1. PKI Administration Using EJBCA and OpenCA
Presented By:
Ayesha Ghori and Asra Parveen

2. PKI: Public Key Infrastructure
A trusted third Party.
Secured communication.
Provides digital certificates that can identify an individual or an organization.
Stores and revokes Certificates.
Provides services like Encryption, digital Signatures, data integrity, key establishment, zero knowledge/minimum knowledge protocols.

3. PKI Components
Certificate Authority: A CA issues certificates to, and vouches for the authenticity of entities.
Registration Authority: An RA is an administrative function that registers entities in the PKI.
End entity: An end-entity is a user, such as an client, a web server, a web browser or a VPN-gateway.

4. PKI HIERARCHY GMU CA TOP CA GMU FAIRFAXCA SUBCA GMU MANASSAS CA
GMU PW CAMPUS CA
RA INSTANCE
GMU FAIRFAX
GMU MANASSAS
GMU PW CAMPUS
GMU Fairfax CA Administrator
GMU Manassas CA Administrator
Super Administrator
GMU Fairfax RA Administrator
GMU Manassas RA Administrator
GMU PW RA Administrator
GMU PW CA Administrator

5. EJBCA and OpenCA Software Requirements
Software Requirements of EJBCA
Java JDK 1.5 – Java 2 Platform Standard Development Kit.
Apache Ant – Java Build Utility, used to compile and build Java programs.
JBoss – J2EE Application Server EJBCA download
Software Requirements of OpenCA
OpenLDAP.
OpenSSL.
Apache Project.
Apache mod_ssl.

6. EJBCA EJBCA is a fully functional Certificate Authority built in Java.
Based on J2EE technology.
Robust
High performance, component based CA.
Flexible and platform independent.
EJBCA can be used as standalone or integrated in any J2EE application.

7. EJBCA: Architecture

8. EJBCA Administration Create and Initialize the Super Administrator
Creating and Configuring data sources
Creating Publishers
Creating Certificate Authorities
Creating Registration Authorities
Creating End Entities
Creating CRL’s
Generating Certificates

9. The EJBCA Super Admin Certificate

10. OpenCA
Linux based.
Provides the choice of algorithms- des, des3, idea.
Extensions Provided: SKI and AKI.
In Addition to the PKI components of EJBCA, OpenCA also has a Registration Authority Operator.

11. OpenCA: Architecture

12. OpenCA Administration
Initializing the Certification Authority
Create the initial administrator
Create the initial RA Certificate
Submit a Certificate Request
Approve the Certificate
Issue the Certificate
Importing the Root Certificate

13. User Certificate

14. Comparison Parameters EJBCA OpenCA Ease of Configuration Very Complex
Confidentiality
Offers Confidentiality using encryption
Integrity
Offers Integrity by encryption
Authentication
Offers Authentication by Digital Signature
NonRepudiation
YES

15. Ability to choose the algorithm to use
Yes
OCSP
Ability to choose CSP No
CRL updates
Automatic
Manual
Cost
Free
Extensions
LDAP Support
Support for smart cards

16. Platform
Java J2EE
Perl CGI on Unix
Certificate Repositories
HSQL
MySQL
Modules
EJB
Perl Modules
Components based
Yes
Standalone Component
Present
Not Present
Supported Browsers
Multiple
Scalability
Good
Bad

17. Conclusion EJBCA is the simplest to use Complexity during installation
Provides for automatic CRL updates
OpenCA is the best for Linux users
Manual revocations
Both can be used by various clients