UNAMgrid CA Juan Carlos Guel UNAM, México. Alejandro Núñez UNAM, México. Israel Becerril UNAM, México. DGSCA UNAM 31/08/06

What is UNAMgrid CA The UNAMgrid CA provide X.509 certificates to the Mexican academic community and related entities for e- science.The UNAMgrid CA provide X.509 certificates to the Mexican academic community and related entities for e- science. It is located in the Departamento de Seguridad en Cómputo (UNAM- CERT/DSC) of the Direccion General de Servicios de Cómputo Académico(DGSCA), of the UNAM.It is located in the Departamento de Seguridad en Cómputo (UNAM- CERT/DSC) of the Direccion General de Servicios de Cómputo Académico(DGSCA), of the UNAM.

Web Site The UNAMgrid Site was created with OpenCA tool adapting to HTML code. The UNAMgrid Site is: –Outline CA –Online RA –Online Public Web Interface

CA information The UNAMgrid CA will operate a secure repository that contains: The UNAMgrid CA certificate (available in PEM, CRT, CER, TXT) and all previous ones necessary to check still valid certificates, The UNAMgrid CA certificate (available in PEM, CRT, CER, TXT) and all previous ones necessary to check still valid certificates, A Certificate Revocation List (available in DER, PEM, TXT) A Certificate Revocation List (available in DER, PEM, TXT) A copy of the most recent version of this policy and all previous versions. A copy of the most recent version of this policy and all previous versions.

How to get a Certificate A brief overview of this process is as follows: 1.Set your browser up to work with the Certificate Authority. 2.Request a certificate from the Certificate Authority. 3. Your nearest Registration Authority (RA) will then require a face-to-face meeting with you to verify your identity. They will need to see your photo ID.

4. The RA checks the PIN that you entered when requesting your certificate. 5. Then the RA checks that you are part of a recognized organization. 6. If all criteria are validated then the RA will approve the request. 7. The CA operator will review the approval and sign it. 8. You will be informed, by , that your certificate is ready. The will include the serial number and instructions about how to get your certificate.

Step 1: Setting up your browser to work with the CA a)Go to the CA, located at b)Click “CA Information”, then “Get CA Certificate” and finally CA Certificate in Browser Importable Format.

c) For Firefox will display a text box asking for what purposes the Certificate should be trusted. Check all the boxes and click OK. For Internet Explorer (IE) will display a prompt asking whether to Open or Save the certificate. Click Open and then click 'Install Certificate' which is located in the certificate window that opens. For Internet Explorer (IE) will display a prompt asking whether to Open or Save the certificate. Click Open and then click 'Install Certificate' which is located in the certificate window that opens.

Step 2: Request a Certificate To request a User Certificate, you will need to do the following: a)Navigate to the CA at a)Click Certificates, then Request a Certificate and finally User Certificates

c) You will see a form asking you for your details. You must fill in this form with your real name (first and last name must be provided and separated by a single space). Provide a valid address and select the RA. Also enter a PIN that will be used to verify your identity.

d) You will see a confirmation form with the data that you entered. Review the details and then press Continue.

e) Your browser now is generating a keypair. f) Wait for a while, the browser generates the keypair. g) You will get a message saying that the request has been successful. Your RA will contact you shortly to arrange a face to face meeting.

Step 3: Download the Certificate When your Certificate is signed you will need to import it into your browser. You can do this by doing the following: Navigating to the CA webpage at and clicking Certificates, then Import Certificate into Browser and entering the serial number given in the . Navigating to the CA webpage at and clicking Certificates, then Import Certificate into Browser and entering the serial number given in the .

Verifying Import When you have imported your certificate, test that it worked by doing the following: a)Navigate to the CA webpage at b)Click Certificates and then Test Certificate.

d) Type in your Master Password (Firefox only). e) You will be presented with a form. Click Sign.

f) Select the certificate you have just requested. Enter your Master Password and press OK. g) You should see Valid Certificate on the Web page. If not, your private key and public key may have been corrupted and you should contact to technical support.

Step 4: Downloading the Certificate Revocation List (CRL) into your browser The Certificate Revocation List is a list of Certificates that have been revoked and should not be trusted. You should have this imported into your browser otherwise you may be tricked into connecting to a compromised site. To import the CRL into your browser: a) Navigate to the CA at

b)Click CA Info, then Certificate Revocation Lists and finally CRL in DER format c) Click Yes to setting up automatic update. d) Check the box to allow automatic updates. e) Click Ok.

Future works Issue a new CA certificate with the following: Issue a new CA certificate with the following: C=mx, O=UNAMgrid, OU=UNAM, CN=CA New CP/CPS: Version 2c New CP/CPS: Version 2c Modify the OpenCA source code to validate a person certificate when a new host/service request is generated Modify the OpenCA source code to validate a person certificate when a new host/service request is generated

Modify the OpenCA source code to send an e- mail to CA Operator and RA Operator when a new request is generated, this will help to make more easy to signed process. Modify the OpenCA source code to send an e- mail to CA Operator and RA Operator when a new request is generated, this will help to make more easy to signed process. Create and publish “Howto”: Create and publish “Howto”: –How does certificate work –How to request a certificate –How to revoke a certificate –Prepare a certificate for use by Globus Toolkit –Convert a certificate to/from PEM format

Comments??