| -----BEGIN PGP SIGNED MESSAGE----- |
| Hash: SHA1 |
| |
| [ Verify new PSC CA, April 2010 (mccreary) ] |
| |
| New CA cert tarball obtained on 23Apr2010 vi email from |
| Derek Simmel <dsimmel@psc.edu>. A good PGP signature for this tar file was |
| sent in the same email message, using a PGP key I have signed myself. The |
| signature was made with this key: |
| |
| pub 1024D/F2882606 2004-01-12 |
| Key fingerprint = EC23 8D42 69B3 3EBB 9850 F972 8575 CF80 F288 2606 |
| uid Derek Simmel <dsimmel@psc.edu> |
| sub 2048g/DB7D9741 2004-01-12 |
| |
| This key has been signed by my own key: |
| |
| pub 1024D/6851EF26 2006-05-03 [expire: 2011-05-02] |
| Key fingerprint = F9E7 8D30 2833 70A8 611A 42C2 6231 1FE3 6851 EF26 |
| uid Sean McCreary <mccreary@ucar.edu> |
| sub 2048g/BD594BA4 2006-05-03 [expire: 2011-05-02] |
| |
| Extracted the following files from the tar file: |
| 9b88e95b.0 |
| 9b88e95b.crl_url |
| 9b88e95b.psc-root.cadesc |
| 9b88e95b.signing_policy |
| acc06fda.0 |
| acc06fda.crl_url |
| acc06fda.psc-host.cadesc |
| acc06fda.signing_policy |
| 4b2783ac.0 |
| 4b2783ac.crl_url |
| 4b2783ac.psc-myproxy.cadesc |
| 4b2783ac.signing_policy |
| 4b2783ac.info |
| 4b2783ac.namespaces |
| |
| Note that the *.crl_url files refer to the DER-format revocation lists. We |
| require PEM-format revocation lists, so I have included the alternate URLs |
| for these files (i.e. I replaced http://foo/bar/XXXXXXXX.crl with |
| http://foo/bar/XXXXXXXX.r0 in each file). |
| |
| 9b88e95b already exists in the tarball. I've verified that the CA cert is |
| identical with the following differences in the signing_policy file: |
| |
| openssl x509 -subject -fingerprint -sha1 -noout -in 9b88e95b.0 |
| subject= /C=US/O=Pittsburgh Supercomputing Center/CN=PSC Root CA |
| SHA1 Fingerprint=76:14:59:94:16:2B:E2:05:C9:16:3F:85:8E:7C:70:EE:B9:DD:84:50 |
| MD5 Fingerprint=A4:DC:F4:AB:62:B1:6B:8C:90:78:03:94:A6:8E:B9:5A |
| |
| $ diff 9b88e95b.signing_policy ../certificates-/9b88e95b.signing_policy |
| 3c3 |
| < cond_subjects globus '"/C=US/O=Pittsburgh Supercomputing Center/*"' |
| - - --- |
| > cond_subjects globus '"/C=US/O=Pittsburgh Supercomputing Center/CN=PSC Root CA" "/C=US/O=Pittsburgh Supercomputing Center/CN=PSC Hosts CA" "/C=US/O=Pittsburgh Supercomputing Center/CN=PSC Web Services CA"' |
| |
| acc06fda also already exists in the tarball. I've verified that the CA cert |
| and signing_policy files are identical. |
| |
| openssl x509 -subject -fingerprint -sha1 -noout -in acc06fda.0 |
| subject= /C=US/O=Pittsburgh Supercomputing Center/CN=PSC Hosts CA |
| SHA1 Fingerprint=6C:CD:19:F1:36:B8:49:01:C4:E4:3B:0B:56:44:9D:58:4B:89:14:88 |
| MD5 Fingerprint=C7:76:67:51:73:EE:F3:13:FA:12:DA:CB:95:CC:2E:C1 |
| |
| 4b2783ac is a new addition to the tarball: |
| |
| openssl x509 -subject -fingerprint -sha1 -noout -in 4b2783ac.0 |
| subject= /C=US/O=Pittsburgh Supercomputing Center/CN=PSC MyProxy CA |
| SHA1 Fingerprint=F8:13:D4:7B:44:9C:4A:83:CF:E3:A5:59:37:5C:9F:F7:FA:0A:1D:66 |
| MD5 Fingerprint=21:F7:B4:30:26:C7:49:5E:F3:56:61:D4:73:A3:32:A1 |
| -----BEGIN PGP SIGNATURE----- |
| Version: GnuPG v1.4.9 (Darwin) |
| |
| iEYEARECAAYFAkvYfeQACgkQYjEf42hR7yaXOgCeM7u14ay4UI7Q5SJfnNCmsp4i |
| K+UAn2Hr9KB3ZZ+2HtOVQN/wWGgAkuSL |
| =BVSC |
| -----END PGP SIGNATURE----- |
