CRY · Cryptography and Key Management
CRY-08 Public-Key Certificate Issuance
Changed since C5:2020 · formerly CRY-04
Basic criterion
Dissolved the former key management criterion and moved public-key certificate issuance into its own criterion with extended requirements.
Additional criterion
Dissolved the former key management criterion and moved public-key certificate issuance into its own criterion, to which the former key management additional criterion does not apply.
Wording in C5:2020
Basic criterion
Procedures and technical safeguards for secure key management in the area of responsibility of the Cloud Service Provider include at least the following aspects:
- Generation of keys for different cryptographic systems and applications;
- Issuing and obtaining public-key certificates;
- Provisioning and activation of the keys;
- Secure storage of keys (separation of key management system from application and middleware level) including description of how authorised users get access;
- Changing or updating cryptographic keys including policies defining under which conditions and in which manner the changes and/or updates are to be realised;
- Handling of compromised keys;
- Withdrawal and deletion of keys; and
- If pre-shared keys are used, the specific provisions relating to the safe use of this procedure are specified separately.
Additional criterion
Keys should be withdrawn or deleted e.g. in the event of compromise or employee changes. The Cloud Service Provider protects the keys which are created and inserted into the cloud service by the cloud customers according to the same criteria as the keys created by the Cloud Service Provider.
Basic criterion
The cloud service provider has documented and implemented procedures to securely issue and obtain public-key certificates, ensuring the integrity and authenticity of cryptographic keys. These procedures include:
- Verification of identity before issuing public-key certificates that are issued by or on behalf of the cloud service provider for its own system components or personnel to ensure they are granted to legitimate entities;
- Secure methods for issuing certificates that are issued by or on behalf of the cloud service provider for its own system components or personnel to prevent unauthorised access; and
- Procedures for obtaining public-key certificates from trusted Certificate Authorities to ensure the authenticity of the certificates used by the cloud service provider.
Supplementary information
The first two bullet points apply to certificates issued by or on behalf of the cloud service provider for its own system components and personnel. If the cloud service provider offers certificate authority services for cloud service customers, the shared responsibility principle applies, i.e. the cloud service provider should ensure that the cloud service provides adequate technical measures to enable cloud service customers to perform adequate identity verification (cf. also the Complementary Customer Criteria).
The third bullet point applies to certificates that the cloud service provider obtains from external Certificate Authorities for use in its own cloud services and system components. The cloud service provider should ensure that certificates are obtained only from trusted Certificate Authorities and that the authenticity of received certificates is verified before use. This criterion does not necessarily extend to certificates that cloud service customers obtain from external Certificate Authorities for their own purposes; the selection and validation of external Certificate Authorities by customers falls under customer responsibility within the shared responsibility model.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that, where they use certificate authority services provided by the cloud service provider, identity verification procedures appropriate to the certificates being issued are implemented and the technical controls provided by the cloud service are configured to enable and enforce identity verification. Cloud service customers ensure with suitable controls that, where they obtain certificates from external Certificate Authorities for their own use, procedures are established for selecting trusted Certificate Authorities and validating the authenticity of obtained certificates.
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources