Which FPKI Certs on a PIV Should be Used for What Purpose about piv-guides

[lachellel]

a table aligning all FPKI certificates with its intended purpose.

• Not for all FPKI certificates - but specific to PIV:
• https://piv.idmanagement.gov/details/#understanding-piv-certificates

a guide on how to identify each certificate.

• might want to break out the details into smaller chunks of information and side nav

Little harder, what to do if the intended certificate does not have the appropriate extensions.

• this is a compliance issue and generally the intended audience for this playbook isn't involved in compliance - they are trying to make something "work"
• we can move this one elsewhere or create a compliance focused link

[rt-smithee]

IMO it should say "SHA-256" not "SHA-2" because SHA-2 is a hash family including e.g. SHA-384, SHA-512, SHA-224, etc.

[godadada]

https://ocio.nih.gov/Smartcard/Pages/Your-PIV-Certificates.aspx#TYPE

Types of Certificates on your PIV card
Your PIV card contains four types of digital certificates:
Authentication Certificate used to log you on to applications and computers.
This certificate usually has an -A after your name.
Encryption Certificate used to encrypted email messages send to you.
This certificate usually has an -E after your name.
Signing Certificate used to digatally sign emails and documents.
This certificate usually has an -S after your name.
Card Management Certificate which is not currently used at NIH.
This certificate is issued to PIV or PIV Users.
The new 128K PIV Cards (see below) may also contain up to five of your prior encryption certificates to make it easier for you to read old encrypted emails. These certificates will have older expiration dates and may, or may not, have an -E after your name.

Note: If you have a 64K PIV card, or need to read very old encrypted emails, you will need to recover the old certificates and associated keys used to encrypt them.

[godadada]

commited:
https://github.com/GSA/piv-guides/blob/piv-cert-typs/pages/piv-certificate-types.md

[clstmbrly]

Putting on hold, per @lachellel on 8/29/2017.

[clstmbrly]

This Issue is very similar to FPKI-Guides' Issue #159, "Distinguishing between certs on a PIV." Combined request from FPKI-Guides' #159 with PIV-Guides' #101--more applicable location. FPKI-Guides' #159 is now closed.
@ryancdickson

[maxwellfunk]

due to lack of consistency across all PIV issuers in adding suffixes to the common names (-A, -E, -S) the only way to distinguish certs by profile is a combination of KU and EKU which is accounted or in the table of the following page:
https://piv.idmanagement.gov/details/#understanding-piv-certificates