| CURRENT (as of March 10, 2013) XSEDE APPROVED CAs: |
| |
| Revision History |
| ----------------- |
| 3/10/2013 [Removed retired NCSA GridShib CA; Replaced 10718cba.crl_url: new file removed http://crl.doegrids.org/cilogon-basic.crl] |
| |
| 1/30/2013 [Added DOEGrids CA S/N 0x47 valid 2002-12-5..2018-01-25 12d0da68.* 1c3f2ca8.*] |
| |
| 1/28/2013 [Removed expiring UK EScience CA 53729190.* 367b75c3.*, DOE Grids CA 12d0da68.* 1c3f2ca8.*, and SDSC NPACI CA 9117797f.* b89793e4.*] |
| |
| 1/11/2013 [Removed Decommissioned TACC CAs 9a1da9f9 and f30e4b25] |
| |
| 11/1/2012 [Removed expired UK EScience CA certs and files 367b75c3.*, corrected filenames and symlinks for UK EScience CA certs] |
| |
| 8/8/12 [Corrected issues with signing policies of the recently added UK e-science CAs 1b6f5ede and ffc3d59b] |
| |
| 7/23/12 [Added UK eScienceCA 2A and 2B Files from igtf tarball v1.48] |
| |
| 4/11/2011 [Added newly TAGPMA accredited NCSA 2-factor SLCS CA (Added to IGTF distribution 3/26/2012).] |
| |
| 1/4/2012 [Added newly TAGPMA accredited NICS MyProxy CA] |
| |
| 6/1/2011 [Added KEK GRID CA (TAGPMA Certified)] |
| |
| 5/4/2011 [Added NERSC CA (TAGPMA Certified)] |
| |
| 1/25/2011 [Added OpenSSL 1.x hash symbolic links for *.0, *.signing_policy, |
| *.info, & *.namespaces files on Jan 25 2011] |
| |
| |
| DOE SCIENCE GRID: |
| ----------------- |
| |
| Added extended CA certificate (S/N 0x47 valid 2002-12-5..2018-01-25 12d0da68.* 1c3f2ca8.*) 2013-01-30 |
| |
| Removed expired CA certificate 2013-01-28 |
| |
| [Updated signing certificates (validity dates extended) & signing_policies for DOEGrids and ESnet, and crl_url for ESnet, Nov 3, 2006] |
| [Updated CRL URL for DOEGrids CA 1, May 1, 2008 (mccreary)] |
| |
| 1c3f2ca8.0 |
| /DC=org/DC=DOEGrids/OU=Certificate Authorities/CN=DOEGrids CA 1 |
| 1c3f2ca8.crl_url |
| http://crl.doegrids.org/1c3f2ca8/1c3f2ca8.r0 |
| 1c3f2ca8.signing_policy |
| |
| d1b603c3.0 |
| /DC=net/DC=ES/O=ESnet/OU=Certificate Authorities/CN=ESnet Root CA 1 |
| d1b603c3.crl_url |
| http://www.es.net/CA/d1b603c3/d1b603c3.r0 |
| d1b603c3.signing_policy |
| |
| IRISGrid (Spain): |
| ----------------- |
| |
| 9dd23746.0 |
| DC=es, DC=irisgrid, CN=IRISGridCA |
| 9dd23746.crl_url |
| http://www.irisgrid.es/pki/crl/cacrl.pem |
| 9dd23746.signing_policy |
| |
| NCSA: |
| ----- |
| |
| [ Verified 13May09 by mccreary, see NCSA_CACL_provenance for details ] |
| 9b95bbf2.0 |
| [ Updated 31Jan11 by jbasney with new Not After date: Apr 2027 ] |
| C=US, O=National Center for Supercomputing Applications, OU=Certificate Authorities, CN=CACL |
| http://ca.ncsa.uiuc.edu/9b95bbf2.r0 |
| 9b95bbf2.signing_policy |
| |
| [ Updated 31Jan11 by jbasney with new Not After date: Apr 2027 ] |
| [ Verified 07Oct09 by mccreary, see NCSA_MyProxy_provenance for details ] |
| f2e89fe3.0 |
| C=US, O=National Center for Supercomputing Applications, OU=Certificate Authorities, CN=MyProxy |
| http://ca.ncsa.uiuc.edu/f2e89fe3.r0 |
| f2e89fe3.signing_policy |
| |
| [ Added 13May09 by mccreary, see NCSA_GridShib_provenance for details ] |
| e8ac4b61.0 |
| /C=US/O=National Center for Supercomputing Applications/OU=Certificate Authorities/CN=GridShib CA |
| e8ac4b61.crl_url |
| http://ca.ncsa.uiuc.edu/e8ac4b61.r0 |
| e8ac4b61.signing_policy |
| |
| PITTSBURGH SUPERCOMPUTING CENTER: |
| --------------------------------- |
| |
| [ Verified 23Apr10 by mccreary, see PSC_provenance for details ] |
| 9b88e95b.0 |
| subject= /C=US/O=Pittsburgh Supercomputing Center/CN=PSC Root CA |
| 9b88e95b.crl_url |
| http://www.psc.edu/ca/crl/9b88e95b.crl |
| 9b88e95b.psc-root.cadesc |
| 9b88e95b.signing_policy |
| |
| [ Verified 23Apr10 by mccreary, see PSC_provenance for details ] |
| acc06fda.0 |
| subject= /C=US/O=Pittsburgh Supercomputing Center/CN=PSC Hosts CA |
| acc06fda.crl_url |
| http://www.psc.edu/ca/crl/acc06fda.crl |
| acc06fda.psc-host.cadesc |
| acc06fda.signing_policy |
| |
| [ Added 23Apr10 by mccreary, see PSC_provenance for details ] |
| 4b2783ac.0 |
| subject= /C=US/O=Pittsburgh Supercomputing Center/CN=PSC MyProxy CA |
| 4b2783ac.crl_url |
| http://www.psc.edu/ca/crl/4b2783ac.crl |
| 4b2783ac.psc-myproxy.cadesc |
| 4b2783ac.signing_policy |
| 4b2783ac.info |
| 4b2783ac.namespaces |
| |
| Purdue University: |
| ------------------ |
| |
| 67e8acfa.0 |
| /CN=Purdue TeraGrid RA/OU=Purdue TeraGrid/O=Purdue University/ST=Indiana/C=US |
| 67e8acfa.crl_url |
| http://tg-ca.purdue.teragrid.org:8080/67e8acfa.r0 |
| 67e8acfa.signing_policy |
| |
| 95009ddc.0 |
| /CN=PurdueCA/O=Purdue University/ST=Indiana/C=US |
| 95009ddc.crl_url |
| http://tg-ca.purdue.teragrid.org:8080/95009ddc.r0 |
| 95009ddc.signing_policy |
| |
| |
| SDSC: |
| ----- |
| |
| 3deda549.0 |
| /C=US/O=SDSC/OU=SDSC-CA/CN=Certificate Authority/UID=certman |
| 3deda549.crl_url |
| http://www.sdsc.edu/CA/3deda549.r0 |
| 3deda549.signing_policy |
| |
| b89793e4.0 |
| /C=US/O=NPACI/OU=SDSC/CN=Certificate Manager/UID=certman |
| b89793e4.crl_url |
| http://www.npaci.edu/CA/b89793e4.r0 |
| b89793e4.signing_policy |
| |
| |
| TACC: |
| ----- |
| |
| [ New TACC CA currently under review - added now to permit testing ] |
| |
| 9a1da9f9.0 |
| /C=US/O=UTAustin/OU=TACC/CN=TACC Certification Authority/UID=caman |
| 9a1da9f9.crl_url |
| http://www.tacc.utexas.edu/CA/CRL |
| 9a1da9f9.signing_policy |
| |
| [ New TACC root and classic CA added, Dec 2008 (mccreary) ] |
| 684261aa.0 |
| /DC=EDU/DC=UTEXAS/DC=TACC/O=UT-AUSTIN/CN=TACC Root CA |
| 684261aa.crl_url |
| http://www.tacc.utexas.edu/CA/684261aa.r0 |
| 684261aa.signing_policy |
| 684261aa.tacc.cadesc |
| 684261aa.tacc.cadesc.sig |
| |
| e5cc84c2.0 |
| /DC=EDU/DC=UTEXAS/DC=TACC/O=UT-AUSTIN/CN=TACC Classic CA |
| e5cc84c2.crl_url |
| http://www.tacc.utexas.edu/CA/e5cc84c2.r0 |
| e5cc84c2.signing_policy |
| e5cc84c2.tacc.cadesc |
| e5cc84c2.tacc.cadesc.sig |
| |
| See TACC_provenance for signed statement of certificate origin |
| |
| [ Added 13May09 by mccreary, see TACC_MICS_provenance for details ] |
| 2ac09305.0 |
| /DC=EDU/DC=UTEXAS/DC=TACC/O=UT-AUSTIN/CN=TACC MICS CA |
| 2ac09305.crl_url |
| http://www.tacc.utexas.edu/CA/2ac09305.r0 |
| 2ac09305.signing_policy |
| |
| UK E-Science CA: |
| ---------------- |
| |
| [ Jan 28, 2013: Removed (again?) EScience CA cert and files 53729190.* 367b75c3.*] |
| |
| [ Nov 1, 2012: Removed expired EScience CA cert and files 367b75c3.* ] |
