CERTIFICATION PRACTICE
STATEMENT
Table of Contents:
Table
of Contents:............................................................................................................................................................................. 2
1. INTRODUCTION..................................................................................................................................................................................... 7
1.1 Overview.......................................................................................................................................................................................... 7
1.2 Document name and identification............................................................................................................................. 7
1.3 PKI participants......................................................................................................................................................................... 8
1.3.1 Certification Authorities......................................................................................................................................................... 8
1.3.2 Registration authorities.......................................................................................................................................................... 8
1.3.3 Subscribers................................................................................................................................................................................ 8
1.3.4. Relying parties......................................................................................................................................................................... 8
1.3.5 Other participants.................................................................................................................................................................... 8
1.4 Certificate usage...................................................................................................................................................................... 8
1.4.1 Appropriate certificate uses................................................................................................................................................... 8
1.4.2 Prohibited certificate uses...................................................................................................................................................... 8
1.5 Policy administration........................................................................................................................................................... 9
1.5.1 Organization administering the document......................................................................................................................... 9
1.5.2 Contact person......................................................................................................................................................................... 9
1.5.3 Person determining CPS suitability for the policy............................................................................................................ 9
1.5.4 CPS approval procedures...................................................................................................................................................... 9
1.6 Definitions and acronyms.................................................................................................................................................. 9
2 PUBLICATION AND REPOSITORY RESPONSIBILITIES.......................................................................................................... 10
2.1 Repositories................................................................................................................................................................................. 10
2.2 Publication of certification
information............................................................................................................ 10
2.3 Time or frequency of publication................................................................................................................................ 11
2.4 Access control on repositories..................................................................................................................................... 11
3 IDENTIFICATION AND AUTHENTICATION................................................................................................................................... 11
3.1 Naming............................................................................................................................................................................................ 11
3.1.1 Types of names........................................................................................................................................................................ 11
3.1.2 Need for names to be meaningful........................................................................................................................................ 11
3.1.3 Anonymity or pseudonimity of subscribers....................................................................................................................... 11
3.1.4 Rules for interpreting various name forms........................................................................................................................ 12
3.1.5 Uniqueness of names............................................................................................................................................................. 12
3.1.6 Recognition, authentication, and role of trademarks.................................................................................................... 12
3.2 Initial identity validation............................................................................................................................................... 12
3.2.1 Method to prove possession of a key.................................................................................................................................. 12
3.2.2 Authentication of organization identity............................................................................................................................ 12
3.2.3 Authentication of individual entity.................................................................................................................................... 12
3.2.4 Non-verified subscriber information.................................................................................................................................. 12
3.2.5 Validation of Authority......................................................................................................................................................... 13
3.2.6 Criteria of interoperation.................................................................................................................................................... 13
3.3 Identification and
authentication for re-key requests............................................................................. 13
3.3.1 Identification and authentication for routine re-key...................................................................................................... 13
3.3.2 Identification and authentication for re-key after revocation...................................................................................... 13
3.4 Identification and
authentication for revocation request................................................................... 13
4 CERTIFICATE LIFE-CYCLE OPERATIONAL REQUIREMENTS................................................................................................ 13
4.1 Certificate application...................................................................................................................................................... 13
4.1.1 Who can submit a certificate application......................................................................................................................... 13
4.1.2 Enrollment process and responsibilities........................................................................................................................... 14
4.2 Certificate application
processing............................................................................................................................ 14
4.2.1 Performing identification and authentication functions............................................................................................... 14
4.2.2 Approval or rejection of certificate applications............................................................................................................ 14
4.2.3 Time to process certificate applications............................................................................................................................ 14
4.3 Certificate issuance............................................................................................................................................................. 15
4.3.1 CA actions during certificate issuance.............................................................................................................................. 15
4.3.2 Notification
to subscriber by the CA of issuance of certificate..................................................................................... 15
4.4 Certificate acceptance...................................................................................................................................................... 15
4.4.1 Conduct constituting certificate acceptance................................................................................................................... 15
4.4.2 Publication of the certificate by the CA............................................................................................................................ 15
4.4.3 Notification of certificate issuance by the CA to other entities.................................................................................... 15
4.5 Key pair and certificate usage...................................................................................................................................... 15
4.5.1 Subscriber private key and certificate usage................................................................................................................... 15
4.5.2 Relying party public key and certificate usage............................................................................................................... 16
4.6 Certificate renewal............................................................................................................................................................. 16
4.6.1 Circumstance for certificate renewal................................................................................................................................. 16
4.6.2 Who may request renewal..................................................................................................................................................... 16
4.6.3 Processing certificate renewal requests............................................................................................................................ 16
4.6.4 Notification of new certificate issuance to subscriber.................................................................................................... 16
4.6.5 Conduct constituting acceptance of a renewal certificate............................................................................................ 16
4.6.6 Publication of the renewal certificate by the CA............................................................................................................. 16
4.6.7 Notification of certificate issuance by the CA to other entities.................................................................................... 16
4.7 Certificate re-key................................................................................................................................................................... 16
4.7.1 Circumstances for certificate re-key................................................................................................................................... 16
4.7.2 Who may request certification of a new public key......................................................................................................... 17
