DD Form 2842: DoD Public Key Infrastructure (PKI) Certificate of Acceptance and Acknowledgement of Responsibilities

In Section 1, Certificate Information, select Enclave, NIPR or SIPR check box; if the electronic version of this form is used, some blocks may automatically be filled and only the remaining blocks require completion.

In Block a, check the appropriate certificate check box: Group/Role, Server, Code Signing, NPE, or Other (Specify).

In Block b, enter the Certificate Common Name, when applicable.

In Block c, enter the Token Identification (When Applicable) (e.g., visual marking on the smart card, serial number, etc.).

Enter Certificate Email Address (When Applicable), Part 2.

Section 2 is Certificate Accepted By.

In Block a of Certificate Acceptance by Subscriber, enter full name as Last Name, First Name, MI (Typed or printed).

In Block b, enter 7 digit DSN telephone number or 10 digit commercial telephone number (i.e. area code + 7 digit number) and extension if necessary.

In Block c, enter Organization (branch of service, major command, or duty station).

In Block d, enter Subscriber's email address.

Read the Privacy Act Statement, Acknowledgment of Responsibilities, Liability, and Governing Law statements.

Acknowledgement of Responsibilities: I acknowledge receiving the identified set of DOD PKI certificates and private keys and will comply with the applicable CPS/RPS and the following obligations.

I will use the certificates and private keys only for the official purposes for which they are intended, and I will ensure the private keys are protected at all times.

I will comply with the instructions per CPS/RPS for selecting a Personal Identification Number (PIN) or other required method for controlling access to the tokens containing private keys, and I will not disclose same to unauthorized personnel, leave it where it might be observed, nor write it on the token itself.

I will ensure that only authorized personnel can access the password and private keys for all certificates issued pursuant to this acknowledgement.

I understand that if I receive key management (encryption/decryption) key pairs on a token, copies of the private decryption keys have also been provided to the key recovery database for recovery purposes.

I will immediately report any compromise (e.g., loss, suspected or known unauthorized use, misplacement, etc.) of my PIN, token, private keys or certificates to my supervisor, security officer, Certification Authority (CA), Registration Authority (RA), Local Registration Authority (LRA), or Trusted Agent (TA).

I will promptly inform the RA, LRA, or TA when the keys and certificates are no longer needed or required, so they can be revoked.

Liability: I agree that I will have no claim of any nature whatsoever against the United States government, including DOD, arising from or in relation to possession, use, termination, or revocation of the certificates, the key recovery process, or any other aspect of the DOD PKI and its operation. I agree that the United States government, including DOD is not liable to me or to any third party for any injury or loss, including direct or indirect, incidental, consequential, special, or punitive damages, arising out of or relating to any certificate issued by a DOD CA.

Governing Law: This agreement shall be governed by the laws of the United States of America.

You have been authorized to receive one or more DOD PKI certificates bearing the above stated Certificate Common Name for the purpose indicated by the above stated Certificate Type. The certificates and private keys are either issued on a token (e.g., smart card or other hardware token), or the certificates are directly downloaded to the Device or Application that generated the public and private key pairs. All certificates and associated key pairs are government property and may be used only for the official purposes for which they are intended.

In Blocks f (1) and f (2) and Blocks g (1) and g (2), enter in Block f (1) a descriptive name for a federal government-issued identification credential with a picture, for example Military ID card or Passport, and enter a unique identification number from that credential in Block f (2).

If the Registration Official can be biometrically verified, no identity documents are required; enter "Biometrically Verified" in Blocks f(l) and g(l) and "N/A" in f(2) and g(2).

Identification 2 (Needed if Identification 1 is not an official DOD ID with picture): if a federal government issued identification credential with a picture is available, then blocks g(1) and g(2) are not required to be completed. However, if a federal government identification credential with a picture is not available and the Registration Official cannot be biometrically verified, two non-federal government-issued identification cards are required, at least one of which must show the Subscriber's picture (for example, a driver's license). Enter a descriptive name for the first credential in Block g (1) and a unique identification number from that credential in Block g (2).

Block h, DATE SIGNED: the current date will automatically be filled in (YYYYMMMDD).

In Block i, the subscriber must sign in this block, and the signature should match the name provided in Block a.

The Registration Official will indicate in Block i if the Subscriber is incapable of signing (Note: For the electronic version of this form, the Subscriber's signature will be automatically applied.)

If the electronic version of this form is used, some blocks may be automatically filled and only the remaining blocks require completion. The following information of Part 3 will be completed by an Authorized Official per the CPS at the time of the Registration Official's registration. PER CPS/RPS I have personally verified the identity of the person above in accordance with the applicable CPS, and if not digitally signed with a DOD PKI Certificate, I have personally witnessed that person sign this form.

Enter full name as Last Name, First Name, and MI (Typed or printed).

In Block b, enter branch of service, major command, and duty station (Organization).

In Block c, enter 7 digit DSN telephone number or 10 digit commercial telephone number (i.e. area code + 7 digit number).

In Block d, enter current e-mail address.

In Block e, the date will automatically populate to current date (YYYYMMMDD).

In Block f, the Authorized Official must sign in this block, the signature should match the name provided in Block a (Note: For the electronic version of this form, the Registration Official's digital signature will be automatically applied.)