X.500 Object Identifiers allocated by OpenFortress

The position of OpenFortress in the OID tree is

1.3.6.1.4.1.10471

The following OID points to a Certificate Practice Statement:

1.3.6.1.4.1.10471.1

The URL of the certificate practice statement contains a filename comprising of a SHA1 checksum in hexadecimal notation followed by .pdf. After downloading this document, please validate its integrity by calculating its SHA1 hash with your favourite crypto toolkit and making sure it matches.

Please note that inclusion by reference is only possible for older documents, because the SHA1 checksum in the reference cannot be known in before finishing a document.

To validate the origin of the document is OpenFortress, it is possible to attache .asc to the URL, and obtain the according PGP detached signature, signed by OpenFortress. Note that this signature is redundant if this OID occurs in a certificate signed by OpenFortress.

Specific CPS's fall under this number, with one number to add the document, and another to add the version (starting at 1). For instance, the root key management description adds .1 -- to describe its first public version, add .1.1 instead.

Example values for this OID field are

http://openfortress.nl/doc/064e0ef64f402e7da2c5fe264355d72bc0dea7ac.pdf

The following OID defines an upper limit for liability:

1.3.6.1.4.1.10471.2

Liability is a difficult matter for any Certification Authority. If set too low, it will lower the trust in a signed-for party; if set too high, it may call for abuse. Where liability is set below minimum demands of a country, it should be replaced by the minimum of the local standard. However, note that OpenFortress resides under Dutch law.

This OID is only valid when cryptographically tied to a period of validity. X.509 certificates define such a period by way of their initiation and expiry date. The liability set by this OID is only valid during the period of validity; outside that period, the liability is always zero, zilch, nothing, nada.

OpenFortress often delegates liability to its reseller network, and notes their guaranteed liability in the certificates when this is requested by the reseller. In this case, the value will be denominated in the currency guaranteed by the reseller, and a remark will be added: guaranteed by followed by the reseller.

An example value for this OID field is:

Good for financial transactions up to a value of 0 grams of gold

The following OID is used to distinguish objects with the same cn attribute:

1.3.6.1.4.1.10471.3

Sometimes the same CommonName (or for short, cn) attribute value must be used in multiple objects, because a single owner requests multiple objects. If this can occur, a distinguishing minor number is added to the distinguishedName (or for short, dn) of the object.

Depending on the kind of object, it may be required that fields for this OID are ignored, to obtain a notion of equivalence that intentionally spans multiple certificates.

Example values for a dn field using this OID are:

cn=Anonymous user 12345/distinguishingMinorNumber=678
cn=Anonymous user 12345/distinguishingMinorNumber=690