A Certification Practice Statement (CPS) is a document explaining how a certificate authority (CA) manages its operations and issues, validates, renews, and revokes digital certificates. It describes the procedures and controls the issuer follows, often in relation to its Certificate Policy (CP), which sets the rules for acceptable certificate use.
The CPS matters because browsers and other systems rely on certificates to establish trust in encrypted connections. If an issuer’s actual practices do not match its documented policies or certificate profiles, certificates may need to be revoked and replaced, potentially causing warnings or service interruptions. Security teams and auditors use CPS documents to assess an issuer’s practices; CA operators use them to guide consistent issuance and revocation processes.