| |
| [ Nov 1, 2012: swapped filenames and links for consistency with other CA cert file naming ] |
| |
| $ ls -l 877af676.* |
| lrwxr-xr-x 1 JimMarsteller staff 10 Nov 1 15:30 877af676.0 -> 1b6f5ede.0 |
| lrwxr-xr-x 1 JimMarsteller staff 16 Nov 1 15:31 877af676.crl_url -> 1b6f5ede.crl_url |
| lrwxr-xr-x 1 JimMarsteller staff 23 Nov 1 15:30 877af676.signing_policy -> 1b6f5ede.signing_policy |
| $ ls -l 1b6f5ede.* |
| -rw-r--r--@ 1 JimMarsteller staff 1367 Jul 11 09:55 1b6f5ede.0 |
| -rw-r--r--@ 1 JimMarsteller staff 43 Jul 11 10:33 1b6f5ede.crl_url |
| -rw-r--r--@ 1 JimMarsteller staff 237 Jul 11 09:55 1b6f5ede.signing_policy |
| $ ls -l 530f7122.* |
| lrwxr-xr-x 1 JimMarsteller staff 10 Nov 1 15:26 530f7122.0 -> ffc3d59b.0 |
| lrwxr-xr-x 1 JimMarsteller staff 16 Nov 1 15:28 530f7122.crl_url -> ffc3d59b.crl_url |
| lrwxr-xr-x 1 JimMarsteller staff 23 Nov 1 15:27 530f7122.signing_policy -> ffc3d59b.signing_policy |
| $ ls -l ffc3* |
| -rw-r--r--@ 1 JimMarsteller staff 1367 Jul 11 10:28 ffc3d59b.0 |
| -rw-r--r--@ 1 JimMarsteller staff 43 Jul 11 10:33 ffc3d59b.crl_url |
| -rw-r--r--@ 1 JimMarsteller staff 237 Jul 11 10:29 ffc3d59b.signing_policy |
| |
| [ addition of UK eScienceCA 2A and 2B, Jul 2012 (fest) ] |
| Files from igtf tarball v1.48 |
| |
| 877af676.0 |
| 877af676.signing_policy |
| 530f7122.0 |
| 530f7122.signing_policy |
| |
| wget https://dist.eugridpma.info/distribution/igtf/current/https://dist.eugridpma.info/distribution/igtf/current/igtf-policy-installation-bundle-1.48.tar.gz |
| |
| added hashes for v1 as well. |
| |
| [ removal of old UK eScience certificates and urls, Aug 2008 (shelmire) ] |
| |
| Files |
| adcbc9ef.0 |
| adcbc9ef.signing_policy |
| 8175c1cd.0 |
| 8175c1cd.signing_policy |
| |
| have been removed. The host that was holding these certificates may have been compromised. The UK E-Science CA is no longer honoring them. |
| |
| [ Replacement UK eScience certificates, May 2008 (mccreary) ] |
| |
| Retrieved from |
| <https://dist.eugridpma.info/distribution/igtf/current/accredited/tgz/> |
| ca_UKeScienceRoot-2007-1.21.tar.gz |
| ca_UKeScienceCA-2007-1.21.tar.gz |
| ca_UKeScienceRoot-1.21.tar.gz |
| ca_UKeScienceCA-1.21.tar.gz |
| |
| on 22May08. Web server presented certificate w/ subject: |
| |
| CN = dist.eugridpma.info |
| O = NIKHEF |
| OU = PDP |
| Serial Num = 01:00:00:00:00:01:10:E4:53:B7:A5 |
| |
| from authority: |
| |
| CN = Cybertrust Educational CA |
| O = Cybertrust |
| OU = Educational CA |
| |
| Valid from 21Feb07 until 21Feb2010 |
| |
| Fingerprints: |
| SHA1 7D:EF:99:28:66:AB:46:91:AE:0C:05:59:8A:F8:69:60:0F:E0:E0:24 |
| MD5 5D:AE:44:D1:14:F6:E8:8A:BB:EE:AD:3F:7A:1F:13:6D |
| |
| Updated: 367b75c3.0 |
| 367b75c3.signing_policy |
| 98ef0ee5.0 |
| 98ef0ee5.signing_policy |
| |
| *.crl_url files left unchanged, only difference is .pem extension |
| |
| 1c1 |
| < http://ca.grid-support.ac.uk/pub/crl/ca-crl.der |
| --- |
| > http://ca.grid-support.ac.uk/pub/crl/ca-crl.pem |
| |
| Also verifiedi: adcbc9ef.0 |
| adcbc9ef.signing_policy |
| 8175c1cd.0 |
| 8175c1cd.signing_policy |
| |
| Note that *crl_url for these certs also differs in the extension |
| |
| 1c1 |