4.7.3 Processing certificate re-keying requests......................................................................................................................... 17
4.7.4 Notification of new certificate issuance to subscriber.................................................................................................... 17
4.7.5 Conduct constituting acceptance of a re-keyed certificate........................................................................................... 17
4.7.6 Publication of the re-keyed certificate by the CA............................................................................................................ 17
4.7.7 Notification of certificate issuance bby the CA to other entities.................................................................................. 17
4.8 Certificate modification................................................................................................................................................... 17
4.8.1 Circumstances for certificate modification....................................................................................................................... 17
4.8.2 Who may request certificate modification......................................................................................................................... 17
4.8.3 Processing certificate modification requests.................................................................................................................... 17
4.8.4 Notification of new certificate issuance to subscriber.................................................................................................... 17
4.8.5 Conduct constituting acceptance of modified certificate.............................................................................................. 17
4.8.6 Publication of the modified certificate by the CA............................................................................................................ 17
4.8.7 Notification of certificate issuance by the CA to other entities.................................................................................... 17
4.9 Certificate revocation and
suspension................................................................................................................... 18
4.9.1 Circumstances for revocation.............................................................................................................................................. 18
4.9.2 Who can request revocation................................................................................................................................................ 18
4.9.3 Procedure for revocation request....................................................................................................................................... 18
4.9.4 Revocation request grace period........................................................................................................................................ 18
4.9.5 Time within which CA must process the revocation request......................................................................................... 18
4.9.6 Revocation checking requirement for relying parties.................................................................................................... 18
4.9.7 CRL issuance frequency........................................................................................................................................................ 18
4.9.8 Maximum latency for CRLs.................................................................................................................................................. 18
4.9.9 On-line revocation/status checking availability............................................................................................................. 18
4.9.10 On-line revocation checking requirements.................................................................................................................... 18
4.9.11 Other forms of revocation advertisements available.................................................................................................... 19
4.9.12 Special requirements re key compromise........................................................................................................................ 19
4.9.13 Circumstances for suspension........................................................................................................................................... 19
4.9.14 Who can request suspension.............................................................................................................................................. 19
4.9.15 Procedure for suspension request.................................................................................................................................... 19
4.9.16 Limits on suspension period.............................................................................................................................................. 19
4.10 Certificate status services............................................................................................................................................ 19
4.10.1 Operational characteristics.............................................................................................................................................. 19
4.10.2 Service availability............................................................................................................................................................. 19
4.10.3 Optional features................................................................................................................................................................. 19
4.11 End of subscription.............................................................................................................................................................. 19
4.12 Key escrow and recovery................................................................................................................................................ 19
4.12.1 Key escrow and recovery policy and practices............................................................................................................. 19
4.12.2 Session key encapsulation and recovery policy and practices.................................................................................. 19
5 FACILITY, MANAGEMENT, AND OPERATIONAL CONTROLS............................................................................................... 20
5.1 Physical controls.................................................................................................................................................................. 20
5.1.1 Site location and construction............................................................................................................................................ 20
5.1.2 Physical access....................................................................................................................................................................... 20
5.1.3 Power and Air Conditioning............................................................................................................................................... 20
5.1.4 Water Exposures..................................................................................................................................................................... 20
5.1.5 Fire Prevention and Protection.......................................................................................................................................... 20
5.1.6 Media storage......................................................................................................................................................................... 20
5.1.7 Waste Disposal....................................................................................................................................................................... 20
5.1.8 Off-site Backup....................................................................................................................................................................... 20
5.2 Procedural controls........................................................................................................................................................... 20
5.2.1 Trusted roles........................................................................................................................................................................... 20
5.2.2 Number of persons required per task................................................................................................................................. 20
5.2.3 Identification and authentication for each role.............................................................................................................. 20
5.2.4 Roles requiring separation of duties.................................................................................................................................. 20
5.3 Personnel controls............................................................................................................................................................... 21
5.3.1 Qualifications, experience and clearance requirements................................................................................................ 21
5.3.2 Background check procedures........................................................................................................................................... 21
5.3.3 Training requirements.......................................................................................................................................................... 21
5.3.4 Retraining frequency and requirements............................................................................................................................ 21
5.3.5 Job rotation frequency and sequence................................................................................................................................ 21
5.3.6 Sanctions for unauthorized actions................................................................................................................................... 21
5.3.7 Independent contractor requirements............................................................................................................................... 21
5.3.8 Documentation supplied to personnel............................................................................................................................... 21
5.4 Audit logging procedures.................................................................................................................................................. 21
5.4.1 Types of events recorded....................................................................................................................................................... 21
5.4.2 Frequency of processing log................................................................................................................................................ 21
5.4.3 Retention period for audit log............................................................................................................................................. 22
5.4.4 Protection of audit log.......................................................................................................................................................... 22
5.4.5 Audit log backup procedures.............................................................................................................................................. 22
5.4.6 Audit collection system (internal vs. external)................................................................................................................ 22
5.4.7 Notification to event-causing subject................................................................................................................................ 22
5.4.7 Notification to event-causing subject................................................................................................................................ 22
5.4.8 Vulnerability assessments.................................................................................................................................................... 22
5.5 Records archival.................................................................................................................................................................... 22
