I wanted to talk more about TAGPMA charter use of the word "accredit" as well as "certify", and the related discussion yesterday. Maybe we're really talking about a branding scheme. I thought of accredit as being a heavyweight process, with certification as one of the components - I was involved in a couple of higher ed accreditation processes a long time ago & I think that's how they were structured. Dictionary use and net use seem synonymous. There seems to be ISO definitions of them for IT/info sec use (one is ISO 17799; you figure it out -- there's a freebie here: http://iso-17799.safemode.org). Accreditation is the process, and certification is the signed statement that results (my drastic paraphrase). Another paraphrase would be that accreditation grants the entity the authority to do something, and the certification is a formal written statement to that effect, with lifetimes, and perhaps other attributes. In other domains, an effort is made to distinguish between approval and capability, and accreditation is focused more on measures of quality and conformance to standards rather than authority to operate. I think this is closer to what we do in fact. The document that David Groep mentioned (& wrote?) is here: http://www.eugridpma.org/guidelines/EUGridPMA-accreditation-20040402-1-0.pdf This does describe a process, which is more or less submission - initial doc review - personal appearance and "defense" - final edit - enrollment There's no formal certification, unless publishing in the directory counts. In a bridge scenario the cross-certificate would be one kind of certification. I tried to find the OSG letter to the PMA's, I had to settle on one of the drafts due to lack of time. In part, it says 1) We request that you utilize or develop accepted standard accreditation profiles sufficient to assure approximate parity in CAs operating to that profile. We ask that each of you perform peer reviews on CAs within your region to categorize CAs by profile. Maybe we'd be better served here by talking about branding in the same context. For a long time, the EDG was the gold standard for Grid CA's. That was the only "brand" that mattered. It is still strong, but things are more complicated now. We also have relying parties, grid coalitions or whatever, like OSG, Teragrid, that want some kind of accreditation (that is they want to outsource as much of the work of CA approval as possible). Let's stick with the generally accepted meanings of certify and accredit. Any discussion about process uses them synonymously, and certification is some kind of publication step at the conclusion of the accreditation process (perhaps optional). It seems like there are 2 things that can be "accredited": providers, like CA's, and profiles. The latter seems more like a standard of some sort to me. Perhaps these should be managed by a standards body like GGF. Regional PMA's could chose which ones it could accredit providers agains, based on needs and expertise, and perhaps support others. Perhaps there should also be some kind of null profile and or experimental profile for providers falling outside the published profiles. There are 3 kinds of branding that could be done. One is locally approved that is CA X is TAGPMA - classic pki profile accredited One is IGTF approved that is CA X is IGTF - classic pki profile accredited and one is relying party approved that is CA X is Teragrid classic pki profile accredited The 2nd is what we are doing. But this seems unwieldy since there may be a questions raised by a certification done by some regional body outside its territory (ie what value did it add). I think emphasizing up the "IGTF" brand is better than building up the regional. The relying party brand is stronger, since these are recognized entities, but they have their limits. ALso, we don't want to just be their slaves; this has unintended consequences when different consortia have colliding requirements. On the other hand, EDG - approved sure was important. The EDG/EUgridpma min req profile, the one we call classic, is clearly one that could be an IGTF branded, since all the regional PMAs are committed to this profile and there are many instances. I don't think the IGTF brand and certainly not the TAGPMA brand are strong enough on their own yet. Maybe it is appropriate for the time being to take up the job of being evaluators for significant Grid projects, and working out a set of guidelines to apply in evaluating CA's. For example, OSG might say that it would accept any profile, but the following 5 things must be true {....}; in return, it would allow TAGPMA to say a CA was "OSG accredited", if TAGPMA's accreditation process indicated that these things were true about an applying CA. TAGPMA might apply its own branding by saying that any of {LCG accredited, OSG accredited, NFC accredited ...} constituted TAGPMA accreditation. For ITGF branding to work, the process for each regional would have to be somewhat normalized or accredited also. So for example "ITGF classic PKI" might require that the EUGridPMA accreditation process above be adopted. It might also be useful to make this an open process that is representatives from one regional might help various steps in another regional's accreditation process. Document review particularly is something that can be done anywhere in the world at any time. Conclusion: accredit = certify; an actual "certification" step might be useful; make the profiles a standards body product; build brands like IGTF; normalize process steps to build that brand; rely on big grid branding to build up regional brand, but don't get shackled to a particular project