New CA needed for IDS-testbed

International-Data-Spaces-Association / IDS-testbed

Apache License 2.0

24 stars 32 forks source link

Open jfernandezsqs opened 1 year ago

jfernandezsqs commented 1 year ago

Waiting for ATOS CA implementation.

jfernandezsqs commented 1 year ago

The CA in the repo should provide an OCSP to enable revocation of issued certificates and checking the revocation status.

Sonia-IDSA commented 1 year ago

The certificates generated by the actual IDS-testbed CA do not have Subject Alternative Name to determine DNS and IP-address.

Currently, the DNS is handled by custom TLS certificates.

mokamhuber commented 1 year ago

We should take care that the CA tool fulfills at least the following requirements:

capability to issue certificates using the cryptographic mechanisms and other cert features specified in the CA specification
possibility to offer an OCSP server which issues OCSP responses on request
Dependencies should be kept to a minimum - no disproportionate requirements concerning the environment or additional tooling necessary for executing the tools

mokamhuber commented 1 year ago

suggestions for tooling from the SubWG meeting:

CFSSL: https://github.com/cloudflare/cfssl -> should be able to fulfill the requirements above, in the Repo https://github.com/Fraunhofer-AISEC/ids-pcp is an example how the IDS PKI could be configured/set up
PKI-Engine: https://developer.hashicorp.com/vault/tutorials/secrets-management/pki-engine -> Carlos will ask his colleagues to support with the assessment of this tool

jfernandezsqs commented 1 year ago

SQS has performed a Demo of the Atos Web Portal CA during the Sub-working Group bi-weekly meeting.