A Certificate Policy (CP) is a set of rules that defines what a digital certificate is intended for, who may receive it, and the conditions under which it is considered trustworthy. In a public key infrastructure (PKI), it helps relying parties understand the assurances behind a certificate, such as how identity was checked and what uses are permitted.
Certificate authorities use CPs to guide certificate issuance and lifecycle management. If certificates are issued outside the applicable policy or profile, they may need to be revoked and replaced, potentially causing browser warnings or service interruptions. Security teams should track certificates, confirm that issuance practices match the governing policy, and maintain a tested process for renewal and revocation. A CP is related to, but distinct from, a Certification Practice Statement, which describes how an issuer implements its policies.