26-28 January 2009 – Nicosia, EUGridPMA CALG CP/CPS updates Dana Ludviga LatGrid CA, SigmaNet, IMCS UL

26-28 January 2009 – Nicosia, EUGridPMA Outline Accreditation process; CP/CPS changes (last review); –Minor; –Medium; –Major (discussion topics).

26-28 January 2009 – Nicosia, EUGridPMA Accreditation process

26-28 January 2009 – Nicosia, EUGridPMA When did it all start? Latvian Grid project (August 2006) Discussions started Introduction presentation (2008) CP/CPS review (Hardi and Jens) CP/CPS presentation (2008) CP/CPS review

26-28 January 2009 – Nicosia, EUGridPMA CP/CPS updates after the last review ( )

26-28 January 2009 – Nicosia, EUGridPMA CP/CPS version 6.0 Major : 4 Medium : 8 Minor : 8 Nitpick : 15

26-28 January 2009 – Nicosia, EUGridPMA Minor(1) follows 2527 not 3647; different repository; public certificate; “servicename/" should probably not be interpreted literally. –Common Name MUST include the "servicename/" prefix, followed by the server DNS name (FQDN). –Organisational Unit MUST include the organization domain name.

26-28 January 2009 – Nicosia, EUGridPMA Minor(2) “CALG does not issue certificates to organisations.” -> “The relation between the subscriber and the organization or organizational unit mentioned in the subject name must be proved during the authentication process (face-to-face meeting), see section ”; CA root cert. doesn’t mention issuers domain name; Are service names authenticated by the RA? Can anyone have any service? –Requests MUST be signed by the personal certificate of the corresponding system administrator issued by CALG.

26-28 January 2009 – Nicosia, EUGridPMA Medium(1) Document date; "No stipulation." ; permit server certificates to have CN=fqdn. –Common Name MUST have one of the two following forms - include the "host/" prefix, followed by the server DNS name (FQDN) or plain FQDN without any additional prefixes or postfixes. –Organizational Unit MUST include the organization domain name.

26-28 January 2009 – Nicosia, EUGridPMA Medium(3) services which the CA can sign should be restricted in any way; relies entirely on humans, too error prone?; –CALG verifies the possession of the private key relating to certificate requests at the time of identity verification by RA, who compares the requestor's printed certificate request with the electronically received request "accepting" a request is not the same as "accepting it for revocation". –CALG MUST accept as a revocation request a message digitally signed with a not expired and not previously revoked user certificate issued under this policy.

26-28 January 2009 – Nicosia, EUGridPMA Medium(4) The CA certificate can generate digital signatures.

26-28 January 2009 – Nicosia, EUGridPMA Major(1) Check the possession of the private key. (3.1.7) post office certificate? –certification service provider accredited according to Electronic Document Law of Latvia The CA's DN does not correspond to the CP/CPS. –DC=LV, DC=latgrid, CN=Certification Authority for Latvian Grid

26-28 January 2009 – Nicosia, EUGridPMA Major(2) In certificates the first two components, are encoded as IA5String: –167:d=5 hl=2 l= 10 prim: OBJECT :DomainComponent –179:d=5 hl=2 l= 2 prim: IA5STRING :LV –187:d=5 hl=2 l= 10 prim: OBJECT :DomainComponent –199:d=5 hl=2 l= 7 prim: IA5STRING :latgrid –212:d=5 hl=2 l= 3 prim: OBJECT :OrganizationalUnitName –217:d=5 hl=2 l= 8 prim: PRINTABLESTRING :lumii.lv –231:d=5 hl=2 l= 3 prim: OBJECT :commonName –236:d=5 hl=2 l= 12 prim: PRINTABLESTRING :Edgars Znots

26-28 January 2009 – Nicosia, EUGridPMA RFC 2247 and 3280 ( 4. Attribute Type Definition The DC (short for domainComponent) attribute type is defined as follows: ( NAME 'dc' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX SINGLE-VALUE ) The value of this attribute is a string holding one component of a domain name. The encoding of IA5String for use in LDAP is simply the characters of the string itself. The equality matching rule is case insensitive, as is today's DNS.

26-28 January 2009 – Nicosia, EUGridPMA Thank you! Questions?