Policy Mail - S/MIME 邮件证书策略 —— 邮件终端用户证书的签发、主体核验、私钥保护与使用限制

Zurückkehren Übergeordnet: Cert Policy - 证书策略（CP）子树 —— 规定所签发证书的适用范围、安全要求与签发/续期/吊销/审计约束 (1.3.6.1.4.1.59719.5.1)

Technische Informationen

Punkt-Notation:	`1.3.6.1.4.1.59719.5.1.220`
ASN.1-Notation:	`{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) tsingyao(59719) pki-certificate-system(5) cert-policy(1) policy-mail(220) }`
OID-IRI-Notation:	`/ISO/Identified-Organization/6/1/4/1/TsingYao/PKICertificateSystem/CertPolicy/PolicyMail`
WEID-Notation:	`weid:P-1A2V-5-1-64-8`
DER-Kodierung:	`06:0C:2B:06:01:04:01:83:D2:47:05:01:81:5C`

Beschreibung

English:
Mail certificate policy for Secure/Multipurpose Internet Mail Extensions (S/MIME) end-user certificates. It defines the certificate issuance rules, subject identity verification requirements, private key protection requirements, certificate usage scope, revocation mechanism based on Certificate Revocation List (CRL) and Online Certificate Status Protocol (OCSP), and subscriber obligations.
Usage rule: certificates issued under this policy shall be used for email digital signature and email encryption only, and shall not be used for server authentication, code signing or other non-email purposes.
Status: registered but unused. No S/MIME certificate has been issued under this policy; when activated, bind the certificate to a verified mailbox address and require revalidation when the mailbox changes. The unused state shall be re-verified at each revision of this file.
Recommendation: enforce the usage restriction with the extended key usage extension and document it in the CPS, since mail clients may accept a certificate for unintended purposes when the EKU is absent.
See also: 1.3.6.1.4.1.59719.5.220, 1.3.6.1.4.1.59719.5.3, 1.3.6.1.4.1.59719.5.1.800.
Verification: 2026-10-22 — this arc and all its sub-ordinates are confirmed unused; re-verify the unused state at each revision of this file.

中文:
适用于安全多用途互联网邮件扩展（Secure/Multipurpose Internet Mail Extensions，S/MIME）邮件终端用户证书的证书策略。规定证书签发规则、主体身份核验要求、私钥保护要求、证书使用范围、基于证书吊销列表（Certificate Revocation List，CRL）及在线证书状态协议（Online Certificate Status Protocol，OCSP）的吊销机制，以及证书订阅方责任。
使用规则：依据本策略签发的证书仅可用于邮件数字签名与邮件加密，不得用于服务器认证、代码签名或其他非邮件场景。
状态：已注册但未使用。尚未按本策略签发任何 S/MIME 证书；启用时应将证书与已验证邮箱地址绑定，邮箱变更时需重新核验。本文件每次修订时须重新核验该未使用状态。
建议：通过扩展密钥用法扩展强制执行使用限制，并在 CPS 中记载；因为缺少 EKU 时邮件客户端可能将证书用于非预期用途。
关联节点：1.3.6.1.4.1.59719.5.220、1.3.6.1.4.1.59719.5.3、1.3.6.1.4.1.59719.5.1.800。
核验：2026-10-22 —— 本弧及其全部下级标识均确认未使用，本文件每次修订时须重新核验该未使用状态。

Registrierungsstelle

tsingyao
E-Mail: op@tsingyao.net
JunQing Gu
TsingYao Technology Limited

Die Registrierungsstelle möchte ihre persönlichen Informationen nicht veröffentlichen.

Untergeordnete Objekte

ID	Base36	ASN.1 IDs (kommagetrennt)	IRI IDs (Kommagetrennt)	RA	Kommentar	Erstellt	Geändert
Keine Einträge vorhanden

Alternative Bezeichner

Bezeichner	Beschreibung
aid:D276000186B200054278A5EC32AC5195 (Keine PIX erlaubt)	OIDplus Information Object Anwendungsbezeichner (ISO/IEC 7816)
guid:4278a5ec-0000-8000-a6d3-f2a52b4a2059	OIDplus Information Object Custom UUID (RFC 9562)
guid:b2fbcf78-7ddb-3bde-bc77-0671b1cf018b	Namensbasierte Version 3 / MD5 UUID mit Namensraum UUID_NAMEBASED_NS_OID
guid:dbd2b99f-049d-59e2-a14e-d86bfd3c6d30	Namensbasierte Version 5 / SHA1 UUID mit Namensraum UUID_NAMEBASED_NS_OID
mac:A2-E1-B2-AC-51-95	OIDplus Information Objekt Unicast MAC-Adresse (AAI)
mac:A3-E1-B2-AC-51-95	OIDplus Information Objekt Multicast MAC-Adresse (AAI)
weid:P-1A2V-5-1-64-8	WEID-Notation
x500dn:/dc=com/dc=example/cn=oidplus/1.3.6.1.4.1.37476.2.5.2.9.4.1=1115203052/1.3.6.1.4.1.37476.2.5.2.9.4.2=850153877	OIDplus Information Object X.500 DN