MD-Grid CA Valentin Pocotilenco RENAM Association

About RENAM RENAM (Research and Educational Networking Association of Moldova) Was founded and registered by the Ministry of Justice of the Republic of Moldova in June 1999 under registration no Is a republican association with unlimited term of existence and develops its activities on the whole territory of Republic of Moldova, with the right to establish its branches both in the Republic and abroad. The aim of the Association is to establish and develop computer network and information services on a modern level mostly in higher and secondary education, research institutions, libraries and public collections. Web site:

RENAM organization The RENAM Council consists of well-known scientists of Moldova, scientific administrators, information systems and networking specialists, which represents the Academy of Sciences of Moldova, Universities of Moldova, and other scientific and educational institutions. Administrative and technical support of the network operation is organized within RENAM by RENAM Executive managers and Network Operating Center (NOC). The functions of NOC are deal with RENAM network associated projects elaboration and realization, network infrastructure maintenance, technical assistance and users support. Web site:

RENAM network structure RENAM Association has built and permanently develops its own networking infrastructure that allowed creating 12 communication nodes in two main cities – Chisinau and Balti. 23 Institutes of Academy of Sciences, 10 leading Universities of Moldova, more than 10 colleges, 3 hospitals and some governmental establishments are connected now to RENAM infrastructure ( RENAM network provides connectivity to about 5000 scientists and professors (75% of all researchers), 1000 Ph.D. students and more than university and colleges students (85% of all students). RENAM infrastructure provides services to the universities and organizations placed in other localities of Moldova. The network node was realized in Balti State University, which joins also four technical colleges from Balti City.

RENAM goals The main goal of RENAM network consists in continuous development of a modern electronic communication infrastructure capable to connect all research, educational, medical and cultural institutions from Moldova, and to provide them with Internet access services. Another aim of RENAM consists in continuous and active participation in the work of international computer network organizations. Organize seminar and training events to help develop and use NREN infrastructure Create a National Grid Initiative of Moldova (NGI)

RENAM NGI MD-Grid - National Grid Initiative of Moldova was officially inaugurated on the plenary session “National Grid Initiative MD-Grid: presentation and inauguration” of RENAM Users Conference – 2007 on May, after receiving approval letters from Ministry of Information Development of Moldova and the Academy of Sciences of Moldova. The MD-Grid NGI Consortium governed by RENAM as its Coordinating NREN joins 6 research, education and industry institutions that expressed their intent to participate in the processes of National Grid Infrastructure building and using: Research and Educational Networking Association of Moldova Institute of Mathematics and Computer Science of the Academy of Sciences of Moldova Faculty of Radioelectronics and Telecommunications of the Technical University of Moldova Institute of Geology and Seismology of the Academy of Sciences of Moldova State Hydrometeorological Service School of Public Health, State Medical and Pharmaceutical University “N.Testemitanu”.

RENAM involvement SEE-GRID II - SEE-GRID SCI -

MD-Grid CA Used documents: –RomanianGRID CP/CPS –TR-Grid CP/CPS –BG.ACAD CP/CPS –MREN CA CP/CPS Our request to IANA is pending and I suppose we will obtain the OID in a few weeks. Date: March 3-rd 2008

MD-Grid CA Naming Issuer: C=MD, O=RENAM, CN=MD-Grid-CA Subject: C=MD, O=RENAM, OU=XXX, CN=Subject-name [C] Country = MD [O] Organization = RENAM [OU] Organization Unit = Name of the institution [CN] Common Name = Name and surname of the person for the personal certificate, DNS name for host or service certificate (In the last case the DNS FQDN may be prefixed by the value 'host' or the service name separated with a '/' from the DNS FQDN).

