auto fpki graph update (20210413)

[ryancdickson]

@idmken

Please find this week's Federal PKI Crawler/Graph update (April 13, 2021 execution).

Live Preview: https://federalist-2147738e-703c-4833-9101-89d779f09ce1.app.cloud.gov/preview/gsa/fpki-guides/20210413-auto-fpki-graph-update/tools/fpkigraph/

Nodes Added or Removed (compared to April 7, 2021 execution):

• N1 (REMOVED): CN=Trans Sped Root CA G2, OU=Trans Sped CA, O=Trans Sped SRL, C=RO

Edges Added or Removed (compared to April 7, 2021 execution):

• E1 (REMOVED): CN=Federal Common Policy CA, OU=FPKI, O=U.S. Government, C=US -> CN=Verizon SSP CA A2, OU=SSP, O=Verizon, C=US
• E2 (REMOVED): CN=Trans Sped Root CA G2, OU=Trans Sped CA, O=Trans Sped SRL, C=RO -> CN=Trans Sped Mobile eIDAS QCA G2, OU=Individual Subscriber CA, O=Trans Sped SRL, C=RO
• E3 (REMOVED): CN=Trans Sped Root CA G2, OU=Trans Sped CA, O=Trans Sped SRL, C=RO -> CN=Trans Sped Root CA G2, OU=Trans Sped CA, O=Trans Sped SRL, C=RO

Root Cause Analysis:

• E1: Certificate Repository Update - Verizon removed the following certificate from http://aia1.ssp-strong-id.net/CA/VZ-SSP-CA-A2.p7c:

  • Subject: CN=Verizon SSP CA A2, OU=SSP, O=Verizon, C=US
  • Issuer: CN=Federal Common Policy CA, OU=FPKI, O=U.S. Government, C=US
  • Validity: December 5, 2018 to December 6, 2026
  • Serial: 65f8
  • SHA1 Hash: 477bf4017d25cde276cdddf756d40ca591d76f6d
  • Key Size: 2048-bit (RSA)
  • Signing Algorithm: SHA-256 with RSA

• N1/E2/E3: Certificate Revocation. As a result of the following certificate being revoked, N1, E2, and E3 were removed from the graph.

  • Subject: CN=SAFE Bridge CA 02, OU=Certification Authorities, O=SAFE-Biopharma, C=US
  • Issuer: CN=Trans Sped Mobile eIDAS QCA G2, OU=Individual Subscriber CA, O=Trans Sped SRL, C=RO
  • Validity: August 30, 2017 to August 30, 2023
  • Serial: 6190bbe94ab32937
  • SHA1 Hash: 17b547ebe24797e2fa48622de70986a301e93e65
  • Key Size: 2048-bit (RSA)
  • Signing Algorithm: SHA-256 with RSA
  • Note: the SAFE Bridge CA 02's certificate issued by the Federal Bridge CA G4 was revoked last month.
    

Other updates:

• Federal Common Policy CA Migration Playbook
  • Updated Red Hat Enterprise Linux steps (thank you to CMS for sharing!)
  • Updated Entrust "link" certificate verbiage on FAQ per NSF recommendation (thank you, Darren!)
• Added System Notification:
  • CertiPath Bridge CA - G3 intent to modify Federal Bridge CA G4 (#862)

[ryancdickson]

Temporarily closing pull request to make some updates recommended at today's CISA office hours.