PKGrid CA Self-Audit 2012 Adeel-ur-Rehman Mansoor Sheikh

2 Brief History PK-Grid CA was first presented and accredited during 2 nd EuGridPMA meeting (held in September 2004) at Brussels Minor updates until 2012 –Infrastructure updates machine specs, kernel version, openssl updates –more secure premises Progressively restrictive access privileges among multiple physical tiers

3 Audit Results Audit guidelines used: GFD.125 (dated: March 31, 2008) In policy: – B: 3 – C: 1 – D: 3 – X: 4

4 “B”: 1/3 Is a CRL issued at least 7 days before expiration (for off-line) or 3 days before expiration (for on-line)? (CA item 29) –We missed it a couple of times.

5 “B”: 2/3 The repository must be run at least on a best-effort basis, with an intended availability of 24x7. (CA item 49) –We had few un-announced downtimes.

6 “B”: 3/3 Over the entire lifetime of the CA it must not be linked to any other entity. How does the CA guarantee this requirement? (RA item 8) –This guarantee is not explicitly mentioned in the CP/CPS.

7 “C”: 1/1 Every CA should perform operational audits of the CA/RA staff at least once per year. (CA item 47) –This has not been practiced regularly.

8 “D”: 1/3 Does the CA or RA have documented evidence on retaining the same identity over time? (RA item 6) –We need to have a documented evidence on retaining the same identity over time.

9 “D”: 2/3 Does the RA record and archive all requests and confirmations? (RA item 11) –The archival for requests and confirmations is currently done by the CA, as we have a small user community.

10 “D”: 3/3 Does the RA maintain the archive of these records in an auditable form? (RA item 12) –An RA does not maintain such records in auditable form. –The archival for requests and confirmations is currently done by the CA, as we have a small user community.

11 “X”: 1/4 Is the CA system completely off-line or one-line which uses FIPS level 3 capable HSM operated in FIPS level 3 mode? (CA item 9) –CA machine is completely offline. –Therefore, We do not have HSM.

12 “X”: 2/4 Does the on-line CA provide a log of issued certificates and a signed revocation list? Is the log tamper-protected? (CA item 16) –CA server is not an online machine.

13 “X”: 3/4 Are new EE certificates signed by a new cryptographic data? (CA item 18) –Yes, new certificates are signed by new cryptographic data. Is the old but still valid certificate available if there are still valid certificates signed by the old private key ? (CA item 18) –NO, as the transition period is not due yet! –Also, old certificates and old key is not valid any more.

14 “X”: 4/4 How is the re-new process described? (CA item 41) –We do not have a renewal policy for certificates as PK-GRID CA does not renew certificates rather it only rekeys…

Questions/Suggestions are welcome! 15