certificate Problem Reports can be submitted via email to:

cert-prob-reports@letsencrypt.org

1.5.3 Person determining CPS suitability for the policy

The ISRG PMA is responsible for determining the suitability of this CPS. The ISRG PMA is informed by results and recommendations received from an independent auditor.

1.5.4 CPS approval procedures

The ISRG PMA approves any revisions to this CPS document after formal review.

1.6 Definitions and acronyms

1.6.1 Definitions

• ACME Protocol
  • A protocol used for validation, issuance, and management of certificates. The protocol is an open standard managed by the IETF.
• Applicant
  • An entity applying for a certificate.
• Baseline Requirements
  • A document published by the CAB Forum which outlines minimum requirements for publicly trusted Certificate Authorities.
• CAB Forum
  • Certificate Authority / Browser Forum, a group a CAs and browsers which come together to discuss technical and policy issues related to PKI systems. (https://cabforum.org/)
• Certificate Problem Report
  • Complaint of suspected Key Compromise, Certificate misuse, or other types of fraud, compromise, misuse, or inappropriate conduct related to Certificates.
• Certificate Repository
  • A repository of information about ISRG certificates. It is located at: https://letsencrypt.org/certificates/
• Cross Certificate
  • A certificate that is used to establish a trust relationship between two Root CAs.
• Policy and Legal Repository
  • A repository of policy and legal documents related to the ISRG PKI. It is located at: https://letsencrypt.org/repository/
• Key Pair
  • A Private Key and its associated Public Key.
• Precertificate
  • A certificate containing a critical poison extension as defined by RFC 6962 Section 3.1.
• Private Key
  • The key in a Key Pair that must be kept secret. Used to create digital signatures that can be verified by the corresponding Public Key or to decrypt messages encrypted by the corresponding Public Key.
• Public Key
  • The only key in a Key Pair that can safely be publicly disclosed. Used by Relying Parties to verify digital signatures from the corresponding private key or to encrypt messages that can only be decrypted by the corresponding private key.
• Relying Party
  • An entity that relies upon information contained within certificates issued by ISRG PKI services.
• Root CA
  • The top-level Certification Authority whose Root Certificate is distributed by Application Software Suppliers and that issues Subordinate CA Certificates.
• Secure PKI Facilities
  • Facilities designed to protect sensitive PKI infrastructure, including CA private keys.
• Subscriber
  • An entity that has agreed to a Subscriber Agreement and is using ISRG PKI services.
• Trusted Contributor
  • A contributor who performs in a Trusted Role. Trusted Contributors may be employees, contractors, or community members. Trusted Contributors must be properly trained and qualified, and have the proper legal obligations in place before performing in a Trusted Role.
• Trusted Role
  • A role which qualifies a person to access or modify ISRG PKI systems, infrastructure, and confidential information.

1.6.2 Acronyms

• ACME
  • Automated Certificate Management Environment
• CA
  • Certificate Authority
• CAA
  • Certificate Authority Authorization
• CP
  • Certificate Policy
• CPS
  • Certification Practice Statement
• DV
  • Domain Validation
• FQDN
  • Fully Qualified Domain Name
• HSM
  • Hardware Security Module
• IDN
  • Internationalized Domain Name
• IP
  • Internet Protocol
• ISRG
  • Internet Security Research Group
• PKI
  • Public Key Infrastructure
• PMA
  • Policy Management Authority
• RA
  • Registration Authority
• SAN
  • Subject Alternative Name
• TLD
  • Top Level Domain

1.6.3 References

No references defined at this time.

1.6.4 Conventions

Terms not otherwise defined in this CPS shall be as defined in applicable agreements, user manuals, Certificate Policies and Certification Practice Statements, of the CA.

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in these Requirements shall be interpreted in accordance with RFC 2119.