What are a certificate policy (CP) and a certification practice statement (CPS)?

A certificate policy is a policy document laying down the rules, requirements and procedures for the content, issuance, management and use of digital certificates, usually within a PKI; a certification practice statement is the CA's detailed document describing the concrete procedures, security measures and operational practices with which it implements the CP.

CPs are also used beyond PKI, for instance to define rules for issuing verifiable credentials in SSI, for certificates in IoT devices, or for qualified signature certificates under ZertES and eIDAS.

Go deeper:

• RFC 3647 Certificate Policy and Certification Practices Framework — the outline every CP and CPS follows.