| < http://ca.grid-support.ac.uk/pub/crl/escience-root-crl.crl |
| --- |
| > http://ca.grid-support.ac.uk/pub/crl/escience-root-crl.pem |
| |
| [ New UK eScience CAs November 2007 (cab) ] |
| |
| 367b75c3.0 |
| subject= /C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science CA |
| 367b75c3.crl_url= http://ca.grid-support.ac.uk/pub/crl/ca-crl.pem |
| 367b75c3.signing_policy |
| |
| 98ef0ee5.0 |
| subject= /C=UK/O=eScienceRoot/OU=Authority/CN=UK e-Science Root |
| 98ef0ee5.crl_url= http://ca.grid-support.ac.uk/pub/crl/root-crl.pem |
| 98ef0ee5.signing_policy |
| |
| [ New UK eScience CAs August 2006 ] |
| [ As of Nov. 27, 2007 No new certificates will be issued by this CA (cab) ] |
| [ Updated the CRL URL location to point to an unpublished PEM file (cab) ] |
| 8175c1cd.0 |
| subject= /C=UK/O=eScienceRoot/OU=Authority/L=Root/CN=CA |
| 8175c1cd.crl_url |
| http://ca.grid-support.ac.uk/pub/crl/escience-root-crl.pem |
| 8175c1cd.signing_policy |
| |
| adcbc9ef.0 |
| subject= /C=UK/O=eScienceCA/OU=Authority/CN=CA |
| adcbc9ef.crl_url |
| http://ca.grid-support.ac.uk/pub/crl/escience-ca-crl.pem |
| adcbc9ef.signing_policy |
| |
| [ UDATED Oct. 16 2007 - updated expired certificate URL (jam) ] |
| [ REMOVED Oct. 1 2007 - purged expired certificat (cab) ] |
| [ EXPIRING Aug 4 10:36:41 2007 GMT - no new certificates to be issued after Aug 2006 ] |
| [ previously approved for limited use until 12/31/2003; re-added for Reality-Grid |
| users under Bruce Boghosian (Tufts) TeraGrid project 08/18/2004 - dsimmel ] |
| 01621954.0 |
| /C=UK/O=eScience/OU=Authority/CN=CA/emailAddress=ca-operator@grid-support.ac.uk |
| 01621954.crl_url |
| http://ca.grid-support.ac.uk/cgi-bin/importCRL.pem |
| 01621954.signing_policy |
| |
| |
| University of Southern California (USC) CA & KCA: |
| ------------------------------------------------- |
| |
| [ added March 2005 to facilitate SCEC project users ] |
| [ removed January 2011 due to CA certificate expiration (jbasney) ] |
| |
| 2ca73e82.0 |
| /C=US/ST=California/L=Los Angeles/O=University of Southern California/CN=University of Southern California PKI-Lite CA, release 1/emailAddress=nmiadmin@usc.edu |
| 2ca73e82.crl_url |
| http://www.usc.edu/isd/services/authx/CA/2ca73e82.r0 |
| 2ca73e82.signing_policy |
| |
| [ USC Kerberos Certification Authority only issues short term certs for proxy use |
| and has no Certificate Revocation List ] |
| |
| [ USC KCA v2 service certificate fa9c3452.0 expired March 2, 2006 - the new v3 appears below ] |
| [ USC KCA v3 service certificate b57985f0.0 expired again on March 2, 2006, removed from the tarball, WJL] |
| b57985f0.0 |
| /C=US/ST=California/L=Los Angeles/O=University of Southern California/OU=Information Services Division/CN=University of Southern California KCA v3/emailAddress=nmiadmin@usc.edu |
| b57985f0.signing_policy |
| |
| |
| INFN (Italy) CA: |
| --------------- |
| |
| [ added March 2006 in preparation for user demo at GGF17 Tokyo May 2006 ] |
| [ removed as it expired Sept. 18, 2007 ] |
| 49f18420.0 |
| /C=IT/O=INFN/CN=INFN Certification Authority |
| 49f18420.crl_url |
| http://security.fi.infn.it/CA/crl.pem |
| 49f18420.signing_policy |
| |
