Policy Code Signing - 代码签名策略（CSP）—— 代码签名证书与已签名可执行文件的校验规则与约束条件

Go back Parent node: Cert Policy - 证书策略（CP）子树 —— 规定所签发证书的适用范围、安全要求与签发/续期/吊销/审计约束 (1.3.6.1.4.1.59719.5.1)

Technical information

Dot notation:	`1.3.6.1.4.1.59719.5.1.200`
ASN.1 notation:	`{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) tsingyao(59719) pki-certificate-system(5) cert-policy(1) policy-code-signing(200) }`
OID-IRI notation:	`/ISO/Identified-Organization/6/1/4/1/TsingYao/PKICertificateSystem/CertPolicy/PolicyCodeSigning`
WEID notation:	`weid:P-1A2V-5-1-5K-4`
DER encoding:	`06:0C:2B:06:01:04:01:83:D2:47:05:01:81:48`

Description

English:
Code Signing Policy (CSP): defines the validation rules and constraints for Code Signing Certificates (CSC) and signed executable files, including signature verification, certificate trust chain checking, revocation validation and the allowed signer scope. When the policy check fails, untrusted signed code is blocked and unauthorized executable programs are prevented from running.
Recommended handling: when abnormal interception occurs, review the policy rules, trust anchor configuration, Certification Authority (CA) trust list and the accessibility of Certificate Revocation List (CRL) and Online Certificate Status Protocol (OCSP) services.
Status: registered but unused. No code signing certificate has been issued under this policy; when activated, restrict the allowed signer scope to named organizational subjects. The unused state shall be re-verified at each revision of this file.
Recommendation: require hardware protected private keys and time stamping (1.3.6.1.4.1.59719.5.210) so that signatures remain valid after certificate expiry.
See also: 1.3.6.1.4.1.59719.5.200, 1.3.6.1.4.1.59719.5.1.210, 1.3.6.1.4.1.59719.6.1.7.
Verification: 2026-10-22 — this arc and all its sub-ordinates are confirmed unused; re-verify the unused state at each revision of this file.

中文:
代码签名策略（Code Signing Policy，CSP）：定义代码签名证书（Code Signing Certificate，CSC）及已签名可执行文件的校验规则与约束条件，包含签名验证、证书信任链校验、吊销状态核验与允许签名者范围。策略校验不通过时将拦截不受信任的签名代码，阻止未授权可执行程序运行。
处理建议：发生异常拦截时，核查策略规则、信任根配置、证书颁发机构（Certification Authority，CA）信任列表以及证书吊销列表（Certificate Revocation List，CRL）与在线证书状态协议（Online Certificate Status Protocol，OCSP）的连通状态。
状态：已注册但未使用。尚未按本策略签发任何代码签名证书；启用时应将允许签名者范围限定为具名组织主体。本文件每次修订时须重新核验该未使用状态。
建议：强制使用硬件保护的私钥并启用时间戳（1.3.6.1.4.1.59719.5.210），使证书过期后签名仍然有效。
关联节点：1.3.6.1.4.1.59719.5.200、1.3.6.1.4.1.59719.5.1.210、1.3.6.1.4.1.59719.6.1.7。
核验：2026-10-22 —— 本弧及其全部下级标识均确认未使用，本文件每次修订时须重新核验该未使用状态。

Registration Authority

tsingyao
E-Mail: op@tsingyao.net
JunQing Gu
TsingYao Technology Limited

The RA does not want to publish their personal information.

Subordinate objects

ID	Base36	ASN.1 IDs (comma sep.)	IRI IDs (comma sep.)	RA	Comment	Created	Updated
No items available

Alternative Identifiers

Identifier	Description
aid:D276000186B200054278A5EC632F363E (No PIX allowed)	OIDplus Information Object Application Identifier (ISO/IEC 7816)
guid:4278a5ec-0000-8000-a6d3-1d98ed3d8321	OIDplus Information Object Custom UUID (RFC 9562)
guid:4934ed56-041e-304c-a97e-40a0d643968c	Name based version 3 / MD5 UUID with namespace UUID_NAMEBASED_NS_OID
guid:0c28c2f7-1307-51cc-b98d-70db2f060ba6	Name based version 5 / SHA1 UUID with namespace UUID_NAMEBASED_NS_OID
mac:B2-D9-E3-2F-36-3E	OIDplus Information Object MAC address, Unicast (AAI)
mac:B3-D9-E3-2F-36-3E	OIDplus Information Object MAC address, Multicast (AAI)
weid:P-1A2V-5-1-5K-4	WEID notation
x500dn:/dc=com/dc=example/cn=oidplus/1.3.6.1.4.1.37476.2.5.2.9.4.1=1115203052/1.3.6.1.4.1.37476.2.5.2.9.4.2=1664038462	OIDplus Information Object X.500 DN