| [ Removed (again?) expiring UK eScience CA certs 53729190.* 367b75c3.* 2013-01-28 dsimmel ] |
| |
| -----BEGIN PGP SIGNED MESSAGE----- |
| Hash: SHA1 |
| |
| [ Updated UK eScience CA certificate, validity extended to March 31, 2013 (jam,dsimmel 2012-11-01) ] |
| |
| $ openssl version |
| OpenSSL 1.0.0-fips 29 Mar 2010 |
| |
| $ openssl x509 -in 367b75c3.0 -serial -issuer -subject -dates -hash -subject_hash_old -noout |
| serial=0121 |
| issuer= /C=UK/O=eScienceRoot/OU=Authority/CN=UK e-Science Root |
| subject= /C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science CA |
| notBefore=Oct 30 09:00:00 2007 GMT |
| notAfter=Mar 31 23:59:59 2013 GMT |
| 53729190 |
| 367b75c3 |
| |
| [ Replacement UK eScience certificates, May 2008 (mccreary) ] |
| |
| Retrieved from |
| <https://dist.eugridpma.info/distribution/igtf/current/accredited/tgz/> |
| ca_UKeScienceRoot-2007-1.21.tar.gz |
| ca_UKeScienceCA-2007-1.21.tar.gz |
| ca_UKeScienceRoot-1.21.tar.gz |
| ca_UKeScienceCA-1.21.tar.gz |
| |
| on 22May08. Web server presented certificate w/ subject: |
| |
| CN = dist.eugridpma.info |
| O = NIKHEF |
| OU = PDP |
| Serial Num = 01:00:00:00:00:01:10:E4:53:B7:A5 |
| |
| from authority: |
| |
| CN = Cybertrust Educational CA |
| O = Cybertrust |
| OU = Educational CA |
| |
| Valid from 21Feb07 until 21Feb2010 |
| |
| Fingerprints: |
| SHA1 7D:EF:99:28:66:AB:46:91:AE:0C:05:59:8A:F8:69:60:0F:E0:E0:24 |
| MD5 5D:AE:44:D1:14:F6:E8:8A:BB:EE:AD:3F:7A:1F:13:6D |
| |
| Updated certs: |
| openssl x509 -subject -fingerprint -sha1 -noout -in 367b75c3.0 |
| subject= /C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science CA |
| SHA1 Fingerprint=CA:1C:B6:6C:A9:E3:27:4D:F7:3E:A9:EB:6A:33:3F:C1:A2:B1:B8:D7 |
| MD5 Fingerprint=29:74:27:49:A9:9C:C2:BB:1A:FE:58:BB:02:BE:00:E9 |
| |
| openssl x509 -subject -fingerprint -sha1 -noout -in 98ef0ee5.0 |
| subject= /C=UK/O=eScienceRoot/OU=Authority/CN=UK e-Science Root |
| SHA1 Fingerprint=A1:39:B0:F3:04:6C:0B:F9:F5:0A:1B:33:00:06:4F:83:6B:7D:4F:3E |
| MD5 Fingerprint=0E:4A:28:9B:BB:2C:A2:3E:90:8F:AF:11:A6:8B:BE:9E |
| |
| *.signing_policy files have cosmetic differences: |
| |
| diff ./367b75c3.signing_policy ../teragrid-certs/367b75c3.signing_policy |
| 1,4c1,14 |
| < # @(#)$Id: 367b75c3.signing_policy,v 1.1 2007/11/15 21:04:34 pmacvsdg Exp $ |
| < access_id_CA X509 '/C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science CA' |
| < pos_rights globus CA:sign |
| < cond_subjects globus '"/C=UK/O=eScience/*"' |
| - - --- |
| > # Signing policy for UK e-Science CA |
| > # This file should be installed in |
| > # /etc/grid-security/certificates |
| > # as <hash>.signing_policy along with |
| > # the CA certificate as <hash>.<digit> |
| > # -- here <hash> is the output of |
| > # openssl x509 -hash -noout -in <certificate> |
| > # and <digit> is the lowest single (decimal) |
| > # digit that makes the file unique (in case |
| > # you have other CA certificates that hash to |
| > # the same value) |
| > access_id_CA X509 '/C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science CA' |
| > pos_rights globus CA:sign |
| > cond_subjects globus '"/C=UK/O=eScience/*"' |
| diff ./98ef0ee5.signing_policy ../teragrid-certs/98ef0ee5.signing_policy |
| 1,4c1,14 |
| < # @(#)$Id: 98ef0ee5.signing_policy,v 1.1 2007/11/15 21:04:34 pmacvsdg Exp $ |
| < access_id_CA X509 '/C=UK/O=eScienceRoot/OU=Authority/CN=UK e-Science Root' |
| < pos_rights globus CA:sign |
| < cond_subjects globus '"/C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science CA"' |
| - - --- |
| > # Signing policy for UK e-Science ROOT CA. |
| > # This file should be installed in |
| > # /etc/grid-security/certificates |
| > # as <hash>.signing_policy along with |
| > # the CA certificate as <hash>.<digit> |
| > # -- here <hash> is the output of |
| > # openssl x509 -hash -noout -in <certificate> |
| > # and <digit> is the lowest single (decimal) |
| > # digit that makes the file unique (in case |
| > # you have other CA certificates that hash to |
| > # the same value) |
| > access_id_CA X509 '/C=UK/O=eScienceRoot/OU=Authority/CN=UK e-Science Root' |
| > pos_rights globus CA:sign |
| > cond_subjects globus '"/C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science CA"' |
| |
| |
| *.crl_url contain different extensions: |
| |
| 1c1 |
| < http://ca.grid-support.ac.uk/pub/crl/ca-crl.der |
| - - --- |
| > http://ca.grid-support.ac.uk/pub/crl/ca-crl.pem |
| |
| Also verified old UKeScience CA and Root certs: |
| |
| openssl x509 -subject -fingerprint -sha1 -noout -in adcbc9ef.0 |
| subject= /C=UK/O=eScienceCA/OU=Authority/CN=CA |
| SHA1 Fingerprint=0A:E0:5B:0C:64:99:18:2B:4F:FB:15:33:6F:77:33:F9:8E:F2:6D:C7 |
| MD5 Fingerprint=24:47:F1:F0:BD:1F:3E:E5:AE:4B:55:E9:E3:30:3A:0F |
| |
| openssl x509 -subject -fingerprint -sha1 -noout -in 8175c1cd.0 |
| subject= /C=UK/O=eScienceRoot/OU=Authority/L=Root/CN=CA |
| SHA1 Fingerprint=88:BF:90:CB:03:C6:10:14:FA:BB:0D:0A:3C:76:DA:D6:6E:21:54:95 |
| MD5 Fingerprint=A7:AD:F4:F9:37:43:8D:88:B0:EA:50:F9:3F:1E:B0:91 |
| |
| Note that *crl_url for these certs also differs in the extension |
| |
| 1c1 |
| < http://ca.grid-support.ac.uk/pub/crl/escience-root-crl.crl |
| - - --- |
| > http://ca.grid-support.ac.uk/pub/crl/escience-root-crl.pem |
| -----BEGIN PGP SIGNATURE----- |
| Version: GnuPG v1.4.8 (Darwin) |
| Comment: GPGTools - http://gpgtools.org |
| |
| iEYEARECAAYFAlCS8voACgkQhXXPgPKIJgbvvgCfWJkk24m0qIcLmQU1795J22ya |
| fh0AoK/7uerxMR1LhW6603A7CfCHKyuw |
| =xdW1 |
| -----END PGP SIGNATURE----- |
