auto fpki graph update (202011160)

[ryancdickson]

@lachellel

Please find the weekly Federal PKI Crawler/Graph update (November 16, 2020 execution).

Live Preview: https://federalist-2147738e-703c-4833-9101-89d779f09ce1.app.cloud.gov/preview/gsa/fpki-guides/20201116-auto-fpki-graph-update/tools/fpkigraph/

Nodes Added or Removed (compared to November 9, 2020 execution):

• No change.

Edges Added or Removed (compared to November 9, 2020 execution):

• E1 (REMOVED): CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US -> OU=Entrust Managed Services NFI Root CA, OU=Certification Authorities, O=Entrust, C=US

Root Cause Analysis:

• E1: Repository Update. Both the FPKIMA and Entrust removed an old version of the Entrust Managed Services NFI Root CA from their certificate repositories (renewed October 29, 2020). Removed certificate details:
  • Issuer: CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US
  • Subject: OU=Entrust Managed Services NFI Root CA, OU=Certification Authorities, O=Entrust, C=US
  • Validity: December 16, 2019 to November 16, 2020
  • Serial #: 1965197bf91f27410579481cef24c85278720f30
  • SHA-1 Hash: 313f87f0eb4f8e6c658f5e66f58764282c54fba4
  • Key Size: 2048-bit (RSA)
  • Signature Algorithm: SHA256 with RSA
  • Note: This certificate expires today.

Other updates:

• Minor grammar update on the Common Policy CA update announcement
• Monitoring publication of new cross certificates issued by the Federal Bridge CA G4 (#767 and #762)
• Updated https://fpki.idmanagement.gov/crls/pivcas/
  • Removed expired CAs, updated table "update date" (forgot to do this last week when updating FTC record)
  • To-do: Review CA operator architecture submissions (FY20 Annual Review Year) and update, as necessary.