5.5.1 Types of records archived..................................................................................................................................................... 22
5.5.2 Retention Period for Archive............................................................................................................................................... 22
5.5.3 Protection of Archive............................................................................................................................................................ 22
5.5.4 Archive backup procedures................................................................................................................................................. 23
5.5.5 Requirements for time-stamping of records....................................................................................................................... 23
5.5.6 Archive collection system (internal or external)............................................................................................................. 23
5.5.7 Procedures to obtain and verify archive information..................................................................................................... 23
5.6 Key changeover........................................................................................................................................................................ 23
5.7 Compromise and Disaster Recovery............................................................................................................................ 23
5.7.2 Computing resources, software, and/or data are corrupted......................................................................................... 23
5.7.3 Entity private key compromise procedures....................................................................................................................... 23
5.7.4 Business continuity capabilities after a disaster............................................................................................................. 23
5.8 CA or RA Termination........................................................................................................................................................... 23
6. TECHNICAL SECURITY CONTROLS............................................................................................................................................. 24
6.1 Key Pair Generation and
Installation..................................................................................................................... 24
6.1.1 Key Pair Generation............................................................................................................................................................. 24
6.1.2 Private key delivery to subscriber...................................................................................................................................... 24
6.1.3 Public key delivery to certificate issuer............................................................................................................................ 24
6.1.4 CA public key delivery to relying parties......................................................................................................................... 24
6.1.5 Key Sizes.................................................................................................................................................................................. 24
6.1.6 Public key parameters generation..................................................................................................................................... 24
6.1.7 Key usage
purposes (as per X.509 v3 key usage field)................................................................................................... 24
6.2 Private key protection and
cryptographic module engineering controls...................................... 25
6.2.1 Cryptographic module standards and controls............................................................................................................... 25
6.2.2 Private key (n out of m) multi-person control.................................................................................................................. 25
6.2.3 Private key escrow................................................................................................................................................................. 25
6.2.4 Private key backup................................................................................................................................................................ 25
6.2.5 Private key archival.............................................................................................................................................................. 25
6.2.6 Private key transfer into or from a cryptographic module............................................................................................ 25
6.2.7 Private key storage on cryptographic module................................................................................................................. 25
6.2.8 Method of activating private key........................................................................................................................................ 25
6.2.9 Method of deactivating private key................................................................................................................................... 25
6.2.10 Method of destroying private key..................................................................................................................................... 25
6.2.11 Cryptographic Module Rating......................................................................................................................................... 25
6.3 Other Aspects of Key Pair
Management................................................................................................................... 25
6.3.1 Public Key Archival.............................................................................................................................................................. 25
6.3.2 Certificate
operational periods and key pair usage periods........................................................................................ 26
6.4 Activation Data...................................................................................................................................................................... 26
6.4.1 Activation data generation and installation................................................................................................................... 26
6.4.2 Activation data protection................................................................................................................................................... 26
6.4.3 Other aspects of activation data......................................................................................................................................... 26
6.5 Computer security controls........................................................................................................................................... 26
6.5.1 Specific computer security technical requirements......................................................................................................... 26
6.5.2 Computer security rating..................................................................................................................................................... 26
6.6 Life Cycle technical controls........................................................................................................................................ 26
6.6.1 System development controls............................................................................................................................................... 26
6.6.2 Security management controls............................................................................................................................................ 26
6.6.3 Life cycle security controls................................................................................................................................................... 26
6.7 Network Security Controls............................................................................................................................................. 27
6.8 Time stamping............................................................................................................................................................................ 27
7. CERTIFICATE, CRL AND OCSP PROFILES.................................................................................................................................. 27
7.1 Certificate Profile................................................................................................................................................................. 27
7.1.1 Version Number...................................................................................................................................................................... 27
7.1.2 Certificate Extensions........................................................................................................................................................... 27
7.1.3 Algorithm Object Identifiers................................................................................................................................................. 27
7.1.4 Name Forms............................................................................................................................................................................ 27
7.1.5 Name constraints................................................................................................................................................................... 28
7.1.6 Certificate Policy Object Identifier..................................................................................................................................... 28
7.1.7 Usage of Policy Constraints extension.............................................................................................................................. 28
7.1.8 Policy qualifiers syntax and semantics.............................................................................................................................. 28
7.1.9 Processing semantics for the critical Certificate Policies extension........................................................................... 28
7.2 CRL profile.................................................................................................................................................................................... 28
7.2.1 Version number(s)................................................................................................................................................................. 28
7.2.2 CRL and CRL entry extensions............................................................................................................................................ 28
7.3 OCSP profile................................................................................................................................................................................. 28
7.3.1 Version number(s)................................................................................................................................................................. 28
7.3.2 OCSP extensions.................................................................................................................................................................... 28
8 COMPLIANCE AUDIT AND OTHER ASSESSMENTS.................................................................................................................. 29
8.1 Frequency or circumstances of
assessment........................................................................................................ 29
8.2 Identity/qualifications of assessor.......................................................................................................................... 29
8.3 Assessor's relationship to
assessed entity........................................................................................................... 29
8.4 Topics covered by assessment......................................................................................................................................... 29
