External and Federal PKI Interoperability

DoD-Approved External PKIs List       |       Interoperability Tools and Documents

In addition to the DoD PKI, the PKIs listed below are approved for use within DoD at the Federal PKI medium hardware equivalent assurance level or higher. Some of the PKIs listed in this section are operated by DoD partners exclusively to serve their own organizations, while others act as Federal Shared Service Providers (SSPs) or commercial Non-Federal Issuers (NFIs). The DoD External Certification Authority (ECA) program provides an alternate method for DoD partners to obtain DoD-approved PKI credentials and is also included.

The DoD External Interoperability Plan (EIP)DoD Instruction 8520.02 Appendix 3B: Mission Partner External PKI Approval Process defines six types of PKIs that can be submitted for DoD approval on unclassified networks:

1. Federal Executive Branch Department and Agency PIV PKIs are operated by individual federal agencies for issuance of PIV PKI credentials to their own personnel.
2. Federal Executive Branch Shared Service Provider (SSP) PIV PKIs contract PKI services under the GSA PKI SSP Program for issuance of PIV credentials to Federal Executive Branch departments and agencies.

   Note: See https://playbooks.idmanagement.gov/fpki/pivcas-and-agencies/ for a listing of type 1 & 2 PKIs used by various federal agencies.

3. Commercial Medium Hardware PKIs are typically operated by large DoD industry partners for issuance of PKI credentials to their employees and contractors; they may also issue PKI credentials to other organizations if permitted by their Memorandum of Agreement (MOA) with DoD.
4. Commercial Personal Identity Verification-Interoperable (PIV-I) PKIs issue PIV-I PKI credentials to entities that may include employees and contractors of their own organization, other commercial organizations, non-executive branch Federal entities (e.g., the United States Senate), State and local governments as permitted by the PIV-I PKI’s MOA with DoD.
5. Combined Communications-Electronics Board (CCEB) Partner PKIs are unclassified PKIs operated by CCEB partner nations to issue credentials to their personnel.
6. Other Mission Partner External PKIs on Unclassified DoD Networks are PKIs serving DoD mission partners that do not align with any of the other listed types (e.g. non-CCEB foreign governments, group or multinational organizations such as the North Atlantic Treaty Organization (NATO)).

The DoD Approved External PKIs Master Document contains the authoritative list of approved partner PKIs (as reflected in the table below), including Certification Authorities (CAs) and assurance levels. The DoD Approved External PKI Certificate Trust Chains zip file contains the corresponding CA certificates. You can find information for a particular PKI by clicking on the PKI’s name in the table.

This table contains DoD PKI interoperability policy, implementation guidance, and PKE tools that can help facilitate various aspects of configuring DoD systems to support DoD-approved external PKI credentials.