MD-Grid CA The values of extensions in case of CA certificate are following: –X509v3 Basic Constraints: critical CA:TRUE –X509v3 Key Usage: critical Certificate Sign, CRL Sign –X509v3 Subject Key Identifier: –X509v3 Authority Key Identifier: keyid: DirName:/C=MD/O=RENAM/CN=MD-Grid-CA serial: –X509v3 Issuer Alternative Name: –X509v3 Subject Alternative Name: –X509v3 CRL Distribution Points –Netscape Cert Type: SSL CA, S/MIME CA, Object Signing CA

MD-Grid CA The values of extensions in case of user certificates are following: –X509v3 Basic Constraints: critical CA:FALSE –X509v3 Key Usage: critical Digital Signature, Key Encipherment, Data Encipherment, Key Agreement, Non-Repuditation. –X509v3 Extended Key Usage: TLS Web Client Authentication, E- mail Protection –X509v3 Subject Key Identifier: –X509v3 Authority Key Identifier: keyid: DirName:/C=MD/O=RENAM/CN=MD-Grid-CA serial: –X509v3 Subject Alternative Name: –X509v3 Issuer Alternative Name: –X509v3 Certificates Policies: Policy: –X509v3 CRL Distribution Points –Netscape Cert Type: SSL Client, S/MIME, Object Signing

MD-Grid CA The values of extensions in case of host and service certificates are following: –X509v3 Basic Constraints: critical CA:FALSE –X509v3 Key Usage: critical Digital Signature, Key Encipherment, Data Encipherment, Key Agreement –X509v3 Extended Key Usage: TLS Web Server Authentication –X509v3 Subject Key Identifier: –X509v3 Authority Key Identifier: keyid: DirName:/C=MD/O=RENAM/CN=MD-Grid-CA serial: –X509v3 Issuer Alternative Name: –X509v3 Subject Alternative Name: DNS:FDQN –X509v3 Certificates Policies: Policy: –X509v3 CRL Distribution Points –Netscape Cert Type: SSL Server

MD-Grid CA –Certificate 1024 bit or 2048 bit encryption; 1 year. –Personal certificate personal contact; id-card, passport or driving license; –Server/Service certificate the host must have a valid DNS name; the administrator must already possess a valid personal MD Grid-CA Certificate; the administrator must provide a proof of his or her relation to the host itself.

MD-Grid CA –Certificate revocation list (CRL): max lifetime of the CRL: 30; issued at least 7 days before expiration; new CRL will be publish as soon as they are updated; –Circumstances for revocation: the CA is informed that the Subscriber has ceased to be a member of or associated with a MREN program or activity; the subscriber’s private key is lost or suspected to be compromised; the information in the Subscriber’s certificate is wrong or inaccurate, or suspected to be wrong or inaccurate; the subscriber violates his/her obligations; the subscriber does not need the certificate any more.

MD-Grid CA – Types of events recorded: certification requests; issued certificates; requests for revocation; issued CRLs; login/logout/reboot of the signing machine. –Each RA must keep log of the following: for each approved request, how it was approved; for each rejected request, why it was rejected; for each approved revocation request, the reason for revocation; for each rejected revocation request, the reason for revocation and the reason the request was rejected.

MD-Grid CA Types of records archived –The following data and files are recorded and archived by the CA: certification requests; issued certificates; requests for revocation; issued CRLs; all messages of correspondence between RA and CA. –Each RA must keep log of the following: for each approved request, how it was approved; for each rejected request, why it was rejected; for each approved revocation request, the reason for revocation; for each rejected revocation request, the reason for revocation and the reason the request was rejected.

MD-Grid CA Physical controls The MD-Grid CA will operate in a controlled and protected room located in Technical University of Moldova. At least one person employed by RENAM Association will always be present on premises 24 hours per day, 7 days per week. Physical access to the MD-Grid CA is restricted to authorized personnel only. Technical University of Moldova premises have a fire alarm system installed, secured access, provided by a particular organization and equipment is maintained in cooled rack’s.

Certification Authority Contact details Research and Educational Networking Association of Moldova 5, Academiei str. room 331. Chishinau, Moldova, Republic of. Phone: Phone: Fax: Fax: Valentin Pocotilenco