RFC3647 describes the difference between a CPS and a CP as follows:
The main differences between CPs and CPSs can therefore be summarized as follows:
- A PKI uses a CP to establish requirements that state what participants within it must do. A single CA or organization can use a CPS to disclose how it meets the requirements of a CP or how it implements its practices and controls.
- A CP facilitates interoperation through cross-certification, unilateral certification, or other means. Therefore, it is intended to cover multiple CAs. By contrast, a CPS is a statement of a single CA or organization. Its purpose is not to facilitate interoperation (since doing so is the function of a CP).
- A CPS is generally more detailed than a CP and specifies how the CA meets the requirements specified in the one or more CPs under which it issues certificates.
There's one sentence that makes sense to me in the above explanation:
A single CA or organization can use a CPS to disclose how it meets the requirements of a CP
If I understand that correctly, the CP sets the general requirements (e.g. you should validate domain ownership before issuing a certificate), and the CPS mentions how it does that in practice (e.g. by checking the DNS records for a token). The CP might have even given that practice as an example already.
So, as a CP and a CPS are mostly written by the same CA, it makes little sense to me to split these up. If I mention in the CP that the ownership must be validated and that this could be done by checking the DNS records for a token, then the CPS will most likely contain exactly the same information. I might be able to understand the use of having both a CPS and a CP in case a CA has separate roots which each might have a different CPS, based on the same CP.
- Can someone explain what the real value of having both a CPS and a CP is, when they are written by the same CA, and whether or not it would be good practice to only write a CPS in that case?
- Shouldn't there be a global standard CP, which can be used by all CAs to base their CPS on?