CERTIFICATION PRACTICE STATEMENT (CPS)

Date Published: 23-Oct-2026          Last Updated: 24-Oct-2026

Framework Authority: Cybrent Technology Solutions (OPC) Pvt. Ltd.

Governing OID Arc: IANA PEN 64963

Architecture Version: DELOL v3.0 (Hybrid Stitched / Factorial Entropy Seal)

1. INTRODUCTION AND OVERVIEW

1.1 Overview

This Certification Practice Statement (CPS) defines the operational, administrative, and technical governance framework for the DELOL Sovereign Digital Signature Private CA Infrastructure. Unlike publicly trusted commercial CAs governed by public web-trust frameworks, this infrastructure is a closed-loop, air-gapped, sovereign enterprise trust model designed strictly for internal document attestation, closed-circle code signing, and digital asset ownership-certification.

1.2 Identification

• Infrastructure Name: DELOL Sovereign Digital Signature Private CA Infrastructure
• Assigned IANA Private Enterprise Number (PEN): 64963
• Governing Policy OID: 1.3.6.1.4.1.64963.10.2
• Published Policy / Infrastructure Reference: https://www.delolshield.com/delol-sovereign-digital-signature-private-ca-infrastructure/

2. PUBLICATION AND REPOSITORY RESPONSIBILITIES

2.1 Repositories

The DELOL Private CA hierarchy operates on an offline, air-gapped architecture. Public-facing components (such as Root Certificates, Issuer Certificates, and CRL distribution endpoints) are published exclusively via authorized organizational distribution channels:

• Primary Infrastructure Repository: https://www.delolshield.com
• AIA / CDP Distribution URI:
  1. Root Certificate: http://certs.cybrent.biz/DELOL-SOVEREIGN-ROOT-CA.crt
  2. Intermediate Issuer Certificate: http://certs.cybrent.biz/DELOL-SOVEREIGN-ISSUER-CA.crt

3. IDENTIFICATION AND AUTHENTICATION (I&A)

3.1 Initial Identity Validation

• Root CA Level: Managed exclusively by the highest-level organizational authority of Cybrent Technology Solutions. Keys are generated via independent CLI utilities and stored in secure, offline environments.
• Intermediate CA Level: Delegated to designated Department Heads or administrative authorities. Each department head is directly accountable for safeguarding their department-specific Intermediate CA private keys (.key) and entropy seeds (.pvt).
• End-Entity Level: Individual certificates are issued to employees or systems under the direct supervision of department authorities for internal asset verification.

4. OPERATIONAL REQUIREMENTS & CERTIFICATE LIFECYCLE

4.1 Certificate Profile & Mandatory Extensions

All certificates issued within this hierarchy strictly conform to RFC 5280 and incorporate proprietary DELOL Sovereign Extensions under IANA PEN 64963:

• Entropy Seal (1.3.6.1.4.1.64963.1.1): A 256-byte dynamic cryptographic entropy seal derived from parent seeds, embedded as an ASN.1 OCTET STRING to bind certificates against cloning or forgery.
• Purpose Code (1.3.6.1.4.1.64963.1.2): Defines the structural operational intent (e.g., DELOL Sovereign Intermediate Anchor).
• Sovereign Attestation Node (1.3.6.1.4.1.64963.2.1): Attests vendor suite and organizational binding.

4.2 Offline Operational Security Model

To completely eliminate exposure to network sniffers, trojans, and botnets:

• No Cloud Generation: Certificates are never generated via online web portals or shared network daemons.
• Disconnected CLI Binaries: Generation is handled by three isolated, independent offline CLI binaries (Root Generator, Intermediate Generator, and End-Entity Generator) that do not share common DLLs or execution states.
• Deep-Tissue Verification: Issued certificates are validated locally using the proprietary DELOL Sovereign Certificate Verifier, which performs forensic DNA and factorial entropy matching to guarantee authenticity.

5. COMPLIANCE & GOVERNANCE

5.1 Scope of Trust

The DELOL Sovereign CA infrastructure is not a replacement for publicly trusted commercial CAs (e.g., for public web browsing or regulatory government tax filings). It is an exclusive corporate trust anchor designed to:

• Deter internal document forgery and malpractice.
• Enable secure, closed-circle code and executable signing.
• Lock approved corporate versions (proposals, SOWs, notices) against tampering without incurring the overhead of public commercial DSCs.

Contact us for queries

For any queries regarding this policy, platform, website or privacy concerns feel free to contact us.