TR-GRID CA Self-Auditing Results and Status Update EUGridPMA Meeting September 12-14, 2011 Marrakesh Feyza Eryol, Onur Temizsoylu TUBITAK-ULAKBIM )

General information Current status of CA (updates & statististics) Self-auditing results What has been done so far after auditing? Conclusion Overview 2 September EUGridPMA Marrakesh Meeting

TR-Grid CA is a traditional X.509 PKI CA with an offline issuing CA configuration. It was accredited at 5th EUGridPMA Meeting in Poznan, in September It provides x509 certificates for academic research and educational activities in Turkey: So far only used by TRUBA users and hosts in grid activities. From TR-GRID(Turkish National Grid Infrastructure) to TRUBA(Turkish Sience e-Infrastructure) It is located in Ankara and managed by TUBITAK- ULAKBIM.Introduction 3September EUGridPMA Marrakesh Meeting

TR-Grid CA self-audit was presented in Amsterdam, in January 2008 CP/CPS had been re-written in RFC 3647 All necessary corrections/clarifications had been done in CP/CPS Openssl configuration updated/corrected The online CA repository updatedUpdates 4September EUGridPMA Marrakesh Meeting

●TR-Grid CA root certificate was re-generated in September ●With the same key, the new validation dates and new extensions ●The following reference documents were used: ●IGTF-AP-Classic v4.2 ●Grid Certificate Profile (GFD.125) ●CP/CPS updated. ●Openssl configuration updated to guarantee that all certificates and CRLs issued with the accurate profile. ●The information on TACAR was updated. Updates - 2 5September EUGridPMA Marrakesh Meeting

CA: So far around 990 certificates issued. So far around 200 certificates revoked. Currently, about 200 valid user certificates available. Currently, about 30 valid host certificates available. RA: Currently there are 4 RA centers: 1 main + 3 regional Ankara (main), Kayseri, Adana, Denizli. Identity validation is performed by video conference where geographical location of the subject is remote. Statistics 6September EUGridPMA Marrakesh Meeting

●Guidelines for auditing Grid CAs version 1.1 (October 28, 2010) is used. ●Reference documents: ●IGTF-AP-Classic v4.3 ●Grid Certification Profile (GFD.125) ●Private Key Protection Guideline v1.1 (September 21, 2010) General Auditing Impression: ●There are some issues which should be in different sections in CP/CPS. ●Certificates and CRLs are issued properly as stated in references. ●The archives of the all records are not well organised, they need to be in an auditable form. Self Auditing 7September EUGridPMA Marrakesh Meeting

52 items with score A (good) 10 items with score B (minor change) 1 items with score C (major change) 0 items with score D 3 item with N/A Self Auditing Results 8September EUGridPMA Marrakesh Meeting

Records Archival (12) – The CA is responsible for maintaining an archive of these records in an auditable form Documentation is OK but it is not well organised in practical. All records are stored in different areas –Especially s Action: All records will be organised in an auditable form at the end of this year. C – major change 9September EUGridPMA Marrakesh Meeting

3.1.2 CA System(7) –The CA system is a dedicated machine, but this is placed in section in CP/CPS. Action: It has been added to section too CRL(29,30) –The CA issue a new CRL at least 7 days before expiration, but this is placed in section 2.3 in CP/CPS. –The new CRL issued immediately after a revocation, but it is placed in section 2.3 in CP/CPS. Action: It has been added to section too. B – minor change 10September EUGridPMA Marrakesh Meeting

3.1.6 CRL(32) –The CRLs are compliant with RFC 3280 which was the obsoleted version of the Action: The CRL structure and extensions are checked. They are compliant with RFC It has been corrected in CP/CPS document End Entity Certificates and Keys(40,42) –Certificates are re-keyed and this is placed in web page of the CA, but it is not placed in an user manual. –Certificates must not be re-keyed consecutively for 5 years without identity verification is applied in practice, but does not exist in a user manual. Action: It will be added to the wiki page as an user manual. B – minor change 11September EUGridPMA Marrakesh Meeting

Compromise and Disaster Recovery(55) –The CA must have compromise and disaster recovery procedure. The compromise procedure is placed in section 5.7.1, but disaster recovery is not. Action: The disaster recovery procedures are added to the CP/CPS document RA Entity Identification (1,4) –The role of RA are described in different sections. –The RA should ensure that the requestor is appropriately authorized by the owner of the associated FQDN. Action: They have been added to the section B – minor change 12September EUGridPMA Marrakesh Meeting

RA Entity Identification (6) –CA or RA have documented evidence on retaining the same identity over time. This has been done in practical, but does not exist in section Action: It has been added to the section B – minor change 13September EUGridPMA Marrakesh Meeting

●All corrections/clarifications have been done in CP/CPS. ●The wiki page is designed to be updated for local users as an user manual ●We have started to collect logs to organise. First actions done after auditing.. 14September EUGridPMA Marrakesh Meeting

Auditing document is really useful and comprehensive enough for its purpose Auditing was a good chance to address the recommendations of Grid Certificate Profile. Each self-audit is an experience chance to corrected the CP/CPS document and certificate profiles. chance to follow the improvements Conclusion 15September EUGridPMA Marrakesh Meeting