auto fpki graph update (2/3/2021)

[ryancdickson]

@idmken

Please find this week's Federal PKI Crawler/Graph update (February 3, 2021 execution).

Live Preview: https://federalist-2147738e-703c-4833-9101-89d779f09ce1.app.cloud.gov/preview/gsa/fpki-guides/20210203-auto-fpki-graph-update/tools/fpkigraph/

Nodes Added or Removed (compared to January 29, 2021 execution):

• N1 (ADDED): CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US
• N2 (ADDED): CN=WidePoint ORC SSP 5, O=ORC PKI, C=US

Edges Added or Removed (compared to January 29, 2021 execution):

• E1 (ADDED): CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US -> CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US
• E2 (REMOVED): CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US -> CN=Federal Common Policy CA, OU=FPKI, O=U.S. Government, C=US
• E3 (ADDED): CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US -> CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US
• E4 (ADDED): CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US -> CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US
• E5 (ADDED): CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US -> CN=U.S. Department of State AD Root CA, CN=AIA, CN=Public Key Services, CN=Services, CN=Configuration, DC=state, DC=sbu
• E6 (ADDED): CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US -> CN=WidePoint ORC SSP 5, O=ORC PKI, C=US
• E7 (ADDED): CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US -> OU=Entrust Managed Services Root CA, OU=Certification Authorities, O=Entrust, C=US
• E8 (REMOVED): CN=Federal Common Policy CA, OU=FPKI, O=U.S. Government, C=US -> CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US

Root Cause Analysis:

• E1: Certificate bundle update. The following certificate was added:
  • Subject: CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US
  • Issuer: CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US
  • Validity: 10/15/2020 to 12/6/2029
  • Serial: 129217e6c9126fd816babe02d9192ae2b519e231
  • SHA1 Hash: edf2d373f4c56b5186087300638e3c5660c9a090
  • Key Size: 4096-bit RSA
  • Signing Algorithm: SHA-256 with RSA
• E2: Certificate bundle update. The following certificate was removed:
  • Subject: CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US
  • Issuer: CN=Federal Common Policy CA, OU=FPKI, O=U.S. Government, C=US
  • Validity: 10/13/2020 to 6/30/2021
  • Serial: 198ef944a16068e7c0b85cd2f5b2cfb5de8b2174
  • SHA1 Hash: fb3f5e09cac4fe4066f6c48cce31feca02fea677
  • Key Size: 2048-bit RSA
  • Signing Algorithm: SHA-256 with RSA
  • Note: To avoid inadvertent path looping, only one within the pair of E1/E2 can be published at the same time. This change signifies the transition to FCPCAG2.
• E3: New certificate issued by Federal Common Policy CA G2 detected by the Crawler after being issued to Subject CA Operator Authority Information Access Extension bundle. Certificate details:
  • Subject: CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US
  • Issuer: CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US
  • Validity: 10/15/2020 to 12/6/2029
  • Serial: 234200beaa6dada658f53b403f418295290cae82
  • SHA1 Hash: 97db351e069964297a82040eb760c9cc1d74ba33
  • Key Size: 2048-bit RSA
  • Signing Algorithm: SHA-384 with RSA
• E4: New certificate issued by Federal Common Policy CA G2 detected by the Crawler after being issued to Subject CA Operator Authority Information Access Extension bundle. Certificate details:
  • Subject: CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US
  • Issuer: CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US
  • Validity: 10/14/2020 to 10/14/2040
  • Serial: 21e5b9a0cc956de278ca012ba8fdc58a98b3fbea
  • SHA1 Hash: 99b4251e2eee05d8292e8397a90165293d116028
  • Key Size: 4096-bit RSA
  • Signing Algorithm: SHA-384 with RSA
• E5: New certificate issued by Federal Common Policy CA G2 detected by the Crawler after being issued to Subject CA Operator Authority Information Access Extension bundle. Certificate details:
  • Subject: CN=U.S. Department of State AD Root CA, CN=AIA, CN=Public Key Services, CN=Services, CN=Configuration, DC=state, DC=sbu
  • Issuer: CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US
  • Validity: 11/18/2020 to 11/18/2023
  • Serial: 27634fd321cbfd8c7efc0aeb02876f63da4c0c09
  • SHA1 Hash: 9b3849f7047964a6654988054956e478ccb75ded
  • Key Size: 4096-bit RSA
  • Signing Algorithm: SHA-384 with RSA
• E6: New certificate issued by Federal Common Policy CA G2 detected by the Crawler after being issued to Subject CA Operator Authority Information Access Extension bundle. Certificate details:
  • Subject: CN=WidePoint ORC SSP 5, O=ORC PKI, C=US
  • Issuer: CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US
  • Validity: 11/19/2020 to 11/5/2030
  • Serial: 210b3f17db750e616eb25f3f0b4933e5a98c449b
  • SHA1 Hash: 80f4731a60fd5f2eb0468d0629310daa50ad210d
  • Key Size: 2048-bit RSA
  • Signing Algorithm: SHA-384 with RSA
• E7: New certificate issued by Federal Common Policy CA G2 detected by the Crawler after being issued to Subject CA Operator Authority Information Access Extension bundle. Certificate details:
  • Subject: OU=Entrust Managed Services Root CA, OU=Certification Authorities, O=Entrust, C=US
  • Issuer: CN=Federal Common Policy CA G2, OU=FPKI, O=U.S. Government, C=US
  • Validity: 11/18/2020 to 8/14/2029
  • Serial: 215e78d99648b021c6394a6566d8e00f46a1e595
  • SHA1 Hash: 07f5dc58f83778d5b5738a988292c00a674a0f40
  • Key Size: 2048-bit RSA
  • Signing Algorithm: SHA-384 with RSA
• E8: Certificate bundle update. The following certificate was removed:
  • Subject: CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US
  • Issuer: CN=Federal Common Policy CA, OU=FPKI, O=U.S. Government, C=US
  • Validity: 12/12/2019 to 12/12/2021
  • Serial: 7994
  • SHA1 Hash: e836f3016bfb6e8df274f27fd8a4a5054517b0f1
  • Key Size: 2048-bit RSA
  • Signing Algorithm: SHA-256 with RSA
    

Other updates:

• Removed references to Jan. 28 CISA webinar (date now past). Will add new webinar date, once identified.
• A new certificate issued to WidePoint NFI CA 6 was issued and then revoked. We expect a modified certificate to be issued. This resulted in the closure and re-opening of #814
• Removed expired CA certificates from fpki_piv_issuers.md
• Now that FCPCAG2 is being picked up by the Crawler, we might want to consider updating the Graph to use it as the center node. I think this will require us to update the Crawler source and recompile the executable JAR. I'll look into this further.

[ryancdickson]

@idmken - after further discussion with @techliaison - I'm going to move forward with using FCPCAG2 as the "center" node. The current version (using FCPCA as the center node) is really quite hard to use. Should have a new PR in a few minutes.

[ryancdickson]

@idmken - Updated - graph now "centers" on Federal Common Policy CA G2. This is much cleaner now that the Crawler is pulling Federal Common Policy CA G2 into the graph.