Mobile Code Obligations

Mobile Code CertIn order to request a Mobile Code Certificate, you must agree to the following obligations.
  • Accurately represent yourself in all communications with ORC and the PKI and abide by all the terms, conditions and restrictions levied upon the use of the issued private key(s) and certificate(s), as stipulated in the US Government ECA CP and the ORC CPS.
  • To protect the certificate private key from unauthorized access in accordance with the Private Key Protection section of the ECA CPS.
  • Request that the Code Signing Attribute Authority CSAA approve and forward to the RA an authorization on the code signer’s behalf to obtain a code signing certificate.
  • To apply for (generate a key pair) and download the code signing certificate onto a FIPS 140-1, Level 2 validated smart card.
  • When not in use, the Code Signer hardware token shall be stored in a locked container.
  • Submit the certificate request to the ECA via a secure (SSL protected) web session.
  • Digitally sign an e-mail, using acceptable PKI credentials, that contains the subject Distinguished Name (DN), code signer DN, and the code signing certificate request number and send it to the RA.
  • In the event of Code Signer change (due to the verified individual having left the employ of the subscribing organization or is no longer assigned as the code signer for the certificate) the applicant organization must designate and notify the ORC ECA of the new Code Signer.
  • That the Code Signer is a current employee of the applicant organization and is authorized to obtain a code signing certificate(s) for the applicant organization.
  • To use the certificate only for authorized applications which have met the requirements of the US Government ECA CP and this CPS.
  • To use the certificate only for the purpose for which it was issued, as indicated in the key usage extension.
  • To report any changes to information contained in the certificate to the appropriate CSAA and/or RA.
  • Subscribers signify and guarantee that their application does not interfere with or infringe upon the rights of any others regarding their trademarks, trade names or any other intellectual property.
    Subscribers shall hold ORC harmless for any losses resulting from any such act.
  • As a result of issuing a certificate that identifies a person as an employee or member of an organization, ORC does not represent that the individual has authority to act for that organization.
  • For Relying Parties: Use of REVOKED certificates could have damaging or catastrophic consequences in certain applications. The matter of how often new Revocation data should be obtained is a determination to be made by the relying party and the system accreditor.
    If it is temporarily infeasible to obtain Revocation information, then the relying party must either reject use of the certificate, or make an informed decision to accept the risk, responsibility, and consequences for using a certificate whose authenticity cannot be guaranteed to the standards of the ORC ECA practice statement.
A Code Signer Certificate Subscriber and their applicant organization found to have acted in a manner inconsistent with these obligations is subject to revocation of CSAA responsibilities and/ or revocation of all Code Signing Certificates issued to that applicant organization.
  • Step 1. Read the Mobile Code Certificate Obligations.
I understand that during this process I will be generating my key pair and will possess the only copy of my private key on the workstation/computer (or hardware token) from which I am making my request. If lost, damaged, or compromised, I will be responsible for requesting and incurring the costs of a new certificate.
I have read and understand all the certificate instructions listed in the Subscriber Instructions document, as well as Trusted the ECA CAs.
I have read and agree to all of the Subscriber Obligations listed above.
To Order a Cryptographic Token and/or schedule a time to meet with an RA, please contact ORC at 1-800-816-5548 7:30 AM to 7:30 PM Eastern Standard Time or e-mail
ORC Office Locations for token purchase and hardware cert requests (please call for appointment first) – Fairfax, VA located at 11250 Waples Mill Rd, Suite 210, South Tower