UK e-Science CA and JCS Migration Status Jens Jensen, John Kewley EUGridPMA May 2015 København

Community “UK e-Science” GridPP …? UK eScience Status 29/12/2018

Staff (alphabetically) Jens Jensen – CA manager, signing code, packaging scripts David Kelsey – representing CA with PMAs John Kewley – user support, packaging scripts David Meredith – code for caportal and CW Suleman Tariq – sysadmin and DR UK eScience Status 29/12/2018

Current Status Currently continuing as before ~1700 valid distinct host certs ~ 800 valid distinct user certs ~10 distinct robots Total issuance >37000 Still adding RAs –200 distinct operators in database Still working with JANET on migration opportunities More on this in a later slide Improving stuff CertWizard CAPortal New CP has taken effect Tidying extensions Talk Title Goes Here 29/12/2018

Renewals Old stuff still around Disaster Recovery Future directions Some SHA1s still alive, sign as SHA2 upon renewal Even a few Netscape extensions, removed upon renewal Likewise email-in-DN, ancient and deprecated Disaster Recovery Improved DR for Root (ROBAB) Improved DR for SARoNGS Already good DR for 2B (semi-online, warm spare) Future directions Likely to retire 2A (online) now Reimplement HSM? JCS migration Talk Title Goes Here 29/12/2018

Risks Not much effort Ageing HSMs Self audit Development, support, proactive stuff After the closure of NGS Trying to understand user communities (other than GridPP) Ageing HSMs No in-plan recovery, must rebuild Considered “small” HSMs Some funding made available by STFC – but need to consider future Self audit Talk Title Goes Here 29/12/2018

Original UK eScience Certificate Hierarchy Dev CA* Training CA Root 2007 CA CA 2A (online) CA 2B (offline) SLCS Toplevel SARoNGS Climate CAs RIGroup Meeting 29/12/2018

Changes in the pipeline Service certificate support (generally deprecated) Turn off OpenCA i/f Downloads of CRLs on ca.grid-support.ac.uk ~ 5200/day New PeCR scripts + maybe CertWizard CLI SHA-2 (done) Requires a port of CertWizard to jGlobus2 IPv6 Our CRLs should probably be made available to test Key-pair generation – inline in caportal Tweak certificate format for new Grid Certificate Profile (done) RIGroup Meeting 29/12/2018

When can we turn off OpenCA? Previous OpenCA Interfaces: ca.grid-support.ac.uk: for Users ca-ra.grid-support.ac.uk/ra: for RA Operators ca-ra.grid-support.ac.uk/node: for CA Operators 1 and 2 replaced with caportal, 1 with CW Lots of downloads of CRLs from ca.grid-support.ac.uk (5200/d) “New” CDPs advertised for years – since 1.32 or so!? RIGroup Meeting 29/12/2018

JCS Migration Aim is to migrate if possible Interfacing to CA Interface to QV for certificate issuance Interfacing to CA Keep caportal and CW running, interfacing to QV? Ke Identity management options – interim/future Keep existing RA network and identities (but DNs will change?) Use UKAMF (needs extra attributes – REFEDS) Use JISC Assent Migration Change DNs!? Continuing support for robots, services? UK eScience Status 29/12/2018