| [ added on Oct. 1, 2007 to reflect the issuing of a new CA (cab) ] |
| [ Renamed the CRL URL to reflect an upublished PEM encoded file (cab) ] |
| [ Updated signing policy, May 1, 2009 (mccreary) ] |
| 2f3fadf6.0 |
| /C=IT/O=INFN/CN=INFN CA |
| http://security.fi.infn.it/CA/INFNCA_crl.pem |
| 2f3fadf6.signing_policy |
| |
| |
| Dutch Grid and NIKHEF CA: |
| ------------------------ |
| |
| [ added March 2006 in preparation for user demo at GGF17 Tokyo May 2006 ] |
| |
| 16da7552.0 |
| /C=NL/O=NIKHEF/CN=NIKHEF medium-security certification auth |
| 16da7552.crl_url |
| http://ca.dutchgrid.nl/medium/cacrl.pem |
| 16da7552.signing_policy |
| |
| |
| AIST (Japan) CA: |
| --------------- |
| |
| [ added March 2006 for GridRPC Materials Science production runs ] |
| |
| a317c467.0 |
| /C=JP/O=AIST/OU=GRID/CN=Certificate Authority |
| a317c467.crl_url |
| https://www.apgrid.org/CA/AIST/Production/a317c467.r0 |
| a317c467.signing_policy |
| |
| |
| NERSC SLCS CA: |
| |
| [ Added Apr 27 2011 per TeraGrid Ticket 198964 ] |
| |
| $ wget https://dist.eugridpma.info/distribution/igtf/current/igtf-policy-installation-bundle-1.38.tar.gz |
| --2011-04-27 10:37:26-- https://dist.eugridpma.info/distribution/igtf/current/igtf-policy-installation-bundle-1.38.tar.gz |
| Resolving dist.eugridpma.info... 194.171.96.74 |
| Connecting to dist.eugridpma.info|194.171.96.74|:443... connected. |
| HTTP request sent, awaiting response... 200 OK |
| Length: 150942 (147K) [application/x-gzip] |
| Saving to: `igtf-policy-installation-bundle-1.38.tar.gz' |
| 100%[======================================>] 150,942 223K/s in 0.7s |
| 2011-04-27 10:37:28 (223 KB/s) - `igtf-policy-installation-bundle-1.38.tar.gz' saved [150942/150942] |
| $ wget https://dist.eugridpma.info/distribution/igtf/current/igtf-policy-installation-bundle-1.38.tar.gz.asc |
| --2011-04-27 10:37:48-- https://dist.eugridpma.info/distribution/igtf/current/igtf-policy-installation-bundle-1.38.tar.gz.asc |
| Resolving dist.eugridpma.info... 194.171.96.74 |
| Connecting to dist.eugridpma.info|194.171.96.74|:443... connected. |
| HTTP request sent, awaiting response... 200 OK |
| Length: 189 [text/plain] |
| Saving to: `igtf-policy-installation-bundle-1.38.tar.gz.asc' |
| 100%[======================================>] 189 --.-K/s in 0s |
| 2011-04-27 10:37:49 (1.80 MB/s) - `igtf-policy-installation-bundle-1.38.tar.gz.asc' saved [189/189] |
| $ gpg --verify igtf-policy-installation-bundle-1.38.tar.gz.asc |
| gpg: Signature made Fri Feb 4 05:14:38 2011 CST using DSA key ID 3CDBBC71 |
| gpg: Good signature from "EUGridPMA Distribution Signing Key 3 <info@eugridpma.org>" |
| $ tar xfz igtf-policy-installation-bundle-1.38.tar.gz |
| $ cd igtf-policy-installation-bundle-1.38/src/accredited/ |
| $ cp NERSC-SLCS.* ~/cvs/repo.teragrid.org/security/certificates |
| $ cd ~/cvs/repo.teragrid.org/security/certificates/ |
| $ mv NERSC-SLCS.pem b93d6240.0 |
| $ mv NERSC-SLCS.info b93d6240.info |
| $ mv NERSC-SLCS.crl_url b93d6240.crl_url |
| $ mv NERSC-SLCS.signing_policy b93d6240.signing_policy |
| $ rm NERSC-SLCS.namespaces |
| $ ln -s b93d6240.0 20b7db76.0 |
| $ ln -s b93d6240.signing_policy 20b7db76.signing_policy |
