1. Emir Imamagić University Computing Centre (Srce)
SRCE CA Self Audit
Emir Imamagić
University Computing Centre (Srce)

2. Overview
SRCE CA
Self Audit
Conclusion

3. Overview Established in May 2006
Certificates for the Croatian academic and research community
Public web site:
address:
Approved by EUGridPMA in July 2006
Classic AP 4.0

4. Organization CA & RA @ SRCE One lightweight RAa
three staff members: Tomislav Stilinovic, Emir Imamagic, Dobrisa Dobrenic
One lightweight RAa
ETFOS (Faculty of Electrical Engineering in Osijek, Croatia), Goran Martinovic

5. System Architecture OpenCA Online interface (RA)
version 1.5.1
online part integrated with Croatian AAI infrastructure
Online interface (RA)
used by EE for certificate requests
used by RAs for request confirmations
deployed on dedicated server
Offline signing machine (CA)
machine kept in safe accessible to CA staff only
data transfer achieve USB
data backup performed after each operation

6. Certificates Total: 1196 certificates Valid: 83 certificates
Host: 491
User: 705
Valid: 83 certificates
Host: 24
User: 59
Revoked: 23 certificates
retired machines
forgotten passphrase
accidentally deleted private keys

7. CP/CPS Updates Version 1.1 Version 1.3 Version 1.4 November 20th 2009
updated EE & CA extensions
made compliant with Grid Certificate Profile
Version 1.3
May 14th 2010
updates after the first self audit
Version 1.4
Aug 8th 2015.
updates after the second self audit
unfortunately not published

8. Self Audit

9. Versions Guidelines for auditing Grid CAs version 1.1
October 28th 2010
Authentication Profile for Classic X.509 Public Key Certification Authorities with secured infrastructure version 4.4
SRCE CA CP/CPS version 1.4
Aug 8th 2015

10. Summary Total number of items: 67 Marks:
C: 0
B: 1
X: 1
A: 65
Marks in previous self audit (2015):
C: 1
A: 64

11. CP/CPS
B - 1.6
Item description: The CP/CPS documents should be structured as defined in RFC
Status: CP/CPS is structured as defined in RFC 2527.
Solution: Currently we do not have resources to perform such major update. Current CP/CPS defines well our practices. We can consider updating in future if strongly requested from PMA and Relying Parties.

12. End Entity Certificates and Keys
X – 7.41
Item description: Certificates associated with a private key residing solely on hardware token may be renewed for a validity period of up to 5 years (for equivalent RSA key lengths of 2048 bits) or 3 years (for equivalent RSA key lengths of bits).
Comment: CA does not support keys residing on hardware tokens.

13. Conclusion & Final Remarks
SRCE CA operates in a stable manner for 12 years
Number of certificates decreasing
planning to decommission grid services in 2018.
Publish CP/CPS version 1.4
Changes related to GDPR compliance
SHA-2 CA certificate?

14. Thank You! Questions?