8.5 Actions taken as a result of
deficiency................................................................................................................. 29
8.6 Communication of results............................................................................................................................................... 29
9 OTHER BUSINESS AND LEGAL MATTERS................................................................................................................................... 29
9.1 Fees.................................................................................................................................................................................................... 29
9.1.1 Certificate issuance or renewal fees................................................................................................................................... 29
9.1.2 Certificate access fees........................................................................................................................................................... 29
9.1.3 Revocation or status information access fees................................................................................................................... 29
9.1.4 Fees for other services........................................................................................................................................................... 30
9.1.5 Refund policy.......................................................................................................................................................................... 30
9.2 Financial responsibility..................................................................................................................................................... 30
9.2.1 Insurance coverage............................................................................................................................................................... 30
9.2.2 Other assets............................................................................................................................................................................. 30
9.2.3 Insurance or warranty coverage for end-entities............................................................................................................ 30
9.3 Confidentiality of business information................................................................................................................................ 30
9.3.1 Scope of confidential information...................................................................................................................................... 30
9.3.2 Information not within the scope of confidential information...................................................................................... 30
9.3.3 Responsibility to protect confidential information......................................................................................................... 30
9.4 Privacy of personal information................................................................................................................................ 30
9.4.1 Privacy plan............................................................................................................................................................................ 30
9.4.2 Information treated as private............................................................................................................................................. 30
9.4.3 Information not deemed private.......................................................................................................................................... 30
9.4.4 Responsibility to protect private information.................................................................................................................. 30
9.4.5 Notice and consent to use private information................................................................................................................ 31
9.4.6 Disclosure pursuant to judicial or administrative process............................................................................................ 31
9.4.7 Other information disclosure circumstances.................................................................................................................... 31
9.5 Intellectual property rights......................................................................................................................................... 31
9.6 Representations and warranties............................................................................................................................... 31
9.6.1 CA representations and warranties................................................................................................................................... 31
9.6.2 RA representations and warranties.................................................................................................................................... 31
9.6.3 Subscriber representations and warranties..................................................................................................................... 31
9.6.4 Relying party representations and warranties................................................................................................................ 31
9.6.5 Representations and warranties of other participants................................................................................................... 31
9.7 Disclaimers of warranties.............................................................................................................................................. 31
9.8 Limitations of liability...................................................................................................................................................... 31
9.9 Indemnities.................................................................................................................................................................................. 32
9.10 Term and termination....................................................................................................................................................... 32
9.10.1 Term........................................................................................................................................................................................ 32
9.10.2 Termination.......................................................................................................................................................................... 32
9.10.3 Effect of termination and survival.................................................................................................................................... 32
9.11 Individual notices and
communications with participants.................................................................. 32
9.12 Amendments............................................................................................................................................................................. 32
9.12.1 Procedure for amendment.................................................................................................................................................. 32
9.12.2 Notification mechanism and period................................................................................................................................. 32
9.12.3 Circumstances under which OID must be changed....................................................................................................... 32
9.13 Dispute resolution provisions...................................................................................................................................... 32
9.14 Governing law......................................................................................................................................................................... 33
9.15 Compliance with applicable law............................................................................................................................... 33
9.16 Miscellaneous provisions................................................................................................................................................ 33
9.16.1 Entire agreement................................................................................................................................................................. 33
9.16.2 Assignment............................................................................................................................................................................ 33
9.16.3 Severability........................................................................................................................................................................... 33
9.16.4 Enforcement (attorneys' fees and waiver of rights)....................................................................................................... 33
9.16.5 Force Majeure...................................................................................................................................................................... 33
9.17 Other provisions...................................................................................................................................................................... 33
1. INTRODUCTION
This document
describes the rules and procedures used by the AEGIS Certification Authority.
1.1 Overview
AEGIS (Academic and Educational Grid Initiative of Serbia) has
been established on April 14, 2005. The main focus of AEGIS is:
·
coordinate
efforts to further develop academic and high performance computing facilities
and help them integrate into AEGIS;
·
organize
dissemination and training activities and help Serbian research communities to
develop and deploy applications that use AEGIS infrastructure;
·
coordinate
fund raising efforts to improve AEGIS infrastructure and human resources;
·
facilitate
wider participation of AEGIS members in Framework 6, Framework 7, and other
international GRID projects;
·
create
a national GRID development policy;
Any additional information can be obtained at: http://aegis.phy.bg.ac.rsyu/
In order to stregthen AEGIS infrastructure and facilitate its efficient
usage by Serbian research community, as well as to allow full integration of
our user community and computing resources into the pan-European and other Grid
infrastructures, it was necessary to establish AEGIS Certification Authority.
The AEGIS CA will provide security infrastructure needed for the operation of
all AEGIS resources and authentication of all AEGIS users, hosts and services.
This document is a combined certification policy and certificate
practice statement. It describes the set of procedures followed by the AEGIS
Certification Authority (CA) in issuing certificates as well as the
responsibilities of the involved parties.
The AEGIS CA is operated at the premises of University of Belgrade
Computer Center.
This document
is structured according to RFC 3647.
This document
was issued on 04.03.2007, and took effect on 01.06.2007..
1.2 Document name and identification
Document
title: AEGIS CA Certificate Policy and Certification Practice Statement
Document
version: Version 1.21
Document date:
0410.03.20072009.
ASN.1 Object
Identifier (OID): 1.3.6.1.4.1.23658.10.1.1.21
The next table describes the meaning of the OID:
|
1.3.6.1.4.1 |
Prefix for IANA private enterprises |
|
23658 |
|
|
10 |
Certification
Authorities |
|
1 |
CP/CPS |
|
1. |
Major and
minor CP/CPS number. |
1.3 PKI participants
1.3.1 Certification Authorities
AEGIS
certificates are signed by AEGIS CA. AEGIS CA provides PKI services to the
Serbian academics and research communities who participate in national or international
Grid activities. The AEGIS CA does not issue nor sign certificates to
subordinate CAs.
1.3.2 Registration authorities
The RA
Operators are responsible for verifying Subscribers’ identities and approving
their certificate requests. RA Operators do not issue certificates. The list of
RAs is available on the AEGIS CA website. Each RA will have it’s own web
interface.
1.3.3 Subscribers
The AEGIS CA
issues user (personal), host and service certificates. Subscribers eligible for
certification from
·
Users
and site administrators of Academic and Educational Grid Initiative of Serbia
(AEGIS).
