1. Tweaking the Certificate Lifecycle for the UK eScience CA John Kewley NGS Support Centre Manager & Service Manager for the UK e-Science CA john.kewley@stfc.ac.uk 30/03/2012EGI CF Munich1

2. Outline Certificates and The UK e-Science CA The Lifecycle of a User Certificate Some problems The CertWizard and other Improvements Future work 30/03/2012EGI CF Munich2

3. Authentication: Identity: who you are c.f. Passport, identity card Authorisation: What you are allowed to do c.f. Visa, or Work/Residence Permit Authentication vs Authorisation 30/03/20123EGI CF Munich

4. What is a CA? A CA (Certification Authority) is a trusted identity that issues and manages digital certificates (security credentials). Trusting a particular CA means that you trust the identity of its certificate holders 30/03/2012EGI CF Munich4

5. The UK e-Science CA The UK e-Science CA issues 13 month certificates for use by users, services and hosts from the UK e-Science Grid community. Since it follows international standards and is accredited by the IGTF, its certificates are accepted by Grids around the world. 30/03/2012EGI CF Munich5

6. Registration Authorities For a CA is to sign their certificate, the user's identity needs asserting This role is federated to about 60 Registration Authorities (RAs) throughout the UK The CA trusts their RA Operators to check the user's photo-id and approve their certificate requests. 30/03/2012EGI CF Munich6

7. Certificate Lifecycle 30/03/2012EGI CF Munich7 VALID Apply

8. The Apply Process 30/03/2012EGI CF Munich8 User Applies for New Certificate CA Signs RA Approves Request User and RA Meet Face to Face

9. The Apply Process 30/03/2012EGI CF Munich9 User Applies for New Certificate CA Signs RA Approves Request User and RA Meet Face to Face Is user entitled to a Certificate? Does PhotoID match Photocopy PhotoID and file Check PIN

10. Certificate Lifecycle 30/03/2012EGI CF Munich10 VALID Apply Renew EXPIRED

11. The Renew Process 30/03/2012EGI CF Munich11 User Applies for Certificate Renewal CA Signs RA Approves Renewal Request

12. Certificate Lifecycle 30/03/2012EGI CF Munich12 VALID REVOKED Apply Renew Revoke EXPIRED

13. Browser/OS Problems We receive many certificate problems on our helpdesk, mostly expiries or browser issues Browsers change, we can't support them all OpenCA s/w was problematic to update. http://www.ngs.ac.uk/supported-internet-browsers 30/03/2012EGI CF Munich13

14. Other Problems If a user's certificate has been revoked or in the following situations: –User's email address changes –User's certificate expires unexpectedly –User wants a new certificate as their old one expired some time ago Then the user must apply for a new one (requesting revocation of their old one if required). This requires visiting the RA Operator in person. 30/03/2012EGI CF Munich14

15. Plan 1.Duplicate existing functionality of old web interface in new CertWizard 30/03/2012EGI CF Munich15

16. Old Web Interface 30/03/2012EGI CF Munich16

17. Old vs New 30/03/2012EGI CF Munich17 CA-Sign CertWizard CA DB Browsers OpenCA https CA-Server REST BulkNew BulkRA Old New

18. CertWizard Platform and browser independent Automatically updating RESTful interface http://www.ngs.ac.uk/tools/certwizard 30/03/2012EGI CF Munich18

19. 30/03/2012EGI CF Munich19

20. 30/03/2012EGI CF Munich20

21. Renew Certificate 30/03/2012EGI CF Munich21

22. Request Revocation 30/03/2012EGI CF Munich22

23. Plan 1.Duplicate existing functionality of old web interface in new CertWizard 2.Amend policy and extend CertWizard to permit renewing recently-expired certificates 30/03/2012EGI CF Munich23

