Tweaking the Certificate Lifecycle for the UK eScience CA John Kewley NGS Support Centre Manager & Service Manager for the UK e-Science CA 30/03/2012EGI CF Munich1

Outline Certificates and The UK e-Science CA The Lifecycle of a User Certificate Some problems The CertWizard and other Improvements Future work 30/03/2012EGI CF Munich2

Authentication: Identity: who you are c.f. Passport, identity card Authorisation: What you are allowed to do c.f. Visa, or Work/Residence Permit Authentication vs Authorisation 30/03/20123EGI CF Munich

What is a CA? A CA (Certification Authority) is a trusted identity that issues and manages digital certificates (security credentials). Trusting a particular CA means that you trust the identity of its certificate holders 30/03/2012EGI CF Munich4

The UK e-Science CA The UK e-Science CA issues 13 month certificates for use by users, services and hosts from the UK e-Science Grid community. Since it follows international standards and is accredited by the IGTF, its certificates are accepted by Grids around the world. 30/03/2012EGI CF Munich5

Registration Authorities For a CA is to sign their certificate, the user's identity needs asserting This role is federated to about 60 Registration Authorities (RAs) throughout the UK The CA trusts their RA Operators to check the user's photo-id and approve their certificate requests. 30/03/2012EGI CF Munich6

Certificate Lifecycle 30/03/2012EGI CF Munich7 VALID Apply

The Apply Process 30/03/2012EGI CF Munich8 User Applies for New Certificate CA Signs RA Approves Request User and RA Meet Face to Face

The Apply Process 30/03/2012EGI CF Munich9 User Applies for New Certificate CA Signs RA Approves Request User and RA Meet Face to Face Is user entitled to a Certificate? Does PhotoID match Photocopy PhotoID and file Check PIN

Certificate Lifecycle 30/03/2012EGI CF Munich10 VALID Apply Renew EXPIRED

The Renew Process 30/03/2012EGI CF Munich11 User Applies for Certificate Renewal CA Signs RA Approves Renewal Request

Certificate Lifecycle 30/03/2012EGI CF Munich12 VALID REVOKED Apply Renew Revoke EXPIRED

Browser/OS Problems We receive many certificate problems on our helpdesk, mostly expiries or browser issues Browsers change, we can't support them all OpenCA s/w was problematic to update. 30/03/2012EGI CF Munich13

Other Problems If a user's certificate has been revoked or in the following situations: –User's address changes –User's certificate expires unexpectedly –User wants a new certificate as their old one expired some time ago Then the user must apply for a new one (requesting revocation of their old one if required). This requires visiting the RA Operator in person. 30/03/2012EGI CF Munich14

Plan 1.Duplicate existing functionality of old web interface in new CertWizard 30/03/2012EGI CF Munich15

Old Web Interface 30/03/2012EGI CF Munich16

Old vs New 30/03/2012EGI CF Munich17 CA-Sign CertWizard CA DB Browsers OpenCA https CA-Server REST BulkNew BulkRA Old New

CertWizard Platform and browser independent Automatically updating RESTful interface 30/03/2012EGI CF Munich18

30/03/2012EGI CF Munich19

30/03/2012EGI CF Munich20

Renew Certificate 30/03/2012EGI CF Munich21

Request Revocation 30/03/2012EGI CF Munich22

Plan 1.Duplicate existing functionality of old web interface in new CertWizard 2.Amend policy and extend CertWizard to permit renewing recently-expired certificates 30/03/2012EGI CF Munich23

Renew Recently Expired 30/03/2012EGI CF Munich24 VALID REVOKED Apply Renew Revoke EXPIRED Recent? No Yes

Plan 1.Duplicate existing functionality of old web interface in new CertWizard 2.Amend policy and extend CertWizard to permit renewing recently expired certificates 3.Permit virtual meetings (VC for example) for Re-Applications 30/03/2012EGI CF Munich25

Re-Applications 30/03/2012EGI CF Munich26 VALID REVOKED Apply Renew Revoke EXPIRED No Re-Apply Recent? Yes

The Re-Apply Process 30/03/2012EGI CF Munich27 User Applies for New Certificate CA Signs RA Approves Request User and RA Meet Virtually

Plan 1.Duplicate existing functionality of old web interface in new CertWizard 2.Amend policy and extend CertWizard to permit renewing recently expired certificates 3.Permit virtual meetings (VC for example) for Re-Applications 4.Extend CertWizard to allow changing of addresses 30/03/2012EGI CF Munich28

Change requests 30/03/2012EGI CF Munich29 VALID REVOKED Apply Renew Revoke EXPIRED Recent? No Yes Re-Apply Change

Change Requests Design Options 1.Permit changing address at Renewal or as a separate Change process. 2.Should the RA Operator be involved? 3.Should the keys and expiry remain the same? 30/03/2012EGI CF Munich30

Plan 1.Duplicate existing functionality of old web interface in new CertWizard 2.Amend policy and extend CertWizard to permit renewing recently expired certificates 3.Permit virtual meetings (VC for example) for Re-Applications 4.Extend CertWizard to allow changing of addresses 5.Integrate CertWizard functionality with our existing MyProxy and VOMS tools 30/03/2012EGI CF Munich31

Seamless Interworking Integrated with MyProxyUploader, our previous proxy generation tool Uploading to MyProxy servers Local Proxies Add VOMS attributes 30/03/2012EGI CF Munich32

Export/Backup 30/03/2012EGI CF Munich33

Install 30/03/2012EGI CF Munich34

Configuration CA Certificates MyProxy servers VOMS servers Your Certificate 30/03/2012EGI CF Munich35

MyProxyUploader 30/03/2012EGI CF Munich36

Local Proxy 30/03/2012EGI CF Munich37

VOMS attributes 30/03/2012EGI CF Munich38

Additional work Provide an RA Operator interface Bulk Host Certificate Request interface Support for Host Certificates in CertWizard Online CA 30/03/2012EGI CF Munich39

Summary Implemented a Certificate request tool Integrated it with our existing MyProxy tool Will allow renewal of recently-expired certificates Introduced the idea of a Re-Application Permit virtual meetings for Re-Applications Designing a Change mechanism for addresses Less hassle for Users Less work for RA Operators Looking ahead to an online CA 30/03/2012EGI CF Munich40

Acknowledgements Jens Jensen and David Meredith NGS STFC 30/03/2012EGI CF Munich41 The next NGS Seminar will be by Josh Howlett of JANET and will be entitled: "Moonshot - next generation federated identity"

Certificate Lifecycle 30/03/2012EGI CF Munich42 VALID Approved New ArchivedDeleted Renew

CSR Lifecycle 30/03/2012EGI CF Munich43 VALID Approved New Archived Deleted Renew Signing RA Approval CSRCertificate

CSR Lifecycle 30/03/2012EGI CF Munich44 Renewal Approved Archived New Deleted

Revocation Lifecycle 30/03/2012EGI CF Munich45 SUSPENDED Approved SUSPENDED RA User CA Deleted CSR Other RA Signing RA

The Revoke Process 30/03/2012EGI CF Munich46 User Makes Revocation Request CA Signs RA Makes Revocation Request Another RA makes Revocation Request RA Approves Request