1. KISTI CA Report Status & Self-Audit
For KISTI Certification Authority

2. KISTI CA Overview
Subject: C=KR, O=KISTI, CN=KISTI Certification Authority
Valid from Apr 14, 2017 until Apr 9, 2037 (20 years)
Signature algorithm: SHA-256 (CA Key size: 4096 bits)
Online repository:
Deployed upon IPv6:
Contact:

3. Operation status Subscribers Certificates
Total number of subscribers: 342
Total number of institutes: 50
Certificates
Total number of certificates: 62
Total number of issued certificates: 54 (user:29, host:25)
Total number of revoked certificates: 8 (user:5, host:3)
New in 2018: 1 user, 2 hosts

4. Self-Audit overview Auditing References
IGTF CAs auditing Checklist version 1 : CA – 55, RA – 12
IGTF PKI Technology Guidelines Version
Assurance Assessment-v
Overall Scoring: CA – A(51), D(4) / RA – A(12)
D (must change) : CA (16, 43, 45, 47)
Logs and archive of them in issuing system are configured by default to be kept for one month; the system must be re-configured to keep all logs and their archives
Self-Audit should be performed at least once a year

5. D (must chaNge) - CA (16, 43, 45, 47)
(16) The CA must record and archive all requests for certificates, along with the issued certificates, all the requests for revocation, all the issued CRLs and the login, logout, start-up, and shutdown of the issuing system
(43) The CA must record and archive all requests for certificates, along with all the issued certificates, all the requests for revocation, all the issued CRLs and the login, logout, start-up, and shutdown of the issuing system
(45) The Issuing Authority (IA) must keep these records for at least three years
(47) ASPEN, BIRCH, CEDAR: The Issuing Authority (IA) should perform internal operational audits of the Issuing Authority (IA)/RA staff and any underlying systems at least once per year to verify its compliance with the rules and procedures specified in its policies and practices documents

6. Actions required Issuing Machine Internal operational audits
System logs in the issuing system are rotated weekly and only 4 weeks of backlogs are kept
Rotating frequency is changed from weekly to yearly and the number of rotating has been increased up to 20 times, in principle the logs and their archives will be kept at least 20 years from now on
Internal operational audits
Perform self-audit and report the result at least once per year