VA - Secure Socket layer (SSL) Certificates - MRAS

On behalf of the Department of Veterans Affairs (VA), the U.S. General Services Administration (GSA) is conducting market research to assess capabilities related to providing external digital certificates. These certificates are essential for maintaining secure access to various VA infrastructure operations, including Active Directory, telehealth services, and on-premises rights management systems. The overarching goal of this initiative is to ensure that the VA's digital communications and data exchanges remain secure and compliant with industry standards.

The work being requested involves supplying Secure Socket Layer (SSL) certificates over a specified period. The VA's Office of Information and Technology has outlined a requirement for SSL certificates issued within a 364-day period, with an initial 12-month base period followed by four optional 12-month periods. The scope includes both Standard SSL Certificates for Organization Validation (OV) and Extended Validation (EV), each requiring annual renewal at specific times throughout the year. These certificates must meet stringent security standards, including X.509 format compliance, 256-bit encryption, and compatibility with over 90% of browsers and systems.

In addition to basic requirements, the SSL certificates must support advanced cryptographic algorithms such as RSA public-key Secure Hash Algorithm (SHA)-2 and Elliptic Curve Cryptography (ECC). Other critical features include unlimited server licensing, free reissues during their lifetime, managed Public Key Infrastructure for Standard SSL Subject Alternative Name Certificates, and comprehensive support options akin to Platinum Support. The ability to manage these certificates through a central console is also necessary, along with functionalities like modifying SANs and setting custom expiration dates.

Optional tasks may involve procuring additional SSL certificates as needed during any performance period up to specified maximum quantities. This flexibility ensures that the VA can scale its security measures in response to evolving needs without compromising on quality or compliance standards.