[ retired 3/10/2013 ]

Return-Path: <jbasney@illinois.edu>
Received: from mailer2.psc.edu (mailer2.psc.edu [128.182.70.106])
	by pscuxb.psc.edu (8.13.8/8.13.1) with ESMTP id r28EsJQW025484
	for <dsimmel@pscuxb.psc.edu>; Fri, 8 Mar 2013 09:54:20 -0500
Received: from pps02.cites.illinois.edu (pps02.cites.illinois.edu [192.17.82.100])
	by mailer2.psc.edu (8.13.8/8.13.8) with ESMTP id r28EsFUw020693
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <dsimmel@psc.edu>; Fri, 8 Mar 2013 09:54:15 -0500
Received: from citesht3.cites.illinois.edu (citesht3.cites.illinois.edu [128.174.34.208])
	by pps02.cites.illinois.edu (8.14.5/8.14.5) with ESMTP id r28EroLW023335
	(version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT);
	Fri, 8 Mar 2013 08:54:04 -0600
Received: from o2.ncsa.illinois.edu (141.142.220.178) by smtp.illinois.edu
 (128.174.34.208) with Microsoft SMTP Server (TLS) id 14.2.328.9; Fri, 8 Mar
 2013 08:53:54 -0600
Message-ID: <5139FB83.1030402@illinois.edu>
Date: Fri, 8 Mar 2013 08:53:55 -0600
From: Jim Basney <jbasney@illinois.edu>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130216 Thunderbird/17.0.3
MIME-Version: 1.0
To: David Groep <davidg@nikhef.nl>, Derek Simmel <dsimmel@psc.edu>
Subject: CILogon/NCSA changes for IGTF distribution
X-Enigmail-Version: 1.5.1
OpenPGP: id=0A33BE15;
	url=http://www.ncsa.illinois.edu/~jbasney/pgp.asc
Content-Type: multipart/mixed;
	boundary="------------090305060403060509020700"
X-Originating-IP: [141.142.220.178]
X-Spam-Score: 0
X-Spam-Details: rule=cautious_plus_nq_notspam policy=cautious_plus_nq score=0
 kscore.is_bulkscore=3.2647351377868e-08 kscore.compositescore=0
 circleOfTrustscore=0 compositescore=0.234807148660411
 urlsuspect_oldscore=0.234807148660411 suspectscore=0
 recipient_domain_to_sender_totalscore=0 phishscore=0 bulkscore=0
 kscore.is_spamscore=0 recipient_to_sender_totalscore=0
 recipient_domain_to_sender_domain_totalscore=0 rbsscore=0.234807148660411
 spamscore=0 recipient_to_sender_domain_totalscore=0 urlsuspectscore=0.9
 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=7.0.1-1211240000 definitions=main-1303080094
X-Spam-OrigSender: jbasney@illinois.edu
X-Spam-Bar: 
X-Spam-Status: No, score=-4.819, required=5, tests=BAYES_00,RCVD_IN_DNSWL_MED,RP_MATCHES_RCVD,SPF_PASS,T_FILL_THIS_FORM_SHORT
X-Scanned-By: MIMEDefang 2.70 on 128.182.70.106

--------------090305060403060509020700
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit

Hi David and Derek,

The NCSA GridShib CA (CN=GridShib CA) has now stopped issuing
certificates, and all issued certificate have expired. Please remove
this CA (files: ncsa-gridshib-ca.*, hashes e8ac4b61 and d87163a8) from
the IGTF distribution. We'll keep issuing CRLs for this CA for at least
another few months to avoid problems for relying parties.

The 3 other NCSA CAs (CN=CACL, CN=MyProxy, and CN=Two Factor CA) are
still actively used, so please don't remove those.

Also, with the upcoming retirement of the DOEGrids CA, CILogon needs to
stop using crl.doegrids.org as a backup CRL distribution point. Updated
cilogon-*.crl_url and cilogon-*.info files are attached. Please include
these updated versions in future IGTF distributions.

Thanks,
Jim

--------------090305060403060509020700
Content-Type: text/plain; charset="UTF-8"; x-mac-type=0; x-mac-creator=0;
	name="cilogon-silver.info"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="cilogon-silver.info"

YWxpYXMgPSBjaWxvZ29uLXNpbHZlcgp1cmwgPSBodHRwOi8vY2EuY2lsb2dvbi5vcmcvCmNh
X3VybCA9IGh0dHBzOi8vY2lsb2dvbi5vcmcvY2lsb2dvbi1zaWx2ZXIucGVtCmNybF91cmwg
PSBodHRwOi8vY3JsLmNpbG9nb24ub3JnL2NpbG9nb24tc2lsdmVyLmNybAplbWFpbCA9IGNh
QGNpbG9nb24ub3JnCnN0YXR1cyA9IGFjY3JlZGl0ZWQ6bWljcwp2ZXJzaW9uID0gQFZFUlNJ
T05ACnNoYTFmcC4wID0gQFNIQTFGUC4wQAo=
--------------090305060403060509020700
Content-Type: text/plain; charset="UTF-8"; x-mac-type=0; x-mac-creator=0;
	name="cilogon-openid.info"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="cilogon-openid.info"

