1. Tweaking the Certificate Lifecycle for the UK eScience CA
John Kewley
NGS Support Centre Manager &
Service Manager for the UK e-Science CA
The UK eScience CA one of the world's leading Grid Certification
Authorities (CA) and has issued around 30,000 certificates.
The National Grid Service (NGS) helpdesk receives many tickets relating
to certificates (and certificate
renewal in particular): largely due to browser incompatibilities.
This talk gives an introduction to the UK eScience CA and its associated
software and interfaces, including CertWizard: our new browser-independent
certificate tool.
It will show how modernisations are being made at various stages of the
certificate lifecycle, making it easier than ever to manage your
personal UK eScience Certificate.
30/03/2012
EGI CF Munich

2. Outline Certificates and The UK e-Science CA
The Lifecycle of a User Certificate
Some problems
The CertWizard and other Improvements
Future work
ABSTRACT:
Users find applying for and renewing of their certificates hard.
In fact one third of the tickets on the UK NGI Helpdesk in the last year
were related to certificates: a common theme being browser issues.
STFC staff have produced a browser-independent tool for managing
the certificates of the UK NGI user community. This tool, combined with
other service improvements, provides a simpler-to-use interface which is
more efficient and fully integrated with our already established
certificate tools.
The NGS runs the world's 2nd largest Grid Certification Authority: the
IGTF-accredited UK e-Science CA. It is trialing several innovations for x509
authentication including alternatives to year-long user certificates,
but their use will be needed for some time. The CA certificate
itself is due for renewal in 2011 and so the opportunity is being taken
to make changes at all levels of the service.
Up until now, users have used their browser to apply for and renew
their certificates. As browsers have evolved there have been a variety of
incompatibilities in the way they handle certificates and our list of
unsupported browsers has grown. The solution was to write a stand-alone
tool to manage these certificate requests without involving a browser.
The tool also adds the facility to renew a recently expired certificate and
change details such as the user's address without having to revoke it
and apply for a new one like now. It has also been merged with our existing
VOMS-enabled MyProxy Upload Tool so that a single tool can be used to manage
all the user's certificate interactions. Further work is already underway
to add interfaces to provide analogous support for host certificates and
for RA Operators to approve both user and host certificate requests.
Although the CA part of our tool is tied in to the UK eScience CA, the
interface provided is well-defined and would not take too much effort to
generalise for other community CAs so we are keen to demonstrate its
functionality at the User Forum in Lyon.
30/03/2012
EGI CF Munich

3. Authentication vs Authorisation
Identity: who you are
c.f. Passport, identity card
Authorisation:
What you are allowed to do
c.f. Visa, or Work/Residence Permit
30/03/2012
EGI CF Munich

4. What is a CA?
A CA (Certification Authority) is a trusted identity that issues and manages digital certificates (security credentials). Trusting a particular CA means that you trust the identity of its certificate holders
30/03/2012
EGI CF Munich

5. The UK e-Science CA
The UK e-Science CA issues 13 month certificates for use by users, services and hosts from the UK e-Science Grid community. Since it follows international standards and is accredited by the IGTF, its certificates are accepted by Grids around the world.
30/03/2012
EGI CF Munich

6. Registration Authorities
For a CA is to sign their certificate, the user's identity needs asserting
This role is federated to about 60 Registration Authorities (RAs) throughout the UK
The CA trusts their RA Operators to check the user's photo-id and approve their certificate requests.
30/03/2012
EGI CF Munich

7. Certificate Lifecycle
Apply
VALID
30/03/2012
EGI CF Munich

8. The Apply Process User Applies for New Certificate
User and RA Meet Face to Face
RA Approves Request
Simplified process
User Applies for a new user certificate (CertWizard or Browser)
RA Operator confirms User is entitled to one. User and RA Operator meet face-to-face so RA Operator can check PhotoID
RA Operator approves (or rejects) certificate request
The UK eScience CA signs the request
CA Signs
30/03/2012
EGI CF Munich

9. The Apply Process Is user entitled to a Certificate?
User Applies for New Certificate
Does PhotoID match
User and RA Meet Face to Face
Photocopy PhotoID and file
RA Approves Request
Check PIN
Simplified process
User Applies for a new user certificate (CertWizard or Browser)
RA Operator confirms User is entitled to one. User and RA Operator meet face-to-face so RA Operator can check PhotoID
RA Operator approves (or rejects) certificate request
The UK eScience CA signs the request
CA Signs
30/03/2012
EGI CF Munich

10. Certificate Lifecycle
Apply
Renew
VALID
EXPIRED
30/03/2012
EGI CF Munich

11. The Renew Process User Applies for Certificate Renewal
RA Approves Renewal Request
Simplified process
User Request that his certificate is renewed (CertWizard or Web Browser)
RA Operator checks User is still entitled to one and if so approves renewal request
The UK eScience CA signs the new certificate
CA Signs
30/03/2012
EGI CF Munich

