29 th EUGridPMA meeting, September 2013, Bucharest AEGIS Certification Authority Dušan Radovanović University of Belgrade Computer Centre

Overview Approved June 2007 Issues certificates to Serbian GRID community CP/CPS and root cert updated January 2009 to reflect TLD change to version 1.2 Current CP/CPS version: 1.3 (updated after last self audit) 29 th EUGridPMA meeting, September 2013, Bucharest

CA operation CA operated by the staff of 1 Current RA’s Online web interface operated on main web server Offline certs signing SimplePKI software Security 29 th EUGridPMA meeting, September 2013, Bucharest

Self Audit AEGIS CA Dublin self audit C – 2 B – 3 X – 1 18 th EUGridPMA meeting, Jan 2010, Dublin

Self Audit – CP/CPS 4. - B Whenever there is a change in the CP/CPS the O.I.D. of the document must change and the major changes must be announced to the responsible PMA and approved before signing any certificates under the new CP/CPS. Practice: Every change is announced to the PMA, but this procedure is not documented in CP/CPS Resolution: CP/CPS now states that every change must be approved by the EUGridPMA. 18 th EUGridPMA meeting, Jan 2010, Dublin

Self Audit – EE certificates/keys B Each host certificate must be linked to a single network entity. Practice: CP/CPS does not describe how each host certificate is linked to a single entity. Resolution: CP/CPS now requires that each host certificate is linked to a single network entity. 18 th EUGridPMA meeting, Jan 2010, Dublin

Self Audit – EE certificates/keys 41. / X The authority shall issue X.509 certificates to end entities based on cryptographic data generated by the applicant, or based on cryptographic data that is be held only by the applicant on a secure hardware token. Practice: We do not have support for hardware tokens Resolution: No action as we don’t use hardware tokens. 18 th EUGridPMA meeting, Jan 2010, Dublin

Self Audit – Audits B Every CA must perform operational audits of the CA/RA staff at least once per year. Practice: We do not have an auditing manual and do not audit RA’s. Resolution: Added the statement that RA’s once per year to the CP/CPS. Short outlines of the audit procedures will also be added. 18 th EUGridPMA meeting, Jan 2010, Dublin

Self Audit – Privacy C Accredited CAs must define a privacy and data release policy compliant with the relevant national legislation. The CA is responsible for recording, at the time of validation, sufficient information regarding the subscribers to identify the subscriber. The CA is not required to release such information unless provided by a valid legal request according to national laws applicable to that CA. 18 th EUGridPMA meeting, Jan 2010, Dublin

Self Audit – Privacy Practice: CP/CPS does not define data release policy because there was no law defining this at the time of writing the original CP\CPS. Resolution: Added the statement that AEGIS CA will release private information on judicial order. 18 th EUGridPMA meeting, Jan 2010, Dublin

Self Audit – RA 8. - C The CP/CPS should describe how the RA or CA is informed of changes that may affect the status of the certificate. Practice: CP/CPS does not define this Resolution: The procedure is defined in CP/CPS. 18 th EUGridPMA meeting, Jan 2010, Dublin

Self Audit Guidelines for auditing Grid CA’s v1.0 from February 17 th C – 1 29 th EUGridPMA meeting, September 2013, Bucharest

37. (C) The end entity certificate extensions compliance with Grid Certificate Profile as defined by GFD.125. –The policyidentifier must include the OID or Authentication Profile uncer which the CA was accredited. Practice: Our EE certs don’t have Classic AP OID, only CP/CPS OID and distributuion points. Solution: Classic AP OID will be added to EE certs. 29 th EUGridPMA meeting, September 2013, Bucharest

Self Audit – Conclusion Implement changes to the CP/CPS –Changes from self audit –Changes suggested from reviewers –Revise and update the whole CP/CPS to the new classic AP 29 th EUGridPMA meeting, September 2013, Bucharest

Questions ? Suggestions… 29 th EUGridPMA meeting, September 2013, Bucharest

Thank you! 29 th EUGridPMA meeting, September 2013, Bucharest