·
Computers
used in activities of Academic and Educational Grid Initiative of Serbia
(AEGIS).
·
Services
or host applications which are running on computers used in Academic and
Educational Grid Initiative of Serbia (AEGIS).
1.3.4. Relying parties
Users of Grid
computing infrastructures that are using the public keys, in certificates signed
by the AEGIS CA for signature verification and/or encryption, will be considered
as relying parties.
1.3.5 Other participants
No
stipulation.
1.4 Certificate usage
1.4.1 Appropriate certificate uses
Personal
certificates can be used to authenticate a user that would like to benefit from
the Grid resources.
Host
certificates can be used to identify computers that have special tasks related
to the Grid activities.
Service
certificates can be used to recognize the host applications and, data or
communication encryption (SSL/TLS).
In addition,
it is permissible to use certificates for email signing.
1.4.2 Prohibited certificate uses
Notwithstanding
the above, using certificates for purposes contrary to Serbian law is
explicitly prohibited.
1.5 Policy administration
1.5.1 Organization administering the document.
The AEGIS CA CP/CPS
document was authored and is administered by the University of Belgrade
Computer Center.
The AEGIS CA
address for operations issues is:
AEGIS
Certification authority
University of
Kumanovska bb
Belgrade 126119
Serbia
Phone: +381
11 3031257
Phone: +381 11 3031258
Fax: +381 11 3031259
e-mail: aegis-ca@aegis-ca.rcub.bg.ac.yu.rs
1.5.2 Contact person
Contact person
for questions related to this document or any other AEGIS CA related issue is:
Dušan
Radovanović
University of
Kumanovska bb
Belgrade 126119
Serbia
Phone: +381
11 3031257
Phone: +381 11 3031258
Fax: +381 11 3031259
e-mail: dusan.radovanovic@rcub.bg.ac.yu.rs
1.5.3 Person determining CPS suitability for the policy
Dušan
Radovanović
University of
Kumanovska BB
Belgrade 126119
Serbia
Phone: +381
11 3031257
Phone: +381 11 3031258
Fax: +381 11 3031259
e-mail: dusan.radovanovic@rcub.bg.ac.yu.rs
1.5.4 CPS approval procedures
No
stipulation.
1.6 Definitions and acronyms
|
AEGIS |
Academic and
Educational Grid Initiative of |
|
ASN.1 |
Abstract Syntax Notation One
(http://asn1.elibel.tm.fr/) |
|
CA |
Certification
Authority |
|
CP/CPS |
Certificate
Policy/Certification Practice Statement |
|
CRL |
Certificate
Revocation List |
|
DNS |
Domain Name
System |
|
FQDN |
Fully
Qualified Domain Name |
|
HTTP |
Hypertext
Transfer Protocol |
|
IANA |
Internet
Assigned Numbers Authority |
|
IP |
Internet
Protocol |
|
OCSP |
Online Certificate Status Protocol |
|
OID |
Object
Identifier |
|
PKI |
Public Key
Infrastructure |
|
RA |
Registration
Authority |
|
RFC |
Request For
Comment |
|
S/MIME |
Secure / Multipurpose Internet Mail Extensions |
|
SEE-GRID |
South East
European GRid-enabled eInfrastructure Development |
|
SSL |
Secure
Sockets Layer |
|
URL |
Uniform
Resource Locator |
|
USB |
Universal
Serial Bus |
2 PUBLICATION AND REPOSITORY RESPONSIBILITIES
2.1 Repositories
The AEGIS CA operates an on-line repository that contains:
·
The
AEGIS CA root certificate
·
User,
Host and Service certificates issued by the CA.
·
Certificate
Revocation Lists (periodically updated)
·
A
copy of the most recent version of this CP/CPS and all previous versions
·
A
list of current operational Registration Authorities.
·
Links
to all trust anchor repositories where
·
Other
relevant information http://aegis-ca.rcub.bg.ac.yu.rs/
The AEGIS CA
communication information for information regarding repositories is:
AEGIS
Certification authority
University of
Kumanovska BB
Belgrade 126119
Serbia
Phone: +381
11 3031257
Phone: +381 11 3031258
Fax: +381 11 3031259
e-mail: aegis-ca@aegis-ca.rcub.bg.ac.yu.rs
2.2 Publication of certification information
See
section 2.1
2.3 Time or frequency of publication
· Certificates will be published as soon as
they are issued.
· The published CRL will have a maximum
lifetime of 30 days and it will be updated no later than 7 days before it’s
expiration date. In case of certificate revocation, the CRL will be updated
immediately following the revocation.
· This CP/CPS will be published whenever it
is updated.
2.4 Access control on repositories
The online repository is maintained on best effort basis and is
available substantially on a 24 hours per day, 7 days per week basis, subject
to reasonable scheduled maintenance.
The AEGIS CA
does not impose any access control on its CP/CPS, issued certificates or CRLs.
3 IDENTIFICATION AND AUTHENTICATION
3.1 Naming
3.1.1 Types of names
The subject names for the certificate applicants
shall follow the X.500 standard:
1. in case of user certificate the subject name must include the persons name
in the CN field;
2. in case of host certificate the subject name must include the DNS FQDN in
the CN field;
3. in case service certificate the subject name must include the service name
and the DNS FQDN separated by a „/“ in the CN field.
3.1.2 Need for names to be meaningful.
The subject name must represent the subscriber in a
way that is easily understandable by humans and must have a reasonable
association with the authenticated name of the subscriber.