12. Certificate Lifecycle
Apply
Renew
VALID
Revoke
REVOKED
EXPIRED
30/03/2012
EGI CF Munich

13. Browser/OS Problems
We receive many certificate problems on our helpdesk, mostly expiries or browser issues
Browsers change, we can't support them all
OpenCA s/w was problematic to update.
30/03/2012
EGI CF Munich

14. Other Problems
If a user's certificate has been revoked or in the following situations:
User's address changes
User's certificate expires unexpectedly
User wants a new certificate as their old one expired some time ago
Then the user must apply for a new one (requesting revocation of their old one if required). This requires visiting the RA Operator in person.
30/03/2012
EGI CF Munich

15. Plan
Duplicate existing functionality of old web interface in new CertWizard
30/03/2012
EGI CF Munich

16. Old Web Interface
30/03/2012
EGI CF Munich

17. Old vs New New Old CA-Sign CA DB OpenCA https CA-Server REST Browsers
Bulk
New Bulk RA
CertWizard
30/03/2012
EGI CF Munich

18. CertWizard Platform and browser independent Automatically updating
RESTful interface
30/03/2012
EGI CF Munich

19. 30/03/2012
EGI CF Munich

20. 30/03/2012
EGI CF Munich

21. Renew Certificate
30/03/2012
EGI CF Munich

22. Request Revocation
30/03/2012
EGI CF Munich

23. Plan
Duplicate existing functionality of old web interface in new CertWizard
Amend policy and extend CertWizard to permit renewing recently-expired certificates
30/03/2012
EGI CF Munich

24. Renew Recently Expired
Apply
Renew
VALID
Yes
Recent?
Revoke No
REVOKED
EXPIRED
30/03/2012
EGI CF Munich

25. Plan
Duplicate existing functionality of old web interface in new CertWizard
Amend policy and extend CertWizard to permit renewing recently expired certificates
Permit virtual meetings (VC for example) for Re-Applications
30/03/2012
EGI CF Munich

26. Re-Applications VALID REVOKED EXPIRED Apply Renew Yes Recent? RevokeNo
REVOKED
EXPIRED
Re-Apply
30/03/2012
EGI CF Munich

27. The Re-Apply Process User Applies for New Certificate
User and RA Meet Virtually
RA Approves Request
Simplified process
User Applies for a new user certificate (CertWizard or Browser)
RA Operator confirms User is entitled to one. User and RA Operator meet face-to-face so RA Operator can check PhotoID
RA Operator approves (or rejects) certificate request
The UK eScience CA signs the request
CA Signs
30/03/2012
EGI CF Munich

28. Plan
Duplicate existing functionality of old web interface in new CertWizard
Amend policy and extend CertWizard to permit renewing recently expired certificates
Permit virtual meetings (VC for example) for Re-Applications
Extend CertWizard to allow changing of addresses
30/03/2012
EGI CF Munich

29. Change requests VALID REVOKED EXPIRED Apply Renew Change Yes No
Recent?
Revoke
REVOKED
EXPIRED
Re-Apply
30/03/2012
EGI CF Munich

30. Change Requests Design Options
Permit changing address at Renewal or as a separate Change process.
Should the RA Operator be involved?
Should the keys and expiry remain the same?
30/03/2012
EGI CF Munich

31. Plan
Duplicate existing functionality of old web interface in new CertWizard
Amend policy and extend CertWizard to permit renewing recently expired certificates
Permit virtual meetings (VC for example) for Re-Applications
Extend CertWizard to allow changing of addresses
Integrate CertWizard functionality with our existing MyProxy and VOMS tools
30/03/2012
EGI CF Munich

32. Seamless Interworking
Integrated with MyProxyUploader, our previous proxy generation tool
Uploading to MyProxy servers
Local Proxies
Add VOMS attributes
30/03/2012
EGI CF Munich

33. Export/Backup
30/03/2012
EGI CF Munich

34. Install
30/03/2012
EGI CF Munich

35. Configuration CA Certificates MyProxy servers VOMS servers
Your Certificate
30/03/2012
EGI CF Munich

36. MyProxyUploader
30/03/2012
EGI CF Munich

37. Local Proxy
30/03/2012
EGI CF Munich

38. VOMS attributes
30/03/2012
EGI CF Munich

39. Additional work Provide an RA Operator interface
Bulk Host Certificate Request interface
Support for Host Certificates in CertWizard
Online CA
30/03/2012
EGI CF Munich

40. Summary Implemented a Certificate request tool
Integrated it with our existing MyProxy tool
Will allow renewal of recently-expired certificates
Introduced the idea of a Re-Application
Permit virtual meetings for Re-Applications
Designing a Change mechanism for addresses
Less hassle for Users
Less work for RA Operators
Looking ahead to an online CA
30/03/2012
EGI CF Munich

41. Acknowledgements Jens Jensen and David Meredith NGS STFC 30/03/2012
EGI CF Munich