auto fpki graph update (20210330)

[ryancdickson]

@idmken

Please find this week's Federal PKI Crawler/Graph update (March 30, 2021 execution).

Live Preview: https://federalist-2147738e-703c-4833-9101-89d779f09ce1.app.cloud.gov/preview/gsa/fpki-guides/20210330-auto-fpki-graph-update/tools/fpkigraph/

Nodes Added or Removed (compared to March 15 2021 execution):

• N1 (REMOVED): CN=CertiPath Bridge CA - G2, OU=Certification Authorities, O=CertiPath LLC, C=US

Edges Added or Removed (compared to March 15, 2021 execution):

• E1 (REMOVED): CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US -> CN=CertiPath Bridge CA - G2, OU=Certification Authorities, O=CertiPath LLC, C=US
• E2 (REMOVED): CN=SAFE Bridge CA 02, OU=Certification Authorities, O=SAFE-Biopharma, C=US -> CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US
• E3 (REMOVED): CN=SAFE Bridge CA 02, OU=Certification Authorities, O=SAFE-Biopharma, C=US -> CN=IdenTrust SAFE-BioPharma CA 1, OU=IdenTrust Global Common, O=IdenTrust, C=US
• E4 (REMOVED): CN=SAFE Bridge CA 02, OU=Certification Authorities, O=SAFE-Biopharma, C=US -> CN=Trans Sped Mobile eIDAS QCA G2, OU=Individual Subscriber CA, O=Trans Sped SRL, C=RO

Root Cause Analysis:

• N1/E1: Certificate revocation. The following certificate was revoked:
  • Subject: CN=CertiPath Bridge CA - G2, OU=Certification Authorities, O=CertiPath LLC, C=US
  • Issuer: CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US
  • Validity: December 12, 2019 to December 12, 2022
  • Serial: 154d6e5eb1df740a2588ca6e27d3b557829a0dfc
  • SHA1 Hash: 3bfc4df881682f8846bff486d422025aee7494d8
  • Key Size: 2048-bit RSA
  • Signing Algorithm: SHA-256 with RSA
• E2: Certificate revocation. The following certificate was revoked:
  • Subject: CN=Federal Bridge CA G4, OU=FPKI, O=U.S. Government, C=US
  • Issuer: CN=SAFE Bridge CA 02, OU=Certification Authorities, O=SAFE-Biopharma, C=US
  • Validity: June 24, 2020 to June 24, 2023
  • Serial: 740000000e1e4162e397cffc6c00000000000e
  • SHA1 Hash: f63f8b52f872ce8db9ff655a215d36a28fefe673
  • Key Size: 2048-bit RSA
  • Signing Algorithm: SHA-256 with RSA
• E3: Certificate revocation. The following certificate was revoked:
  • Subject: CN=IdenTrust SAFE-BioPharma CA 1, OU=IdenTrust Global Common, O=IdenTrust, C=US
  • Issuer: CN=SAFE Bridge CA 02, OU=Certification Authorities, O=SAFE-Biopharma, C=US
  • Validity: December 11, 2018 to December 11, 2021
  • Serial: 740000000cf7f6b4249862ecf100000000000c
  • SHA1 Hash: 245f753f8a315a83bd0be8cf70833503f99fd2d2
  • Key Size: 2048-bit RSA
  • Signing Algorithm: SHA-256 with RSA
• E4: Certificate revocation. The following certificate was revoked:
  • Subject: CN=Trans Sped Mobile eIDAS QCA G2, OU=Individual Subscriber CA, O=Trans Sped SRL, C=RO
  • Issuer: CN=SAFE Bridge CA 02, OU=Certification Authorities, O=SAFE-Biopharma, C=US
  • Validity: August 23, 2017 to August 23, 2023
  • Serial: 740000000a68b5f6edd0a9e34300000000000a
  • SHA1 Hash: c1a2b6bb919d104065a2c0c550b27dcdfe12ce96
  • Key Size: 2048-bit RSA
  • Signing Algorithm: SHA-256 with RSA

Other updates:

• Federal Common Policy CA Migration Playbook
  • Throughout the Playbook - Extended migration timeline to June after recent certificate revocation planning updates.
  • Updated revocation dates for Entrust and Treasury
• System Notifications
  • Added revocation notification for CertiPath Bridge CA - G2
  • Added two (2) revocation notifications for SAFE Bridge CA 02
  • Added notification for Entrust OCSP outage (March 29, 2021)
  • Updated notifications for Entrust/Treasury certificate revocations