Baltic Grid Certification Authority 15th EUGridPMA, January 28th 2009, Nicosia1 Self-audit Hardi Teder EENet

Overview Baltic Grid CA Statistics Self-audit  Minor  Medium  Major Conclusions

15th EUGridPMA, January 28th 2009, Nicosia Baltic Grid CA Baltic Grid CA gives certificates to end entities which are located in Estonia, Latvia or Lithuania and have interest in grid computing. Accredited: November 2005 Location: EENet, Tartu, Estonia Opetated by:  Hardi Teder  Tõnu Raitviir  Lauri Anton (not any more)

15th EUGridPMA, January 28th 2009, Nicosia Statistics 1013 issued certificates  699 user, 297 host, 17 service  75 revoked  445 LT, 292 LV, 275 EE 313 valid  209 user, 103 host, 1 service 20 RAs  10 LT  4 LV  6 EE

15th EUGridPMA, January 28th 2009, Nicosia Scores Based on Auditing Guidelines for Grid CAs:  A. Good  B. Recommendation (minor change)  C. Recommendation (major change)  D. Advice (must change)  X. Could not evaluate (N/A)

15th EUGridPMA, January 28th 2009, Nicosia B. Recommendation (minor change) The CP/CPS should be structured as defined in RFC3647  It is RFC 2527 CA certificate lifetime must be no longer then 20 years  The root certificate lifetime is not mentioned in CP/CPS End entity must request revocation of its certificate as soon as possible, but within one working day after detection of he/she lost or compromised the private key pertaining to the certificate or the data in the certificate are no longer valid  Need updates in CP/CPS and user guides

15th EUGridPMA, January 28th 2009, Nicosia B. Recommendation (minor change) Certificates may be renewed or re-keyed for more than 5 years without a form of identity and eligibility verification, and this procedure must be described in the CP/CPS.  CP/CPS updates needed

15th EUGridPMA, January 28th 2009, Nicosia C. Recommendation (major change) Every CA must issue a new CRL at least 7 days before expiration  Addition notification methods in use Certificate requests must only be rekeyd, not renewed  Have signed same request again  Our CA management software does not allow that any more Every CA must perform operational audits of the CA/RA staff at least once per year.  Not audited all RAs

15th EUGridPMA, January 28th 2009, Nicosia C. Recommendation (major change) The RA must record and archive all requests and confirmations.  Requests archived centrally  updates CP/CPS

15th EUGridPMA, January 28th 2009, Nicosia D. Advice (must change) The pass phrase of the encrypted private key must be kept also on an offline medium, separated from the encrypted private keys and guarded in a safe place where only the authorized personnel of the CA have access.  Had everything in one safe accessible only for the Director of EENet  Already have a separate safe for CA backups CRL profile must be version 2  Right now there are version 1 CRLs issued  Only PEM file is availeble

15th EUGridPMA, January 28th 2009, Nicosia Conclusions CP/CPS needs several updates RA archiving and auditing procedures should be updated Backups Move to CRL v2 Reviewers

15th EUGridPMA, January 28th 2009, Nicosia Thank you Q&A