...
For information about the Certificate issuing process please refer to the OpenPEPPOL public space and section /wiki/spaces/Public/pages/191496224
The short version
The OpenPeppol network is migrating to a new PKI infrastructure.
- After 2018-09-03 00:00:00 all Access Points in the network MUST entrust both the current PKI infrastructure and the new PKI infrastructure. Transactions can still be sent using ANY PKI infrastructure.
- After 2018-11-30 23:59:59 all Access Points in the network MUST only send and receive transactions using the new PKI infrastructure.
Background
The decision reason why this migration is necessary and why it cannot wait until the current PKI infrastructure expires is based on several reasons;the following:
- Improved security. The current PKI infrastructure is based on SHA-1 cryptography which not long time ago was , which was recently announced as not recommended to for use, due to discovered exploits. The new PKI infrastructure will issue be based on certificates supporting SHA-256 cryptography which currently is the recommended web standard.
- Responsible organization. In the current PKI infrastructure, the issuing agency organization is "DIGST" (Danish Agency for Digitisation) and it a request has been requested that made to move this responsibility is migrated to the correct organizationto the appropriate organization (OpenPEPPOL AISBL).
- Minor improvements. Some smaller changes to the naming convention of the certificates conventions will make it easier to maintain the certificates and also to utilize a more cost effective pricing model which will not be will be based on issued certificate but on taken seatsthe member level rather than on the individual certificates.
Dictionary
Term | Clarification |
---|---|
AP | Peppol Access Point |
SMP | Service Metadata Publisher |
T1 | Date when PKI migration starts |
T2 | Date when PKI migration ends |
C1 | Internal |
date when issuing of PKI v3 certificates will commence | |
C2 | Internal date when PKI v2 certificates can no longer be issued |
Exchange transactions | Ability for |
a PEPPOL Access Point to both send and receive transactions |
PKI v2 |
Certificates | The PKI certificates that are currently in use, that we are migrating from |
PKI v3 |
Certificates | The PKI |
certificates being implemented, that we are migrating to |
Process implementation and timeline
Refer to the graph below;
- After C1 the operational office of OpenPeppol will commence issuing of PKI v3 certificates.
- Up until date T1;
- All APs MUST be able to exchange transactions using the PKI v2 Infrastructurecertificates.
- All SMPs MUST support PKI v2 Infrastructurecertificates.
- SML MUST support PKI v2 Infrastructurecertificates.
- PEPPOL Directory MUST support PKI v2 Infrastructurecertificates.
- After date T1 and until date T2;
- All APs MUST be able to initiate a transaction (send) using ANY of the two available PKI infrastructures certificates (v2 or v3).
- All APs MUST be able to support receiving transactions initiated using BOTH available PKI infrastructure certificates (v2 and v3).
- All SMPs MUST support BOTH available PKI infrastructure certificates (v2 and v3).
- Before C1C2;
- All (operational before T1) AP and SMP providers will have been issued certificates from the PKI v3 infrastructure (this is an internal OpenPeppol deadline).
- After date T2;
- All APs MUST only be able to exchange only exchange transactions using PKI v3 Infrastructurecertificates.
- All SMPs MUST only support PKI v3 infrastructure..certificates.
C1 = 2018-04-18 00:00:00
T1 = 2018-09-03 00:00:00
C1 C2 = 2018-10-31 23:59:59
T2 = 2018-11-30 23:59:59
Technical implementation
How to implement this from a technical point of view is dependent on the AP or SMP platform used. There will not be a guideline available for every platform, but the general approach is as follows.
...
- Before T1. Prepare your implementation so that it will be able to entrust transactions/signatures using the PKI v3 Infrastructurecertificates.
- Between T1 and T2 (and before C1). You will be issued a client certificate from the PKI v3 infrastructure. Replace For your Peppol Access Point implementation, replace the current client certificate with the new one. Remember to update all participants in your SMP with public part of the new Any receivers (participants) you might have registered in an SMP must also be updated with the public key of the issued PKI v3 certificate.
- After T2. Patch your implementation so it no longer entrusts transactions/signatures using the current (then old) PKI infrastructurecertificates.
For SMP providers;
- Between T1 and T2. You will be issued a client certificate from the PKI v3 infrastructure. Replace the current client certificate with the new one. (we need to add more documentation here, there is a process for this part of the migration that has been documented by CEF)
The needed Root and Intermediate CAs are available for download here.
Access Point | SMP | PEPPOL Directory | SML | OpenPEPPOL | |||
---|---|---|---|---|---|---|---|
Sending | Receiving | Server | Client | ||||
No later than T1 |
|
|
|
|
| After T1 only v3 certificates will be issued. | |
After C1 | All service providers should have a v3 certificate. | ||||||
No later than T2 |
|
|
|
|
|
| |
After T2 |
|
|
|
|
|
|
...
Provider | In PROD before T1 | In TEST before T1 | In TEST after T1 | Enter TEST after T1 | Certificate expire expires before T2 | Certificate expire expires after T2 | Recommendation |
---|---|---|---|---|---|---|---|
AP/SMP | YES | - | - | - | YES | You will be prioritized in the process for being issued a PKI v3 certificate before T1. If you still believe you will not have time to install it can't install it before end of expiry of PKI v2 certificate certificates, then renew PKI v2 certificate and follow matching recommendation for that situationscenario. | |
AP/SMP | YES | - | - | - | YES | Before C1 you will have been issued a PKI v3 certificate. Make sure to implement this certificate into your platform before T2. | |
AP/SMP | - | YES | - | - | If you complete your tests and become eligible for a PROD certificate before T1. You will be prioritized in the process for being issued a PKI v3 PROD certificate before T1. | ||
AP/SMP | - | YES | - | - | If you complete your tests and become eligible for a PROD certificate before T2, you will be issued a PKI v3 PROD certificate. If you fail to complete your tests before T2, you will have to reapply for a PKI v3 TEST certificate. | ||
AP/SMP | - | YES | - | - | You will use a PKI v3 TEST certificate for your testing .You will be issued a PKI v3 PROD certificate when you complete tests and become eligible for a PROD certificate. |
...