3.1.3 Anonymity or pseudonimity of subscribers
3.1.4 Rules for interpreting various name forms
See section
3.1.1.
3.1.5 Uniqueness of names
The subject name included in the CN part of a certificate must be
unique for all certificates issued by the AEGIS CA. These certificates belong
to the same end entity. When essential, extra characters may be affixed to the
original name to guarantee the uniqueness of the subject name.
Private keys must not be shared among end entities.
DNs cannot be recycled.
3.1.6 Recognition, authentication, and role of trademarks
No stipulation.
3.2 Initial identity validation
3.2.1 Method to prove possession of a key
The AEGIS CA
proves possession of the private key that is the companion to the public key in
The AEGIS CA
verifies the possession of the private key relating to certificates requests by
out-of-band, non-technical means at the time of authentication. Such
verification may take the form of a directly posed question to requester. A
cryptographic challenge-response exchange may be used to prove possession of
the private key at any point in time before certification of subscriber.
The AEGIS CA
will not generate the key pair for subscribers and will not accept or retain
private keys generated by subscribers.
3.2.2 Authentication of organization identity
The AEGIS CA authenticates organizations by:
·
Checking that organization is affiliated with AEGIS
Initiative;
·
Contacting the person who represents the
organization in the project.
3.2.3 Authentication of individual entity
Certificate of a person:
The subject should contact personally the RA or CA staff in order
to validate his/her identity. The subject authentication is fulfilled by
providing an official document for personal identification (ID-card, driving
license or a passport), and a valid document proving subject’s relation with an
institute or organization, declaring that the subject is a valid end entity.
Certificate of a host or service:
Host or service certificates can only be requested by the
administrator responsible for the particular host. In order to request a host
or service certificate the following conditions must be met:
1.The host must have a valid FQDN.
2.The administrator must already possess a valid personal
AEGIS certificate.
3.The administrator must provide a proof of his or hers
relation to the host itself.
The subscriber
requesting service from the AEGIS CA must present valid documents for personal
identification (ID-card, driving license or a passport), and a valid document
proving subject’s relation with an institute or organization.
3.2.4 Non-verified subscriber information
During the
initial identity validation the requester's e-mail is not verified. This is
done during the processing of the certificate application as described in
section 4.2.2.
3.2.5 Validation of Authority
No stipulation.
3.2.6 Criteria of interoperation
No stipulation.
3.3 Identification and authentication for re-key requests
3.3.1 Identification and authentication for routine re-key
Expiration warnings will be sent to subscribers before it is re-key
time. Re-key before expiration can be executed by stating a re-key request
signed with the personal certificate of the subscriber. Re-key after expiration
uses completely the same authentication procedure as new certificate. For the
first time and after that once every 3 years, a subscriber must be
authenticated by the RA or CA serving his/her location following the procedure
described in section 3.2.3.
3.3.2 Identification and authentication for re-key after revocation
The procedure for re-key after revocation is exactly the same with
an initial registration.
3.4 Identification and authentication for revocation request
Certificate revocation requests should be authenticated in one of
the following ways:
·
By
signing a revocation request e-mail via a valid personal key corresponding to
the certificate that is requested to be revoked which must be a valid,
non-expired and non-revoked AEGIS certificate.
·
For
persons who do not have a valid AEGIS certificate, but hold an evidence of a
revocation circumstance: by personal authentication as described in 3.2.3
·
If
the revocation request is for a host or service certificate, then the e-mail
must be signed by the private key corresponding to the certificate of the
person responsible of the host or service. When e-mail is not an option, the
request will be authenticated using the procedure described in section 3.2.3.
·
Revocation
request by the RA should be done by e-mail, signed with valid RA operator key.
4 CERTIFICATE LIFE-CYCLE OPERATIONAL REQUIREMENTS
4.1 Certificate application
4.1.1 Who can submit a certificate application
The applicant must:
1.
be
an acceptable subscriber as stated in section 1.3.3
2.
read
and adhere to all of the statements of this document
3.
generate
a key-pair using a trustworthy method. The private key must be at least 1024 bits
and the exponent must be greater than 3.
4.
use
a strong passphrase of at least 12 characters
5.
User certificate: For the first time and
after that once every 3 years, a subscriber must be authenticated by the RA or
CA serving his/her location following the procedure described in section 3.2.3.
The submission of the certificate requests will be done via an SSL secured web
form or via e-mail. If the subscriber wants to re key his/her certificate, then
he/she must follow the procedures described in section 4.7.
6.
Host or service certificate: The subject must already have a valid .yu.rs
with the certificate
requests attached and stating in the body of the e-mail that he is the person
responsible for the server/service. In both cases the certificate request will
be forwarded to the appropriate RA or CA, who will approve or disapprove the
request according to sections 4.2.1 and 4.2.2
4.2 Certificate application processing
4.2.1 Performing identification and authentication functions
All the
certificate applications will be authenticated and validated by the AEGIS CA
and RAs as stated in section 3.2.3. In the cases of re-key of user certificate
or request for host or service certificate, the authentication of the
certificate application will take place by checking that the requester has a
valid
4.2.2 Approval or rejection of certificate applications
The essential
procedures that must be conformed in a certificate application request are as
follows:
1.the subscriber must be authenticated by RA or CA;
2.the subject must be an acceptable subscriber entity, as
defined by this Policy (section 1.3.3);
3.the request must obey the AEGIS CA distinguished name scheme
(section 7.1.4);
4.the distinguished name must be unique;
5.the key must be 1024 or 2048 bits;
6.each applicant generates his/her own key by using OpenSSL or similar
software;
7.host and service certificate requests must be submitted via SSL secured
web form or via e-mail signed by a
valid
8.user certificate requests must be submitted via SSL secured web form or
via e-mail.
