Certificate Practice Statement Checker

Review certificate practice statements

About Certificate Practice Statement Checker

A Certificate Practice Statement (CPS) is a document published by a Certificate Authority (CA) that describes their practices for issuing, managing, and revoking certificates. A CPS cannot be checked automatically — it is a legal document, not a server header — so this page tells you exactly what to review manually: where to find your CA's CPS, and which sections matter for WebTrust, ETSI, and CAB Forum Baseline Requirements compliance.

How to Use

1Enter the domain name whose certificate CPS you want to review.
2Click Run to fetch the certificate and extract its CPS information.
3Review the CPS details including CA policy, assurance level, and compliance indicators.

Use Cases

•Verify CA compliance with industry standards before purchasing certificates
•Audit your existing certificates for CPS policy adherence and assurance levels
•Compare CPS policies across different Certificate Authorities

Frequently Asked Questions

A CPS is a formal statement published by a Certificate Authority detailing the practices they employ when issuing, managing, and revoking certificates. It covers security controls, validation procedures, and compliance with industry standards.

CPS compliance ensures the CA follows industry best practices and standards like WebTrust and ETSI. Non-compliance can result in browsers distrusting certificates issued by that CA, affecting your website visitors.

The checker analyzes the certificate's issuer information and CP/CPS extension to identify the CA and retrieve their published practice statement. It then evaluates key compliance indicators against industry standards.

Because the input is prose with legal force, not protocol bytes. A CPS describes procedures, responsibilities and audit regimes in sentences; judging whether they satisfy the Baseline Requirements needs reading comprehension and context no handshake can provide. Automation that claimed to grade documents it never parsed would be inventing results, so this page documents the review instead of faking it.

The Certificate Policy states what the CA does — the rules — while the Practice Statement states how it does it — the procedures. Public CAs typically publish both, often as a combined document, and auditors read them together against the Baseline Requirements and the relevant WebTrust or ETSI criteria. When someone asks for the CPS, either document family satisfies the spirit of the request.

Domain validation methods, because weak validation undermines everything downstream; identity vetting for OV and EV certificates; revocation commitments including CRL and OCSP availability; certificate lifetimes against current maximums; and the audit section naming the qualified assessor and the audit period. Skim the rest, read those five closely, and note version dates — an outdated CPS describing retired practices is itself a finding.

Check the audit letters the CA publishes, usually alongside the CPS, and confirm they cover the current period under WebTrust for CAs or the ETSI equivalent. The major root programs also maintain public lists of audited CAs with the audit dates. A CA missing from those lists, or with expired audit statements, should not be issuing certificates your business relies on.

Indirectly but really. The CPS documents the lifetimes you must renew within, the revocation channels your clients will consult, and the validation methods available when you reorder or add names. Operational surprises — a 90-day lifetime where you assumed a year, or DNS-only validation where you planned email — almost always trace back to a CPS section nobody read before deploying.

What This Page Gives You

A Certificate Practice Statement is a legal document, not a server header, so no automated check can retrieve and grade it. This page is upfront about that: instead of inventing a verdict, it tells you where your CA's CPS lives and which sections actually matter for an audit.

1Find the right document. Every public CA publishes its CPS — usually linked from its repository alongside the Certificate Policy — and the review starts by confirming you are reading the current version for the issuing CA named in your certificate.
2Check validation practice first: how the CA verifies domain control, and for organisation and extended validation, how it vets identity. Baseline Requirements set minimums here, and anything weaker in the document is the finding.
3Then revocation, lifetimes and audit: the CRL and OCSP commitments, maximum certificate lifetimes, and the WebTrust or ETSI audit statements. A CPS without current third-party audits behind it is paper without backing.

For the machine-checkable side of CA compliance — what the server actually serves — the checker, chain and revocation pages on this site cover what automation can honestly cover.

Tips & Best Practices

•Review CA Certification Practice Statements before certificate purchase
•Understand CA liability and warranty terms from CPS documents
•Compare CPS documents across CAs for informed selection
•Keep CPS documentation for compliance audit evidence

Technical Details

Document: Certification Practice Statement (CPS) analysis
Content: CA practices, validation procedures, liability terms
Source: CA-published CPS documents
Output: CPS summary with key findings