1. Jens Jensen, STFC 15 Sep. 2017 GridPP39, Lancaster
Certificate Stuff
Jens Jensen, STFC
15 Sep. 2017
GridPP39, Lancaster

2. Contents AAAI Pathfinder Multiple SANs
More bkg information in presentation to dteam
(Also attached to agenda)
Multiple SANs
More information in talk at hepsysman

3. AAAI Pathfinder
GridPP
VOMS
DiRAC, ARCHER
X.509
SAFE
ssh
IdP

4. AAAI Pathfinder
GridPP
PRACE
EGI, EUDAT, Indigo DC
X.509
IdP

5. GridPP, EGI, PRACE, EUDAT, GlobusConnect(?) DB
Pathfinder T3.2
STFC/Facilities
Portal
sshd
User
Reg’n portal
SCARF
Public
Authn
MyProxy
Online CA
HSM
GridPP, EGI, PRACE, EUDAT, GlobusConnect(?) 
VOMS

6. (links to) JISC and service AUP CRL (links to) CP and CPS
Moonshot (user) authenticated
Account management
Public Portal/server (no authentication required)
Information
Links to helpdesk
(links to) JISC and service AUP
CRL
(links to) CP and CPS
AUP Acceptance
Name filter
IdP check
Attribute check
Data Processing Acceptance
Certificate Interface
Acct DB
Status
(Re)new
Revoke
Management Interface (X.509 authenticated)
Service API
Forget

7. GridPP’s participation
Work with Suleman Tariq
CA portal (user interface)
If you have an IdP in Assent, you can authenticate to
Not finished yet
You can’t get a certificate (yet)
Chose not to use the CTS code
No VOMS in interface; expecting attrs from Moonshot

8. Visiony Stuff Single identity provided by home org.
Or a “homeless” org.
Access to both web and non-web resources
Chicken and egg takeup:
More resources make having an IdP more attractive
Use Pathfinder to provide resources

9. Technical Points Moonshot requires client side libs (mech_eap.so)
X.509 certificates require higher LoA
Aiming for BIRCH
Need for IdP to communicate “loss of traceability”
Infrastructure managed private keys
Should improve usability

10. (Main) Risks (There is a proper risk register…) Not enough IdPs…
Of a sufficient LoA (IGTF BIRCH)
Need to sign a contract! (little assurance in Assent itself)
IdP cannot notify on loss of traceability
IGTF accreditation delayed
Users still manage certs through browser!

11. Support for added extra supplementary additional
Subject alt names

12. Now supported via PeCR cli mode uses --san to request extra SANs
Bulk mode uses extra lines in cnfiles
Comma separated (no spaces)
Need a recent version of PeCR, see

13. Still a few niggles Need to pre-authorise all SANs
By submitter DN
Through RA
(Because RA will not necessarily see the SANs during approval)
Only works for NEW host requests
Otherwise submitter DN is not present
Need to fiddle old requests
cnfiles need single names to download
fixed!

14. Additional Credits
PeCR – Robert Frank
Testing – John Kewley

15. More information on both Pathfinder and Multi-SAN: dteam