24. Renew Recently Expired 30/03/2012EGI CF Munich24 VALID REVOKED Apply Renew Revoke EXPIRED Recent? No Yes

25. Plan 1.Duplicate existing functionality of old web interface in new CertWizard 2.Amend policy and extend CertWizard to permit renewing recently expired certificates 3.Permit virtual meetings (VC for example) for Re-Applications 30/03/2012EGI CF Munich25

26. Re-Applications 30/03/2012EGI CF Munich26 VALID REVOKED Apply Renew Revoke EXPIRED No Re-Apply Recent? Yes

27. The Re-Apply Process 30/03/2012EGI CF Munich27 User Applies for New Certificate CA Signs RA Approves Request User and RA Meet Virtually

28. Plan 1.Duplicate existing functionality of old web interface in new CertWizard 2.Amend policy and extend CertWizard to permit renewing recently expired certificates 3.Permit virtual meetings (VC for example) for Re-Applications 4.Extend CertWizard to allow changing of email addresses 30/03/2012EGI CF Munich28

29. Change requests 30/03/2012EGI CF Munich29 VALID REVOKED Apply Renew Revoke EXPIRED Recent? No Yes Re-Apply Change

30. Change Requests Design Options 1.Permit changing email address at Renewal or as a separate Change process. 2.Should the RA Operator be involved? 3.Should the keys and expiry remain the same? 30/03/2012EGI CF Munich30

31. Plan 1.Duplicate existing functionality of old web interface in new CertWizard 2.Amend policy and extend CertWizard to permit renewing recently expired certificates 3.Permit virtual meetings (VC for example) for Re-Applications 4.Extend CertWizard to allow changing of email addresses 5.Integrate CertWizard functionality with our existing MyProxy and VOMS tools 30/03/2012EGI CF Munich31

32. Seamless Interworking Integrated with MyProxyUploader, our previous proxy generation tool Uploading to MyProxy servers Local Proxies Add VOMS attributes 30/03/2012EGI CF Munich32

33. Export/Backup 30/03/2012EGI CF Munich33

34. Install 30/03/2012EGI CF Munich34

35. Configuration CA Certificates MyProxy servers VOMS servers Your Certificate 30/03/2012EGI CF Munich35

36. MyProxyUploader 30/03/2012EGI CF Munich36

37. Local Proxy 30/03/2012EGI CF Munich37

38. VOMS attributes 30/03/2012EGI CF Munich38

39. Additional work Provide an RA Operator interface Bulk Host Certificate Request interface Support for Host Certificates in CertWizard Online CA 30/03/2012EGI CF Munich39

40. Summary Implemented a Certificate request tool Integrated it with our existing MyProxy tool Will allow renewal of recently-expired certificates Introduced the idea of a Re-Application Permit virtual meetings for Re-Applications Designing a Change mechanism for email addresses Less hassle for Users Less work for RA Operators Looking ahead to an online CA 30/03/2012EGI CF Munich40

41. Acknowledgements Jens Jensen and David Meredith NGS STFC 30/03/2012EGI CF Munich41 The next NGS Seminar will be by Josh Howlett of JANET and will be entitled: "Moonshot - next generation federated identity" http://www.ngs.ac.uk/news/ngs-seminar-series-february-2012

42. Certificate Lifecycle 30/03/2012EGI CF Munich42 VALID Approved New ArchivedDeleted Renew

43. CSR Lifecycle 30/03/2012EGI CF Munich43 VALID Approved New Archived Deleted Renew Signing RA Approval CSRCertificate

44. CSR Lifecycle 30/03/2012EGI CF Munich44 Renewal Approved Archived New Deleted

45. Revocation Lifecycle 30/03/2012EGI CF Munich45 SUSPENDED Approved SUSPENDED RA User CA Deleted CSR Other RA Signing RA

46. The Revoke Process 30/03/2012EGI CF Munich46 User Makes Revocation Request CA Signs RA Makes Revocation Request Another RA makes Revocation Request RA Approves Request