9.the requests for certification keys with exponent == 3 will
be rejected.
If the certificate request
does not meet one or more of the above criteria, it will be rejected and signed
notification e-mail will be sent by the RA or CA to the requester with carbon
copy to aegis-ca@aegis-ca.rcub.bg.ac.yu.rs
4.2.3 Time to process certificate applications
Each certificate application will take no more that 3
working days to be processed.
4.3 Certificate issuance
4.3.1 CA actions during certificate issuance
If the certificate was
requested through RA, the CA will validate the RA signature and RA authority
and then issue the certificate.
If the user requested the
certificate from the CA, the user must be validated as described in section
3.2.3 and then the certificate will be issued.
Right after the subscriber’s
certificate is issued, an e-mail will be sent to the relevant RA manager or to
the subscriber informing him/her about the action.
Communication between CA and
RA will be done via encrypted and digitally signed e-mails using S/MIME.
4.3.2 Notification to subscriber by the CA of issuance of certificate
If the RA handled the communication
between Subscriber and CA, the RA will send an e-mail, informing about
certificate issuance. If Subscriber contacted CA directly, the CA will send an
e-mail, informing about certificate issuance. User can then download His or Her
certificate from CA on-line repository.
4.4 Certificate acceptance
If the user wants to accept
the certificate, he or she must follow the procedure in section 4.4.1.
If a user wants to reject a
certificate, he or she must submit a revocation request as described in section
4.9.
4.4.1 Conduct constituting certificate acceptance
The subscriber must send an
e-mail, within 5 working days from the day that his/her certificate was issued,
in which he will be stating that:
1.He
or She accepts his/her certificate signed by the AEGIS CA;
2.He or She assumes the
responsibility to notify the AEGIS CA immediately:
• in case of possible private key compromise;
• when the certificate is no longer required;
• when the information in the certificate becomes
invalid.
The e-mail which the user
sends to the CA has to be signed with the key corresponding to the public key
in certificate he or she received from the CA.
If the subscriber does not
send the e-mail within 5 working days, the certificate becomes the subject for
revocation.
4.4.2 Publication of the certificate by the CA
All the certificates issued
by the AEGIS CA will be published in the on-line repository operated by the AEGIS CA.
4.4.3 Notification of certificate issuance by the CA to other entities
If the RA has handled the communication with the subscriber, then
it will be notified of the certificate issuance.
The RA will be informed about any certificate signatures and re-keys
before expiration that were submitted through it.
4.5 Key pair and certificate usage
4.5.1 Subscriber private key and certificate usage
The subscribers' private keys
along with the certificates issued by the AEGIS CA can be used for:
·
email signing/verifying and
encryption/decryption (S/MIME);
·
server authentication and
encryption of communications;
· authentication
purposes in Grid Infrastructures.
· non-repuditation
4.5.2 Relying party public key and certificate usage
Relying parties can use the
public keys and certificates of the subscribers for:
·
email encryption and signature
verification (S/MIME);
·
server authentication and
encryption of communications;
·
authentication purposes in Grid
infrastructures.
Relying parties must download
the CRL at least once a day and implement its restrictions while validating
certificates.
4.6 Certificate renewal
4.6.1 Circumstance for certificate renewal
4.6.2 Who may request renewal
4.6.3 Processing certificate renewal requests
4.6.4 Notification of new certificate issuance to subscriber
4.6.5 Conduct constituting acceptance of a renewal certificate
4.6.6 Publication of the renewal certificate by the CA
4.6.7
Notification of certificate issuance by the CA to other entities
4.7 Certificate re-key
4.7.1 Circumstances for certificate re-key
Subscribers must regenerate
their key pair in the following circumstances:
1.expiration
of their certificate signed by the AEGIS CA;
2.revocation
of their certificate by the AEGIS CA;
4.7.2 Who may request certification of a new public key
Every subscriber holding a valid
4.7.3 Processing certificate re-keying requests
Expiration
warnings will be sent to subscribers before it is re-key time.
a) Re-key before expiration
can be executed by stating a re-key request signed with the private key corresponding to the public one in the valid personal certificate of the subscriber. The requester is not required to pass the authentication
procedure described in section 3.2.3, if this does not contrast with c) or d).
b) Re-key after certificate
expiration uses completely the same authentication procedure as that for the new certificate.
c) At
least once every 3 years the subscriber must go through the same authentication
procedure as the one described for a new certificate.
d) In case the request for a new certificate is due to
revocation of certificate the subscriber must follow the same procedure as the
one described in for a new one.
4.7.4 Notification of new certificate issuance to subscriber
Same as in section 4.3.2
4.7.5 Conduct constituting acceptance of a re-keyed certificate
Same as in section 4.4.1
4.7.6 Publication of the re-keyed certificate by the CA
Same as in section 4.4.2
4.7.7 Notification
of certificate issuance by the CA to other
entities
Same as in section 4.4.3
4.8 Certificate modification
4.8.1 Circumstances for certificate modification
No stipulation.
4.8.2 Who may request certificate modification
No stipulation.
4.8.3 Processing certificate modification requests
No stipulation.
