Sam Morrison APAC CA – APGridPMA - ISGC2010 APAC CA Self Audit and status update Sam Morrison ARCS

Sam Morrison APAC CA – APGridPMA - ISGC2010 Info APAC Certification Authority – Classic CA Profile – Accredited Feb 2006 – Lifetime 10 years – Expires 2016 – Now run by ARCS, CA Location - Melbourne AUS Software – OpenCA (old version)

Sam Morrison APAC CA – APGridPMA - ISGC2010 Status People – 3 CA Staff (Sam, Andy, Russell) – 47 RA Operators Issued (to date) – 942 User – 1294 Host

Sam Morrison APAC CA – APGridPMA - ISGC2010 Current Valid Certificates User : 179 Web Server : 329 RA Operators: 37 Total 544 (2 CA Operators)

Sam Morrison APAC CA – APGridPMA - ISGC2010 Issuing Trend

Sam Morrison APAC CA – APGridPMA - ISGC2010 Self Audit Using guidelines for Auditing Grid CAs version 1.0

Sam Morrison APAC CA – APGridPMA - ISGC B The profile of the end entity certificates must also comply with the current IGTF and OGF certificate profile guidelines before being included in any distribution of certificates. – CPS wasn't changed to show changes to End Entity certs in relation to extra OIDs – Certificates were changed just not reflected in CPS

Sam Morrison APAC CA – APGridPMA - ISGC2010 B - 56 A list of CA and RA personal should be maintained and verified at least once per year. CA Staff have changed – Manager changed from David Bannon to myself. (section 1.3) RA Operator list needs to be verified more frequently

Sam Morrison APAC CA – APGridPMA - ISGC C The message digests of the certificates and CRLs must be generated by a trustworthy mechanism, like SHA1 (in particular, MD5 must not be used). – Still using MD5 (1 of a couple Cas still out there) – Still working on modifying software to deal with this.

Sam Morrison APAC CA – APGridPMA - ISGC D The pass phrase of the encrypted private key must also be kept on off-line media, separated from the encrypted private keys and guarded in a secure location where only the authorised personnel of the CA have access. Alternatively, another documented procedure that is equally secure may be used. – Wasn't the case. (Was destroyed when we replaced safes) – Is now back in place

Sam Morrison APAC CA – APGridPMA - ISGC2010 X - 8 The CP/CPS documents should be structured as defined in RFC – Still use 2527 – No plan to change

Sam Morrison APAC CA – APGridPMA - ISGC2010 X - 49 Certificates associated with a private key residing solely on hardware token may be renewed for a validity period of up to 5 years (for equivalent RSA key lengths of 2048 bits) or 3 years (for equivalent RSA key lengths of 1024 bits). – Don't provide specific support for hardware tokens

Sam Morrison APAC CA – APGridPMA - ISGC2010 Self Audit Summary 71 As 2 Bs 1 C 1 D 2 Xs

Sam Morrison APAC CA – APGridPMA - ISGC2010 Updated CPS - V – Change APAC to ARCS 1.3 – Change manager to Sam Morrison, Change APAC to ARCS 1.4 – Change contact – Add New OIDs to certificate extentions