CNRS GRID-FR CA Sophie Nicoud

2Prenom nom – nom presentation – date GRID-FR CNRS CA  Objectif : Remplacer la « vielle » CA Datagrid-fr Avec des nouvelles spécificités: s Extensions X509v3 s Traduction complète des pages et des formulaires s Ajout d’extensions UNICORE s Signature avec SHA1 s Nouveaux sujets de certificats En accords avec les nouvelles règles de EUGridPMA  Une sous-CA dédiée aux : Projets de GRID dans lesquels le CNRS ou des instituts Français sont impliqués s EGEE, LCG, … DEISA, …, Grid 5000, …, E-Sciences,…  Validités des CA : CNRS: 2048 bits, Valid 20 years CNRS-Projets: 2048 bits, Valid 10 years GRID-FR: 2048 bits, Valid 10 years

3Prenom nom – nom presentation – date Datagrid-fr Statistiques  Certificats valident au 21 th January 2005  certificats issus depuis Juin 2001  Avant il y avait CNRS-Test CA

4Prenom nom – nom presentation – date End Entities  End entities : Instituts publics Français ou companies privées* No HEP public instituts or private companies which have not a National CA* s * involved in GRID project with the CNRS or French research institutes  Types of certificates issued : Personal, Host, Service  Validity : From 1 day to 1 year max  Keys size : 1024 or 2048 bits  Subject : / O=GRID-FR /C=Country/O=Institut/OU=Unit/CN=Firstname Familyname/ Address= / O=GRID-FR /C=Country/O=Institut/OU=Unit/CN=Name of the host/ Address= admin / O=GRID-FR /C=Country/O=Institut/OU=Unit/CN=Name of service/ Address= admin CP-CPS v 0.5

5Prenom nom – nom presentation – date CRL  As soon as a certificate is revoked, a CRL is issued  Valid for 1 month  Re-issued each night  Stored in a repository dedicated to the GRID-FR CA To avoid overload of the machine and the network due to the many download of the GRID sites

6Prenom nom – nom presentation – date Operations  The machines of the CNRS PKI is operated by the Direction of the System of Information (DSI/CNRS) in Toulouse DSI/CNRS is the administration computer center of the CNRS located in Paris and Toulouse  The CNRS PKI is in control of the UREC/CNRS in Grenoble  There is 2 Registrations Authorities for GRID-FR CA : Edith, Sophie from UREC/CNRS in Marseille  The CNRS CA software has been written and is maintained by UREC/CNRS UREC is the Unit of the Networks of the CNRS located in Paris, Grenoble, Lyon and Marseille

7Prenom nom – nom presentation – date RA organisation  Now, 2 RAs One RA Manager and one RA They are 2 persons of the UREC/CNRS  Only these 2 RAs can request, to the CA, creation and revocation of certificate via the RA site  In each unit there’s a local representative of the RA  This local representative is chosen by the RA Manager  The access to the RA site is protected by IP adresses and personal certificate  The RAs have a personal certificate issued by the CNRS-Plus CA  The RA and RA Manager work with the CNRS CA Committee

8Prenom nom – nom presentation – date Certificate request procedure  User requests a personal certificate via the CA web site  He fills the forms : First and last names, , phone number, unit, institute, key size Units and institutes are chosen in a list defined  The key pair is generated by his browser  The public key is taken by the CA via CGI  The user receives receipt by , he has to reply to confirm his request

9Prenom nom – nom presentation – date Request verification  The RA receives an of information  The RA has to verify That no certificate with a small difference has already been issued The personal information (name, , phone …) The job information s Unit, institute, s duration of the user contract, s participation of the user in GRID project  The RA requests the creation of the certificate by signing the request with his CNRS-Plus certificate

10Prenom nom – nom presentation – date Acquisition of the certificate  The user receives a notification containing an URL to get his certificate on the CA web portal  He can get his certificate only if he has the private key associated.

11Prenom nom – nom presentation – date Host and service certificate  To request a host or service certificate, the user must own a personal certificate  The unit and the institute of the requesting certificate are built from the unit/institute of the user certificate  The RA verifies the request  The certificate is sent by crypted and signed to the user The address is deduced from the user certificate

12Prenom nom – nom presentation – date Migration…  La CA GRID-FR a été accréditée par EUGridPMA fin Janvier 2005  Depuis, nous émettons des certificats avec une validité inférieure à 1 an  Tests des nouveaux certificats effectués: En interne au CPPM Avec le RB du LAL Souhaits d’effectuer des tests avec le CC => Tests concluant  Les RPMs v 27-1 sont distribuées par EUGridPMA depuis Février LCG depuis Mars  Problèmes rencontrés: Distribution des nouveaux RPMs difficile Tests de monitoring des sites SA1, ne prennentpas en compte la nouvelle version  => Pas d’utilisation correcte possible de la nouvelle CA

13Prenom nom – nom presentation – date Migration…  Lorsque les RPMs seront complètement diffusées Demande de certificats GRID-FR s Nous les préviendrons, on le fera par labo Demande de ré-inscription à leur VO préférée s Les VOs admins sont déjà prévenus s Nous enverrons, à chaque nouveaux certificat émis, n Un mail aux VO admins n Un mail Maria Dimou (admin de la VO auth) n Un mail à l’utilisateur  Revoke all certificate before the end of the year 2005  Revoke the Datagrid-fr CA certificate start of year 2006