YWxpYXMgPSBjaWxvZ29uLW9wZW5pZAp1cmwgPSBodHRwOi8vY2EuY2lsb2dvbi5vcmcvCmNh
X3VybCA9IGh0dHBzOi8vY2lsb2dvbi5vcmcvY2lsb2dvbi1vcGVuaWQucGVtCmNybF91cmwg
PSBodHRwOi8vY3JsLmNpbG9nb24ub3JnL2NpbG9nb24tb3BlbmlkLmNybAplbWFpbCA9IGNh
QGNpbG9nb24ub3JnCnN0YXR1cyA9IGV4cGVyaW1lbnRhbAp2ZXJzaW9uID0gQFZFUlNJT05A
CnNoYTFmcC4wID0gQFNIQTFGUC4wQAo=
--------------090305060403060509020700
Content-Type: text/plain; charset="UTF-8"; x-mac-type=0; x-mac-creator=0;
	name="cilogon-basic.info"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="cilogon-basic.info"

YWxpYXMgPSBjaWxvZ29uLWJhc2ljCnVybCA9IGh0dHA6Ly9jYS5jaWxvZ29uLm9yZy8KY2Ff
dXJsID0gaHR0cHM6Ly9jaWxvZ29uLm9yZy9jaWxvZ29uLWJhc2ljLnBlbQpjcmxfdXJsID0g
aHR0cDovL2NybC5jaWxvZ29uLm9yZy9jaWxvZ29uLWJhc2ljLmNybAplbWFpbCA9IGNhQGNp
bG9nb24ub3JnCnN0YXR1cyA9IGV4cGVyaW1lbnRhbAp2ZXJzaW9uID0gQFZFUlNJT05ACnNo
YTFmcC4wID0gQFNIQTFGUC4wQAo=
--------------090305060403060509020700
Content-Type: text/plain; charset="UTF-8"; x-mac-type=0; x-mac-creator=0;
	name="cilogon-silver.crl_url"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="cilogon-silver.crl_url"

aHR0cDovL2NybC5jaWxvZ29uLm9yZy9jaWxvZ29uLXNpbHZlci5jcmwK
--------------090305060403060509020700
Content-Type: text/plain; charset="UTF-8"; x-mac-type=0; x-mac-creator=0;
	name="cilogon-openid.crl_url"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="cilogon-openid.crl_url"

aHR0cDovL2NybC5jaWxvZ29uLm9yZy9jaWxvZ29uLW9wZW5pZC5jcmwK
--------------090305060403060509020700
Content-Type: text/plain; charset="UTF-8"; x-mac-type=0; x-mac-creator=0;
	name="cilogon-basic.crl_url"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="cilogon-basic.crl_url"

aHR0cDovL2NybC5jaWxvZ29uLm9yZy9jaWxvZ29uLWJhc2ljLmNybAo=
--------------090305060403060509020700--

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[ New GridShib CA, May 2009 (mccreary) ]

Received via email with S/MIME signature on 13May09.  Signed using
certificate w/ subject:

	CN = Jim Basney
	O  = National Center for Supercomputing Applications
	OU = People
Serial Num = 01:04

from authority:

	CN = CACL
	O  = National Center for Supercomputing Applications
	OU = Certificate Authorities

Valid from 23May08 until 24May2009

Fingerprints:
	SHA1	FC:BF:6C:6E:9E:71:AC:B5:01:4C:FE:FF:57:D8:17:86:E4:07:32:31
	MD5 	E3:B8:68:A8:5C:62:00:78:A0:DB:30:48:03:B0:5A:C9

Self-signed CACL CA cert in tarball verified on 13May09, see NCSA_CACL_provenance
for details.

Tar file containing the CA cert and signing policy was also obtained from
<http://www.ncsa.uiuc.edu/~jbasney/ncsa-gridshib-ca-igtf.tar.gz>
Good PGP signature for this tar file was obtained from
<http://www.ncsa.uiuc.edu/~jbasney/ncsa-gridshib-ca-igtf.tar.gz.sig>
Signature made with this key:

pub   1024D/424ACD8C 2009-01-01 [expires: 2010-01-26]
      Key fingerprint = 7396 9433 032F 4DC9 94A4  514A 1155 CA38 424A CD8C
uid                  Jim Basney <jbasney@ncsa.uiuc.edu>
sub   2048g/A97983D9 2009-01-01 [expires: 2010-01-26]

Unfortunately this key is not part of the TG security working group web of trust.

Extracted the following files from the tar file and checked against the
attachments from the email message:

ncsa-gridshib-ca-igtf/e8ac4b61.0
ncsa-gridshib-ca-igtf/e8ac4b61.signing_policy

Cosmetic differences between email and tar files:
diff ./e8ac4b61.0 ../ncsa-gridshib-ca-igtf/e8ac4b61.0
24,25d23
< 
< 
diff ./e8ac4b61.signing_policy ../ncsa-gridshib-ca-igtf/e8ac4b61.signing_policy
4,5d3
< 
< 

Obtained CRL URL from subsequent S/MIME email message from Jim Basney, signed
with the same CACL cert.

http://ca.ncsa.uiuc.edu/e8ac4b61.r0 

New GridShib cert:
openssl x509 -subject -fingerprint -sha1 -noout -in e8ac4b61.0
subject= /C=US/O=National Center for Supercomputing Applications/OU=Certificate Authorities/CN=GridShib CA
SHA1 Fingerprint=48:DE:D1:9E:40:BF:3A:20:2B:A2:F6:F2:85:6A:62:37:5D:E9:AD:E1
MD5 Fingerprint=3D:6F:CD:C7:C2:E9:B0:DF:F9:0F:B7:28:0F:57:CD:63
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)

iD8DBQFKCzPaYjEf42hR7yYRAgP4AKCWfo4Kgxb2GLOWldO55r9a+e8ZrwCcC/K4
HyZGK7+1+mZ/FYpUSP7a5NM=
=jt55
-----END PGP SIGNATURE-----