KISTI Grid CA Operation KISTI Supercomputing Center Sangwan Kim, Soonwook Hwang CA Operators Contact: Jan. 8, 2007

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration)

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) 1 The subscriber download ‘User Application Form’ from the web site and fill the form.

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) User Application Form Face-to-Face Meeting 2

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) 3 PIN# RA’s Signature Get a PIN number PIN# User Application Form Face-to-Face Meeting PIN# The RA gets a PIN number from the CA server. PIN number requests can be done with RA privilege. The RA write down the PIN# in the application form of the user and sign the form.

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# RA’s Signature FAX the application form to the CA 4

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# RA’s Signature The CA checks the PIN# and RA’s Signature 5

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# RA’s Signature If required, the CA may contact to the RA if the RA has really signed the application form. 6

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# The CA make a WACC for the user. WACC is protected by PIN#. (PIN# is a password) PIN# RA’s Signature * WACC: Web-Access Client Certificate PIN# WACC 7

PIN# WACC Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# * WACC: Web-Access Client Certificate Register the WACC information in the lookup database of the web server. 8

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# The CA send the WACC to the User by normal . (The WACC is protected by PIN#) PIN# * WACC: Web-Access Client Certificate PIN# WACC 9

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# * WACC: Web-Access Client Certificate PIN# WACC The Subscriber can decrypt the WACC using his PIN#. He installs the WACC in his web browser. 10

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# * CSR: Certificate Signing Request WACC The subscriber access the online CSR website with the WACC. This communication is protected with HTTPS with client authentication. Internet The web server authenticate the client using the WACC information received from the client, and compare it with the lookup database, to check if the WACC is valid one or not. 11 HTTPS

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# * CSR: Certificate Signing Request WACC The Subscriber uploads his CSR to request for the CA to sign the CSR. CSR 12 HTTPS

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# WACC The subscriber sends a notification to the CA after uploading the CSR. CSR * CSR: Certificate Signing Request 13

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# WACC CSR The CA get the CSR from the web server, and sign it to make a certificate. Certificate 14

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# WACC The CA publish the certificate in the web server. 15

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# The CA operator send a notification to the subscriber after issuing a certificate. 16

Subscriber CA Operator RA CA machine (off-line) Web Server(s) (with Virtual Host configuration) PIN# The Subscriber get his certificate from the web server. 17 HTTPS