Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

For information about the Certificate issuing process please refer to the OpenPEPPOL public space  for space and section /wiki/spaces/Public/pages/191496224

...

  • Improved security. The current PKI infrastructure is based on SHA-1 cryptography which not long time ago was announced as not recommended to use due to discovered exploits. The new PKI infrastructure will issue certificates supporting SHA-256 cryptography which currently is the recommended web standard.
  • Responsible organization. In current PKI infrastructure the issuing agency organization is "DIGST" (Danish Agency for Digitisation) and it has been requested that this responsibility is migrated to the correct organization.
  • Minor improvements. Some smaller changes to the naming convention of the certificates will make it easier to maintain the certificates and also utilize a more cost effective pricing which will not be based on issued certificate but on taken seat.seats.

Dictionary

TermClarification

AP

Peppol Access Point
SMPService Metadata Publisher
T1Date when PKI migration starts
T2Date when PKI migration ends
C1Internal date for when no certificated for PKI v2 Infrastrcuture can be issued
exchange transactionsAbility for an Access Point to both send and receive transactions
PKI v2 Infrastructure

The current PKI infrastructure that is used and from which we aim at migrating from

PKI v3 InfrastructureThe PKI infrastructure which is currently being put in place and at which we aim at migrating to

Process implementation and timeline

...

  1. Up until date T1;
    1. All APs MUST support current PKI infrastructure. (clarify what 'support' really means for sending/receiving)be able to exchange transactions using the PKI v2 Infrastructure. 
    2. All SMPs MUST support current PKI infrastructurev2 Infrastructure.
    3. SML MUST support current PKI infrastructurev2 Infrastructure.
    4. PEPPOL Directory MUST support current PKI infrastructurev2 Infrastructure.
  2. After date T1 and until date T2;
    1. All APs MUST initiate a transaction (send) using ANY of the two available PKI infrastructures (v2 or v3).
    2. All APs MUST support receiving transactions initiated using BOTH current available PKI infrastructure AND the new(v2 and v3).
    3. All SMPs MUST support BOTH current available PKI infrastructure (v2 and the new v3).
  3. Before C1;
    1. All (operational before T1) AP and SMP providers will have been issued certificates from the new PKI v3 infrastructure . (Update: OpenPEPPOL internal (this is an internal OpenPeppol deadline).
  4. After date T2;
    1. All APs MUST only support new PKI infrastructurebe able to exchange transactions using PKI v3 Infrastructure.
    2. All SMPs MUST only support new PKI v3 infrastructure..

T1 = 2018-0409-03 00:00:00 (Suggestion Rune: too early)

C1 = 2018-0810-15 31 23:59:59 (Suggestion: 2018-09-15)

T2 = 2018-0911-30 23:59:59 (Suggestion: 2018-10-30)
Image Removed

Technical implementation

How to implement this from a technical point of view is dependent on the AP or SMP platform used. There will not be a guideline available for every platform, but the general approach is as follows.

...

  1. Before T1. Prepare your implementation so that it will be able to entrust transactions/signatures using the new PKI infrastructurev3 Infrastructure.
  2. Between T1 and T2 (and before C1). You will be issued a client certificate from the new PKI v3 infrastructure. Replace the current client certificate with the new one. Remember to update all participants in your SMP with public part of the new certificate.
  3. After T2. Patch your implementation so it no longer entrusts transactions/signatures using the current (then old) PKI infrastructure.

...

  1. Between T1 and T2. You will be issued a client certificate from the new PKI v3 infrastructure. Replace the current client certificate with the new one. (we need to add more documentation here, there is a process for this part of the migration that has been documented by CEF)

The needed CAs are available for download here.

v2: current PKI version.

v3: new PKI version


certificates issued for PKI v2.

??Question PH: doesn't that also mean: every participant received a new v3 certificate?


Access PointSMP

PEPPOL Directory

SMLOpenPEPPOL

SendingReceivingServerClient


No later than T1
  • Must be able to validate MDNs signed with PKI v3.
  • MUST accept an incoming transaction signed with either PKI v2 or PKI v3.

  • Must accept responses signed with PKI v2 and v3
  • MUST accept SMP client certificates for both PKI v2 and v3.
  • MUST accept SMP client certificates for both PKI v2 and v3.
After T1 only v3 certificates will be issued.
After C1





All service providers should have a v3 certificate.

No No later than T2
  • MUST be able to sign transactions with PKI v3.
  • Must use PKI v3 to sign MDNs
  • MUST update AP configuration with AP certificate PKI v3.
  • Provide PKI v3 SMP certificate to SML operator so they can update their entry.
  • Update all SMP entries to use a PKI v3 AP certficate
  • Must use PKI v3
  • Must use PKI v3
  • Must use PKI v3

After T2
  • Disable PKI v2 support
  • Disable support for receiving transactions signed with PKI v2.
  • Disable PKI v2 support
  • Disable PKI v2 support
  • Disable PKI v2 support
  • Disable support for SMP client PKI v2 certs.

...

ProviderIn PROD before T1In TEST before T1In TEST after T1Enter TEST after T1Certificate expire before T2Certificate expire after T2Recommendation
AP/SMPYES---YES
You will be prioritized in the process for being issued a NEWPKI PKI v3 certificate before T1. If you still believe you will not have time to install it before end of expiry of OLDPKI PKI v2 certificate then renew OLDPKI PKI v2 certificate and follow matching recommendation for that situation.
AP/SMPYES---
YESBefore C1 you will have been issued a NEWPKI PKI v3 certificate. Make sure to implement this certificate into your platform before T2.
AP/SMP-YES

--If you complete your tests and become eligible for a PROD certificate before T1. You will be prioritized in the process for being issued a NEWPKI PKI v3 PROD certificate before T1.
AP/SMP-
YES
--If you complete your tests and become eligible for a PROD certificate before T2, you will be issued a NEWPKI PKI v3 PROD certificate. If you fail to complete your tests before T2, you will have to reapply for a NEWPKI PKI v3 TEST certificate.
AP/SMP-

YES--You will use NEWPKI PKI v3 TEST certificate for your testing .You will be issued a NEWPKI PKI v3 PROD certificate when you complete tests and become eligible for a PROD certificate.

* NEWPKI - Refers to the new PKI infrastructure that will become mandatory after T2.

* OLDPKI - Refers to the current PKI infrastructure we are about to obsolete.