Best practices for deploying PCA for cryptographic assessment

What is a cryptographic assessment

The Cryptographic Application Compliance Assessment, also known as a cryptographic assessment, is a key initiative from the State Cryptography Administration of China to ensure information system security. It is widely applied in critical sectors such as government, finance, energy, healthcare, and transportation. By adhering to the standards published by the administration, system operators can ensure the compliant use of cryptographic technologies, thereby enhancing overall security and meeting legal and regulatory requirements.

The necessity of cryptographic assessments

According to laws, regulations, and national standards such as the "Cryptography Law of the People's Republic of China", "Regulations on the Administration of Commercial Cryptography", "Administrative Measures for the Security Assessment of Commercial Cryptography Applications", "GB/T 39786-2021 Basic Requirements for the Application of Cryptography in Information Systems", and "Administrative Measures for the Construction of National Government Informatization Projects", critical information infrastructure and Multi-Level Protection Scheme (MLPS) Level 3 or higher systems must be protected with commercial cryptography. These systems must pass a cryptographic assessment before they can be put into operation and must be reassessed at least annually.

Purchase a Compliance CA

1. Log in to the Certificate Management Service console.

2. In the navigation pane on the left, choose Certificate Management > Private Certificate Management. On the Private Certificate Management page, select the region where the PCA service is located.

3. On the Compliant CA tab, click Purchase Private Root CA.

4. On the Purchase pane, complete the purchase configuration.

   Configuration item	Description
   Product module	By default, PCA Service is selected. This creates a CA service for your enterprise to maintain and manage certificates.
   PCA purpose	By default, Enterprise Compliance Use (Regulatory Requirements) is selected. This option is for scenarios that require cryptographic application security assessments or compliance with electronic certification service standards, such as direct bank-enterprise connections and electronic signatures.
   Product specification	By default, Create subordinate CA is selected.
   Certificate algorithm	Select SM (Chinese National Standard).
   Subscription duration	Select the subscription duration.

5. Read the Terms of Service. Then, click Buy Now and complete the payment.

6. After the purchase is complete, the created Compliance CA is listed on the Private Certificate Management > Compliant CA page. The Status of the compliance root CA is Disabled by default.

Enable a compliance CA

1. On the Compliance CA tab, find the target compliance root CA and click Enable in the Actions column.

2. In the Compliance CA pane, configure the information for the compliance root CA and click Confirm and Enable.

   • Registered Enterprise Name: The registered name of the company for this CA. Chinese and English names are supported.

   • Unified Social Credit Code: The 18-digit Unified Social Credit Code of the company for this CA. If the company has not yet applied for the Three-in-One Certificate, enter the business license registration number.

   • Department Name: The name of the company department for this CA. For example: IT Department.

   • Landline: The landline phone number of the company for this CA.

   • Administrator Email: The email address of the company administrator.

   • Administrator Name: The name of the company administrator.

   • Administrator Mobile Number: The mobile phone number of the company administrator.

   • Administrator ID Number: The ID card number of the company administrator.

   • Application Form: Upload the application form for the compliance root CA. The steps are as follows:

     1. Click Download Template to download the application form.

     2. Print the application form.

     3. Fill out the printed application form. After you confirm that the information is correct, affix the official company seal in the designated area on the form.

     4. Scan or take a photo of the completed and sealed application form, and save it as a JPG, GIF, or PNG file.

        Ensure the scanned image or photo is clear and legible.

     5. Click Upload File to upload the scanned application form.

   • Business License: Click Upload File to upload an image of the company's business license.

     The business license image must be a color scan or photo in JPG, GIF, or PNG format. Ensure the image is clear and legible. If you use a photocopy of the business license, you must affix the official company seal to the copy before you scan or photograph it for upload.

Obtain a USBKey through One-to-one Expert Service

1. In the navigation pane on the left, click One-to-one Expert Service.

2. On the One-to-one Expert Service page, select Customer Self-handling with Expert Assistance (DingTalk) and a Contact. Then, click Contact Technical Support for Cloud Security Services to start the one-on-one service process.

   • Select Service: Select Customer Self-handling with Expert Assistance (DingTalk).

   • Contact: From the list of existing contacts, select a contact to connect with the expert service.

3. After the expert service process starts, contact the technical staff as soon as possible to have the USBKey mailed to you.

Install the USBKey control (for users)

1. Install the USBKey driver.

   Click to download the USBKey driver and follow the on-screen instructions to complete the default installation.

2. Install the USBKey control.

   Click to download the USBKey control and follow the on-screen instructions to complete the default installation.

For more information about how to install and use the USBKey control, see USBKey Control User Guide.

Manage the USBKey as an administrator (for administrators)

1. Click to download the USBKey Control Management Tool and unzip the file.

2. Select USBKey Control Management Tool.exe and follow the on-screen instructions to complete the default installation.

If you need to use management functions such as Initialize, Modify SO PIN, and Unlock, see USBKey Control Management Tool Administrator Guide.

Apply for a certificate

1. Log in to the Certificate Management Service console.

2. In the navigation pane on the left, choose Certificate Management > Private Certificate Management. On the Private Certificate Management page, select the region where the PCA service is located.

3. On the Compliant CA tab, find the target subordinate CA. In the Actions column, click Apply for Certificate.

4. In the Apply for Certificate panel, enter the certificate information and click Confirm.

   • Personal Name: Enter the subject name for the compliance certificate.

   • Key Container: Select USBKey.

   • System Account:

     • If you use the certificate to log on to the Alibaba Cloud console, enter your Alibaba Cloud UID. For more information about how to view your Alibaba Cloud account ID, see Modify basic account information.

     • If you use the certificate to log on to an enterprise business system, enter the system logon account.

5. In the password dialog box that appears, enter the initial password for the USBKey, click Log On, and wait for the certificate to be created.

Install the certificate

1. In the Compliant CA list, find the record of the created root CA and click Certificates to go to the certificate list.

2. Find the certificate that you applied for and click Install Certificate.

3. The Install Certificate panel automatically detects the current installation environment. After you confirm the environment is correct, click Install and wait for the certificate to be installed.

4. After the certificate is installed, you can open the USBKey control management tool and click the Certificate tab to view information about the created container and certificate.