1. J Jensen, STFC Chief Soapbox Officer 23 May 2017DR
J Jensen, STFC
Chief Soapbox Officer
23 May 2017

2. CA services From an old UK eSc CA doc Description Base address Av Int
Description
Base address Av
Int
Conf
Prod S0
Network (not part of CA but online services depend on it)
N/A 3 1 S1
CA web site, containing repository information, documentation, CP/CPS, and other documents
rview 2 4 S2
Helpdesk
support.ac.uk S3
Contact addresses
e.g., support.ac.uk S4
CRL server
crl.ca.ngs.ac.uk
(web1.ca.ngs.ac.uk)
ca.grid-support.ac.uk S5
Online request service
support.ac.uk/ 8 S6
Renewal and admin (RA) interface
support.ac.uk/

3. CA services Description Base address Av Int Conf Prod S7
Description
Base address Av
Int
Conf
Prod S7
CA Operator interface
support.ac.uk/ 1 2 3 6 S8
Online server database
N/A 18 S9
A notification service which sends to people
S10
Offline signing service 9
S11
Offline RA database (letters archive)
S12
DNS/Internal
Can store or cache locally
S13
DNS/External
S14
Web start host

4. CA services Description Base address Av Int Conf Prod P1
Description
Base address Av
Int
Conf
Prod P1
People: signing operators P2
People: support staff P3
People: policy/admin
S17
People: software support

5. Protecting a
Root key

6. Protecting a Root Key # physical copies? How they are encrypted?
Where they are physically stored?
Off site?
Who can release the key?
What is required to release the key?
E.g. m-of-n, such as SSSS (which needs some thought)
How to keep knowledge, testing?
E.g. root CRL issuance
Frequency of doing so