2. Architecture

The will be a hierarchy of CA's. A root CA will be maintained by UCOP. It's sole function will be to issue certificates to certificate authorities on the campuses. (It might in turn be certified by some outside authority; that remains a desireable but perhaps unachieveable feature.)

Each campus will maintian a single certificate authority for personal certificates. The campus CA will issue certificates to individuals and web servers for the campus. They might possibly also issue certificates to subsidiary certificate severs, subject to suitable policy contraints.

3.1 Types of Certificates

Individual

Web Server

3.2 Certificate Payload

The NetID field, if present, is the NetID associated with the given individual. It can be used to look up authorization data on the individual (for example in the UDir).

The CampusID, if present, is the CampusID associated with the given individual. It has a meaning which is particular to the campus, but presumably can be used to look up authoriization data on the individual in some local DB.

4.2 Subscriber Agreement

Subscribers are notified of the importance of the UCCert by being presented with a notice substantially like this when applying:

"I understand that the UCCert is an important form of identification. All the information I will provide and all the representations I will make in applying for a certificate are true. I have not allowed and will not allow anyone to have access to the private key that will be associated with the certificate I am requesting. I have stored that private key in a password protected file. I will inform the Certificate Authority Administrator immediately should any of the information I have provided change or should I believe the security of my private key has been compromised. I will remove the UCCert and the associated private key from the web server or my browser within 24 hours of being informed that it has been revoked."

4.2.1 Subscribers who are web server administrators enter into the following additional agreement:

"I have authority to and accept responsibility for ensuring that anyone who performs administration functions on the web server for which a UCCert is issued is fully informed of the requirements for use of the certificate and that they agree to use the certificate exclusively for authorized and legal purposes, consistent with this policy and procedure document."

4.3 Key Pair Generation

Subscribers generate their own key pairs to minimize the exposure of the private key.

4.4 Verification of Identity

The identity of the individuals requesting certificates is verified by various means as indicated by the STRENGTH field on the certificate.

• Strength = 7. Means that the subject presented a picture ID (drivers license, passport, etc.) to a duly authorized officer of the university before the certificate was issued. (Possibly, the subject was then issued a password for subsequent issuing of the certificate.)
• Strength = 3. Means that the subject was verified by means of some automated system, without presenting an ID to a duly authorized officer. Examples include:
  • The subject was challenged for information the should only be known by them:
    • a password which was mailed to an account that the person controls
    • mother's maiden name, social security number, date of birth, etc.
  • The subject was in a kerberos or other database which the university believes is reasonably administered and knew the password.

5. Procedures for Revoking UCCerts

A UCCert will be revoked when the private key associated with the certificate is compromised or suspected to be compromised. In general, this will become known because the subscriber notifies the CAA. (It will not normally be revoked should the subscriber status change. This includes the case where there has been some violation of acceptable use of UC computing resources. It is intended that this be handled by suitable modification to the authorization DB.)

5.2 Revocation Procedure

When a certificate is revoked, it will be added to the Certificate Revocation List (CRL) in the certificate repository and a status of revoked will be added as an attribute to the certificate in the certificate repository. The CA Administrator (CAA) will notify the subscriber that the certificate has been revoked and instruct them to remove the certificate and the associated private key from the web server or web browser.

6.1.1 The CA workstation is located in the secure computer room where it has fire protection and climate control;

6.2 Technical Controls

6.2.1 Network access to the CA and its repository passes through a firewall that limits the type and source of access;

6.2.2 The Operator shall take all standard precautions to limit access to the system and prevent system breakins. It uses CA and certificate repository software acquired and managed so as to assure there are no unauthorized modifications.

6.3 Procedural Controls

6.3.1 Three distinct administrative roles have been established to ensure a single individual cannot act alone to create unauthorized certificates and remove evidence of that action. The roles are as follows:

a. Certification Authority Administrator (CAA)

The CAA role includes:

• Verification of application information;
• Certificate generation;
• Administrative functions associated with maintaining the CA database and assisting in compromise investigations.
• Responding to questions about the certificates issued and the UCPKI.

The SA role includes:

• Performing initial configuration of the CA system including secure boot start-up and shut down of the workstation;
• Initial setup of all new accounts;
• Setting the initial network configuration;
• Creating emergency system restart media to recover from catastrophic system loss;
• Performing system backups, software upgrades and recovery
• Changing of the host name and/or network address.

The ISSO role includes:

• Assigning security privileges and access controls for administrators of the CA.
• Assigning passwords to all new accounts.

8. Policy and Procedure Maintenance

In the event UC decides to cease operating a PKI, it will provide at least three months notice to subscribers to give them time to obtain a certificate from a commercial CA if desired. All certificates will be revoked on the termination date.

Definitions

CAA - The Certificate Authority Administrator.

Certificate subject - The entity whose public key is certified in the certificate.

Certificate Revocation List (CRL) - A list of certificates that have been revoked prior to their expiration date.

Operator - The organization/people responsible for operation of the CA.

Subscriber - In the case of certificates issued to resources (such as web servers), the person responsible for the certificate for that resource. For certificates issued to individuals, same as certificate subject.

UCCert - a certificate issued by the UCPKI.

UCPKI - The UC Public Key Infrastructure - The hardware, software, policies, procedures, and personnel for creating, using, and terminating public key certificates.

Sal Gurnani