auto fpki graph update (20210302)

[ryancdickson]

@idmken

Please find this week's Federal PKI Crawler/Graph update (March 2, 2021 execution).

Live Preview: https://federalist-2147738e-703c-4833-9101-89d779f09ce1.app.cloud.gov/preview/gsa/fpki-guides/20210302-auto-fpki-graph-update/tools/fpkigraph/

Nodes Added or Removed (compared to February 23, 2021 execution):

• N1 (REMOVED): CN=NextgenIDRootCA1, OU=Certification Authorities, O=NextgenID, C=US
• N2 (REMOVED): CN=NGIDTrustCA1, OU=Certification Authorities, O=NextgenID, C=US

Edges Added or Removed (compared to February 23, 2021 execution):

• E1 (REMOVED): CN=CertiPath Bridge CA - G3, OU=Certification Authorities, O=CertiPath, C=US -> CN=Carillon Federal Services PIV-I CA1, OU=Certification Authorities, O=Carillon Federal Services Inc., C=US
• E2 (REMOVED): CN=CertiPath Bridge CA - G3, OU=Certification Authorities, O=CertiPath, C=US -> CN=Carillon PKI Services G2 Root CA 2, OU=Certification Authorities, O=Carillon Information Security Inc., C=CA
• E3 (REMOVED): CN=CertiPath Bridge CA - G3, OU=Certification Authorities, O=CertiPath, C=US -> CN=NextgenIDRootCA1, OU=Certification Authorities, O=NextgenID, C=US
• E4 (REMOVED): CN=NextgenIDRootCA1, OU=Certification Authorities, O=NextgenID, C=US -> CN=NGIDTrustCA1, OU=Certification Authorities, O=NextgenID, C=US

Root Cause Analysis:

• N1/E3: Certificate expiration. Certificate details:
  • Subject: CN=NextgenIDRootCA1, OU=Certification Authorities, O=NextgenID, C=US
  • Issuer: CN=CertiPath Bridge CA - G3, OU=Certification Authorities, O=CertiPath, C=US
  • Validity: Feb. 26, 2020 to Feb. 28, 2021
  • Serial: 18f4f2292fa6e3703c5f52ad4044f44e
  • SHA1 Hash: 7c96f349497d7abf22b83fa9768fee257848e8a8
  • Key Size: 3072-bit (RSA)
  • Signing Algorithm: SHA-384 with RSA
• N2/E4: Due to the expiration of the certificate above, this certificate was also removed. Certificate details:
  • Subject: CN=NGIDTrustCA1, OU=Certification Authorities, O=NextgenID, C=US
  • Issuer: CN=NextgenIDRootCA1, OU=Certification Authorities, O=NextgenID, C=US
  • Validity: Nov. 23, 2017 to Nov. 23, 2030
  • Serial: 1af06981c50d2c7dc0d63fc16ce0b886bddb1273
  • SHA1 Hash: 463a1a71f0cea0db1f0483ece42903c28d6b6d7c
  • Key Size: 3072-bit (RSA)
  • Signing Algorithm: SHA-256 with RSA
  • Note: this certificate was also revoked on Feb. 28, 2021
• E1: Certificate Expiration. Certificate details:
  • Subject: CN=Carillon Federal Services PIV-I CA1, OU=Certification Authorities, O=Carillon Federal Services Inc., C=US
  • Issuer: CN=CertiPath Bridge CA - G3, OU=Certification Authorities, O=CertiPath, C=US
  • Validity: Feb. 26, 2020 to Feb. 28, 2021
  • Serial: 2edc463b839f7352087bb161ab23002b
  • SHA1 Hash: aff439f001ebdbe7f4a53dc4805cffc78d1e7c63
  • Key Size: 4096-bit RSA
  • Signing Algorithm: SHA-384 with RSA
• E2: Certificate Expiration. Certificate details:
  • Subject: CN=Carillon PKI Services G2 Root CA 2, OU=Certification Authorities, O=Carillon Information Security Inc., C=CA
  • Issuer: CN=CertiPath Bridge CA - G3, OU=Certification Authorities, O=CertiPath, C=US
  • Validity: Feb. 26, 2020 to Feb. 28, 2021
  • Serial: 23c16e3ba51d710489960d139c1cc14b
  • SHA1 Hash: 5283e2ea0ee49b1deb93841e81b1b5b524b1e0b5
  • Key Size: 4096-bit RSA
  • Signing Algorithm: SHA-384 with RSA

Note: Two additional CAs were recently renewed and their updated certificates were published to replace expiring ones. Due to the timing of the expiration/publishing in comparison to the execution of the FPKI Graph, they do not appear as changes outlined above. Including relevant information below for completeness. System Notifications have also been added.

 - Subject: CN=Ministerie van Defensie PKIoverheid Organisatie Persoon CA - G3, 2.5.4.97=NTRNL-27370985, O=Ministerie van Defensie, C=NL
 - Issuer: CN=CertiPath Bridge CA - G3, OU=Certification Authorities, O=CertiPath, C=US
 - Validity: Feb. 17, 2021 to Feb. 28, 2022
 - Serial: 5dc76a7b566d03d58679762d29e7a2e4    
 - SHA1 Hash: 64b24bf2fdfd1a8aabe432ac332fdbbc4a76ff30   
 - Key Size: 4096-bit RSA 
 - Signing Algorithm: SHA-384 with RSA

 - Subject: CN=Northrop Grumman Corporate Root CA-G2, OU=Northrop Grumman Information Technology, O=Northrop Grumman Corporation, C=US 
 - Issuer: CN=CertiPath Bridge CA - G3, OU=Certification Authorities, O=CertiPath, C=US
 - Validity: Feb. 17, 2021 to Feb. 28, 2022 
 - Serial: 4b518aabc6ad6930b1a17bad8449b198   
 - SHA1 Hash: 9ac306e3369858456ec83128dd1daef5cb4a0061   
 - Key Size: 3072-bit RSA 
 - Signing Algorithm: SHA-384 with RSA

Other updates:

• System Notifications:
  • Added #837 for IdenTrust's intent to issue a new CA certificate
  • Added remaining notifications associated with #832 (certificates published within the last week were not available during last week's update)