September 2014 - caops-wg

Fwd: [pkix] Proposed revisions to X.509
by Sill, Alan 26 Sep '14

26 Sep '14

FYI - information provided by Tony Rutkowski below. Alan Begin forwarded message: From: Tony Rutkowski <tony(a)yaanatech.com> Subject: [pkix] Proposed revisions to X.509 Date: September 25, 2014 at 3:31:06 PM GMT+2 To: Kathleen Moriarty <kathleen.moriarty.ietf(a)gmail.com>, Stephen Farrell <stephen.farrell(a)cs.tcd.ie> Cc: <pkix(a)ietf.org>, <smime(a)ietf.org> Reply-To: <tony(a)yaanatech.com> PKIX and IETF/CABF groups - as part of their collaborative roles - may be interested in the proposed amendment document just published. -t _______________________________________________ pkix mailing list pkix(a)ietf.org https://www.ietf.org/mailman/listinfo/pkix

1 0

Fwd: [Nsi-wg] slides for NSI AA presentation Monday 22 September 2014
by Sill, Alan 22 Sep '14

22 Sep '14

FYI. Review and thoughts to the author are recruited (by me). Thoughts welcome on how we can improve communication among and between members of the OGF groups, and more widely between the networking and security portions of the community on this topic. Alan Begin forwarded message: From: Hans Trompert <hans.trompert(a)surfnet.nl<mailto:hans.trompert@surfnet.nl>> Date: September 19, 2014 at 12:40:29 PM CDT To: "nsi-wg(a)ogf.org<mailto:nsi-wg@ogf.org>" <nsi-wg(a)ogf.org<mailto:nsi-wg@ogf.org>> Subject: [Nsi-wg] slides for NSI AA presentation Monday 22 September 2014 Hi, Please find attached my slides for the NSI AA presentation Monday 22 September 2014 in Uppsala. Cheers, HansT.

2 1

Fwd: useful information about bestman2 and SHA2 host certificates
by Sill, Alan 13 Sep '14

13 Sep '14

Hmm, more in the SHA2 and jglobus story below. Any other related experience out there? Alan Begin forwarded message: From: Horst Severini <hs(a)nhn.ou.edu> Subject: useful information about bestman2 and SHA2 host certificates Date: September 13, 2014 at 2:56:49 AM GMT+1 To: <osg-sites(a)OPENSCIENCEGRID.ORG>, <usatlas-t2-l(a)lists.bnl.gov> Cc: <adt027(a)latech.edu>, <hs.greenw(a)phys.latech.edu> Reply-To: <hs(a)nhn.ou.edu> Hi all, since we just found out the hard way, I thought I'd send an email and warn people who may run up against the same issue fairly soon. This is documented somewhere, but I'm not sure how many people actually know about it -- at least I hadn't read it before. =) So the problem is that if you request a new hostcert on a RHEL6/SL6/CentOS6 machine with the latest openssl version installed, then the hostkey which that procedure produces won't work with bestman2; somehow the version of jglobus that bestman2 uses doesn't like it. The details are here: https://twiki.grid.iu.edu/bin/view/Documentation/Release3/InstallOSGBestman… In a nutshell, the solution seems to be to run the following command on the newly produced hostkey file: openssl rsa -in hostkey.pem -out hostkey.pem.old Then move the original hostkey.pem out of the way, rename hostkey.pem.old back to hostkey.pem, and then make a copy of that to bestman/bestman.key as well, as usual for bestman2. At least that worked for us, Joel Snow tested it. Thanks to Wei Yang for reminding us about this issue. By the way, the DigiCert certificate expiration reminder email system is currently being fixed, too -- well, it has been fixed, but this fix will most likely be deployed on September 23 during the monthly maintenance, so you may want to have a closer look at all your certificates as well and make sure none of them expire before that. We were also bitten by that. :) Cheers, Horst

2 1

Linux Journal Article: Provisioning X.509 using RFC 7030
by Sill, Alan 12 Sep '14

12 Sep '14

Thought this article would be of interest to the group, given discussions on similar topics today. Alan

1 0