- Hardware Security Modules
- Equipment status
- Submit new CP, Submit new Naming doc, Submit new Charter
- Certificate service Statistics as of end of August
- Roll out plan for version 2 of DOEGrids
- System Architecture - 10/15
- Data center design
- Project Schedule
- Problems
Mike Helm and Dhiva have finished their evaluations of HSMs from: Rainbow, Chrysalis and Ncipher. The HSM is a requirement for the project, to meet the security requirements from EDG, for running an online CA . In early September Mike and Dhiva demonstrated how the HSMs would work in our environment. Ncipher was the selected system. They have been ordered and delivered. They are being deployed as part of the 10/15 architecture. The new architecture with the HSMs will begin testing in October - with production starting sometime in November.
Stan's group has been working with Plant engineering to get the ESnet Data Center racks secured and powered. The work continues. The new racks should be powered in the October time frame. The servers should start being moved in October, as the schedule, work permits. The October architecture will begin construction in early October. The goal is to have the new systems in testing configurations by the end of October. The system should go into production in November or early December. The current system will stay in production until the switch over. This requires working with all our relying parties and the European Data Grid to insure continuous operation.
To meet the October architecture we need to update our PKI document set: CP/CPS and PMA charter. As part of the October goal we need to modify the Naming used by the PKI Service. Mike Helm has submitted a new naming document to the PMA for review. The naming document describes the naming that the PMA has approved in earlier discussions this summer. No new issues have come up, this naming will go into production with the new service. The Naming changes and a number of minor edits have been done on our CP/CPS. The new CP/CPS has been submitted to the PMA for approval. No open issues are seen at this time. The new CP/CPS will be used for the October architecture. The GGF has produced a document to help develop PMA charters - This documented edited by Mike Helm and Peter Gietz was used to produce the new Charter for the DOEGrids PMA. This document has been submitted to the PMA for approval.
With the new document set and the equipment in place the October Architecture can be deployed. The goal is to have the new system up and in testing mode by the end of October - the actual production date will most likely happen in November.
Tasks |
Dates |
Comments |
| Power Black Racks | 10/21 | This gates the project. Plant engineering needed to sign off racks. They are hoping to get power to at least one of the racks on the 21st. |
| Move servers | 10/28 | It is hoped that this happens earlier, but is dependent on the Racks. This includes the deployment of the HSMs. Ncipher is scheduled out in early October to help configure the new HSMs. |
| Configure new servers | 11/4 | Could configure servers not in the Racks but would be better if final configuration was in place. Vacations and conference meetings are delaying this date. |
| Test new servers | 2 weeks | Need a Globus configuration to test with. |
| Update EDG files | 11/15 | |
| Add Firewall policies | 11/30 | The new servers will be moved to the firewall subnet when they are racked in the Black racks. |
| Online | 11/30 |
| Certs per month issued | ~ 40 – 80 |
| Total Certificates issued: | 457 |
| Certificates revoked: | 44 |
| People Certificates | 216 |
| Services Certificates | 229 |
| Host (internal usage) | 18 |
| Requests in Queue: | 3 |
