Policy Device - 设备与物联网（IoT）证书策略 —— 设备证书的签发、生命周期管理、吊销与使用规范

Go back Parent node: Cert Policy - 证书策略（CP）子树 —— 规定所签发证书的适用范围、安全要求与签发/续期/吊销/审计约束 (1.3.6.1.4.1.59719.5.1)

Technical information

Dot notation:	`1.3.6.1.4.1.59719.5.1.230`
ASN.1 notation:	`{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) tsingyao(59719) pki-certificate-system(5) cert-policy(1) policy-device(230) }`
OID-IRI notation:	`/ISO/Identified-Organization/6/1/4/1/TsingYao/PKICertificateSystem/CertPolicy/PolicyDevice`
WEID notation:	`weid:P-1A2V-5-1-6E-5`
DER encoding:	`06:0C:2B:06:01:04:01:83:D2:47:05:01:81:66`

Description

English:
Device and Internet of Things (IoT) certificate policy. It defines the issuance, lifecycle management, revocation and usage rules for device and IoT certificates, and specifies identity authentication requirements, key generation, private key protection, Certificate Revocation List (CRL) and Online Certificate Status Protocol (OCSP) validation, certificate deployment, renewal and revocation mechanisms for IoT terminals.
Usage rule: all device certificates issued under this policy shall only be used for trusted communication, identity verification and secure access of IoT devices, and shall not be reused in other unauthorized scenarios.
Status: registered but unused. No device certificate has been issued under this policy; when activated, bind the certificate subject to the device unique identity (1.3.6.1.4.1.59719.1.100) and enable automatic enrolment and renewal. The unused state shall be re-verified at each revision of this file.
Recommendation: define the key generation and protection requirement per device class (secure element, trusted platform module or software keystore) and enforce the device EKU (1.3.6.1.4.1.59719.5.3.1) in issued certificates.
See also: 1.3.6.1.4.1.59719.5.300, 1.3.6.1.4.1.59719.5.3.1, 1.3.6.1.4.1.59719.2.700.
Verification: 2026-10-22 — this arc and all its sub-ordinates are confirmed unused; re-verify the unused state at each revision of this file.

中文:
设备及物联网（Internet of Things，IoT）证书策略。规定设备及物联网证书的签发、生命周期管理、吊销与使用规范，明确物联网终端的身份核验要求、密钥生成、私钥保护、证书吊销列表（Certificate Revocation List，CRL）与在线证书状态协议（Online Certificate Status Protocol，OCSP）校验、证书部署、续期及吊销机制。
使用规则：本策略下签发的所有设备证书仅用于物联网设备的可信通信、身份鉴别与安全接入，不得挪用于其他未授权场景。
状态：已注册但未使用。尚未按本策略签发任何设备证书；启用时应将证书主体与设备唯一身份（1.3.6.1.4.1.59719.1.100）绑定，并启用自动注册与自动续期。本文件每次修订时须重新核验该未使用状态。
建议：按设备类别定义密钥生成与保护要求（安全芯片、可信平台模块或软件密钥库），并在签发的证书中强制携带设备扩展密钥用法（1.3.6.1.4.1.59719.5.3.1）。
关联节点：1.3.6.1.4.1.59719.5.300、1.3.6.1.4.1.59719.5.3.1、1.3.6.1.4.1.59719.2.700。
核验：2026-10-22 —— 本弧及其全部下级标识均确认未使用，本文件每次修订时须重新核验该未使用状态。

Registration Authority

tsingyao
E-Mail: op@tsingyao.net
JunQing Gu
TsingYao Technology Limited

The RA does not want to publish their personal information.

Subordinate objects

ID	Base36	ASN.1 IDs (comma sep.)	IRI IDs (comma sep.)	RA	Comment	Created	Updated
No items available

Alternative Identifiers

Identifier	Description
aid:D276000186B200054278A5EC4263D5C8 (No PIX allowed)	OIDplus Information Object Application Identifier (ISO/IEC 7816)
guid:4278a5ec-0000-8000-a6d3-27cbb30a0726	OIDplus Information Object Custom UUID (RFC 9562)
guid:a7df48d1-68bd-3193-b9d3-bc8915266914	Name based version 3 / MD5 UUID with namespace UUID_NAMEBASED_NS_OID
guid:e78e800f-94be-5717-ba9b-6904819cb1bc	Name based version 5 / SHA1 UUID with namespace UUID_NAMEBASED_NS_OID
mac:92-79-C2-63-D5-C8	OIDplus Information Object MAC address, Unicast (AAI)
mac:93-79-C2-63-D5-C8	OIDplus Information Object MAC address, Multicast (AAI)
weid:P-1A2V-5-1-6E-5	WEID notation
x500dn:/dc=com/dc=example/cn=oidplus/1.3.6.1.4.1.37476.2.5.2.9.4.1=1115203052/1.3.6.1.4.1.37476.2.5.2.9.4.2=1113839048	OIDplus Information Object X.500 DN