1. UK e-Science CA and JCS Migration Status
Jens Jensen, John Kewley
EUGridPMA May 2015
København

2. Community
“UK e-Science”
GridPP …?
UK eScience Status
29/12/2018

3. Staff (alphabetically)
Jens Jensen – CA manager, signing code, packaging scripts
David Kelsey – representing CA with PMAs
John Kewley – user support, packaging scripts
David Meredith – code for caportal and CW
Suleman Tariq – sysadmin and DR
UK eScience Status
29/12/2018

4. Current Status Currently continuing as before
~1700 valid distinct host certs
~ 800 valid distinct user certs
~10 distinct robots
Total issuance >37000
Still adding RAs –200 distinct operators in database
Still working with JANET on migration opportunities
More on this in a later slide
Improving stuff
CertWizard
CAPortal
New CP has taken effect
Tidying extensions
Talk Title Goes Here
29/12/2018

5. Renewals Old stuff still around Disaster Recovery Future directions
Some SHA1s still alive, sign as SHA2 upon renewal
Even a few Netscape extensions, removed upon renewal
Likewise -in-DN, ancient and deprecated
Disaster Recovery
Improved DR for Root (ROBAB)
Improved DR for SARoNGS
Already good DR for 2B (semi-online, warm spare)
Future directions
Likely to retire 2A (online) now
Reimplement HSM?
JCS migration
Talk Title Goes Here
29/12/2018

6. Risks Not much effort Ageing HSMs Self audit
Development, support, proactive stuff
After the closure of NGS
Trying to understand user communities (other than GridPP)
Ageing HSMs
No in-plan recovery, must rebuild
Considered “small” HSMs
Some funding made available by STFC – but need to consider future
Self audit
Talk Title Goes Here
29/12/2018

7. Original UK eScience Certificate Hierarchy
Dev CA*
Training CA
Root
2007 CA
CA 2A
(online)
CA 2B
(offline)
SLCS
Toplevel
SARoNGS
Climate
CAs
RIGroup Meeting
29/12/2018

8. Changes in the pipeline
Service certificate support (generally deprecated)
Turn off OpenCA i/f
Downloads of CRLs on ca.grid-support.ac.uk ~ 5200/day
New PeCR scripts + maybe CertWizard CLI
SHA-2 (done)
Requires a port of CertWizard to jGlobus2
IPv6
Our CRLs should probably be made available to test
Key-pair generation – inline in caportal
Tweak certificate format for new Grid Certificate Profile (done)
RIGroup Meeting
29/12/2018

9. When can we turn off OpenCA?
Previous OpenCA Interfaces:
ca.grid-support.ac.uk: for Users
ca-ra.grid-support.ac.uk/ra: for RA Operators
ca-ra.grid-support.ac.uk/node: for CA Operators
1 and 2 replaced with caportal, 1 with CW
Lots of downloads of CRLs from ca.grid-support.ac.uk (5200/d)
“New” CDPs advertised for years – since 1.32 or so!?
RIGroup Meeting
29/12/2018

10. JCS Migration Aim is to migrate if possible Interfacing to CA
Interface to QV for certificate issuance
Interfacing to CA
Keep caportal and CW running, interfacing to QV? Ke
Identity management options – interim/future
Keep existing RA network and identities (but DNs will change?)
Use UKAMF (needs extra attributes – REFEDS)
Use JISC Assent
Migration
Change DNs!?
Continuing support for robots, services?
UK eScience Status
29/12/2018