4.8.4 Notification of new certificate issuance to subscriber
No stipulation.
4.8.5 Conduct constituting acceptance of modified certificate
No stipulation.
4.8.6 Publication of the modified certificate by the CA
No stipulation.
4.8.7 Notification of certificate issuance by the CA to other entities
No stipulation.
4.9 Certificate revocation and suspension
4.9.1 Circumstances for revocation
A certificate will be
revoked when the information it contains or the implied assertions it carries
are known or suspected to be incorrect, the private key is compromised or the
Subscriber does not need the certificate any more. This includes situations
where:
·
The CA is
informed that the Subscriber has ceased to be a member of or associated with a
AEGIS program or activity;
·
The Subscriber’s
private key is lost or suspected to be compromised;
·
The information
in the Subscriber’s certificate is wrong or inaccurate, or suspected to be
wrong or inaccurate;
·
The Subscriber
violates his/her obligations.
·
The Subscriber
does not need the certificate any more.
4.9.2 Who can request revocation
The CA, RA, subscriber of
the certificate or any other entity holding evidence of a revocation
circumstance about that certificate can request revocation.
4.9.3 Procedure for revocation request
The entity requesting the
certificate revocation is authenticated by signing the revocation request with
a valid
4.9.4 Revocation request grace period
No stipulation.
4.9.5 Time within which CA must process the revocation request
4.9.6 Revocation checking requirement for relying parties
Relying parts must download
the CRL from the online-repository [section 2.1] at least once a day and
implement its restrictions while validating certificates.
4.9.7 CRL issuance frequency
1.CRLs
will be published in the on-line repository as soon as issued and at least once
every 23 days;
2.The
maximum CRL lifetime is 30 days;
3.Each new CRL is
issued at least 7 days before expiration of the previous CRL.
4.9.8 Maximum latency for CRLs
No stipulation.
4.9.9 On-line revocation/status checking availability
Currently there are no on-line
revocation/status services offered by the AEGIS CA.
4.9.10 On-line revocation checking requirements
Currently there are no
on-line revocation/status services offered by the AEGIS CA.
4.9.11 Other forms of revocation advertisements available
No stipulation.
4.9.12 Special requirements re key compromise
No stipulation.
4.9.13 Circumstances for suspension
4.9.14 Who can request suspension
4.9.15 Procedure for suspension request
4.9.16 Limits on suspension period
4.10 Certificate status services
4.10.1 Operational characteristics
4.10.2 Service availability
The on-line repository is
maintained on best effort basis with intended availability of 24x7.
4.10.3 Optional features
No stipulation.
4.11 End of subscription
No stipulation.
4.12 Key escrow and recovery
4.12.1 Key escrow and recovery policy and practices
No stipulation.
4.12.2 Session key encapsulation and recovery policy and practices
No stipulation.
5 FACILITY, MANAGEMENT, AND OPERATIONAL CONTROLS
5.1 Physical controls
5.1.1 Site
location and construction
The AEGIS CA
operates in a controlled and protected room located in University of Belgrade Computer
Center. At least one person employed by
5.1.2 Physical access
Physical access to the AEGIS
CA is restricted to authorized personnel only.
5.1.3 Power and Air Conditioning
Premises
containing the CA machine are air conditioned.
5.1.4 Water Exposures
No
stipulation.
5.1.5 Fire Prevention and Protection
University of
5.1.6 Media storage
Backups are to
be stored in removable storage media (CD-ROM, Floppies and USB Flash) in a safe
location in University of Belgrade Computer Center premises.
5.1.7 Waste Disposal
Floppy disks
or CDs are physically destroyed before being trashed.
5.1.8 Off-site Backup
No
stipulation.
5.2 Procedural controls
5.2.1 Trusted roles
No stipulation.
5.2.2 Number of persons required per task
No stipulation.
5.2.3 Identification and authentication for each role
No stipulation.
5.2.4 Roles requiring separation of duties
No stipulation.
5.3 Personnel controls
5.3.1 Qualifications, experience and clearance requirements
5.3.2 Background check procedures
No stipulation.
5.3.3 Training requirements
Internal training is given to
5.3.4 Retraining frequency and requirements
5.3.5 Job rotation frequency and sequence
No stipulation.
5.3.6 Sanctions for unauthorized actions
No stipulation.
5.3.7 Independent contractor requirements
No stipulation.
5.3.8 Documentation supplied to personnel
Documentation regarding all
the operational procedures of the CA is supplied to personnel during the
initial training period.
5.4 Audit logging procedures
5.4.1 Types of events recorded
The
following events are recorded by
·
certification
requests
·
issued
certificates
·
requests
for revocation
·
issued
CRLs
·
login/logout/reboot
of the signing machine
Each RA must
keep log of the following:
·
for
each approved request, how it was approved;
·
for
each rejected request, why it was rejected;
·
for
each approved revocation request, the reason for revocation;
·
for
each rejected revocation request, the reason for revocation and the reason the
request was rejected.
5.4.2 Frequency of processing log
Audit logs will be processed at least once per month.
5.4.3 Retention period for audit log
Audit logs will be retained for a minimum of 3 years.
5.4.4 Protection of audit log
Only authorized CA personnel are allowed to view and
process audit logs. Audit logs are kept in a safe storage in a room with limited access.
5.4.5 Audit log backup procedures
Audit logs are copied to an offline medium and kept
in a safe storage in a room with limited access.
5.4.6 Audit collection system (internal vs. external)
Audit log collection system is internal to the AEGIS CA.