[security-devroom] [Talk/Demo Submission] Dogtag Certificate System (open source PKI)
Heya, Here is my talk/demo submission for "Hardware Security and Cryptography" room at Fosdem. I also added it to the below wiki (I'd prefer to do a demo if time permits) http://www.opensc-project.org/opensc/wiki/FOSDEM2012 Abstract for 'Dogtag Certificate System': -------------------------------------------------- This talk gives a brief overview of Dogtag Certificate System, an open-source and open-standards based scalable PKI(public-key infrastructure) solution. It lets you manage digital certificate life cycle -- common operations like certificate issuance, revocation, retrieval, renewal, manage Certificate Revocation Lists, certificate status checking using OCSP, key archival/recovery. The talk also provides a deployment overview of different configurable subsystems like CA(Certificate Authority) -- this is the core part of certificate system which handles basic certificate management operations. Other subsystems include DRM(data recovery manager) -- which is used for 'key' archival and recovery; OCSP(online certificate status protocol) -- for checking whether a certificate is valid. RA(Registration Authority) -- for locally generating and submitting certificate requests(and validate them) effectively reducing load on CA. There are couple of other subsystems for token management (TKS/TPS) Demonstration: ------------------- If possible, I'd also prefer to show a quick demo of configuring different subsystems like CA, KRA(Key Recovery Archival), OCSP, RA(Registration Authority) using virtual machines on my laptop with the current upstream dogtag pki . This would hopefully be useful for sys. admins trying to deploy an enterprise class PKI. (I'd be using some test scripts[2], but, I may use slightly updated scripts at that time of demo.) Affiliation/Bio: ---------------- I'm Kashyap Chamarthy, a test engineer at Red Hat. I help test open source Identity and Security(PKI) technologies[2][3]. I also test and deploy a lot of upstream Linux(KVM based) virtualization as part of my lab infrastructure. Looking ahead to learn some finer details about open-source crypto at FOSDEM and meet some cool folks. [1] http://kashyapc.fedorapeople.org/dogtag-pki/ [2] http://pki.fedoraproject.org [3] http://freeipa.org
On 2011-11-16 16:59, Kashyap Chamarthy wrote:
Affiliation/Bio: ---------------- I'm Kashyap Chamarthy, a test engineer at Red Hat. I help test open source Identity and Security(PKI) technologies[2][3]. I also test and deploy a lot of upstream Linux(KVM based) virtualization as part of my lab infrastructure.
Looking ahead to learn some finer details about open-source crypto at FOSDEM and meet some cool folks.
Looking forward to meeting you too. Stef
Hello Kashyap, I look forward to hearing some more about Dogtag system, especially from the system-administrator perspective. What I'd be interested as well would be possibility of interoperability between EJBCA and Dogtag (since I'm planning on extending my cookbook at some point). Deploying Dogtag on a non-Fedora/RHEL/CentOS system would also be an interesting thing to see. Best regards :) P.S. Any chance of setting-up some kind of LiveCD with Dogtag on top of it for handing out to people - or even downloadable image would do? Дана Wed, 16 Nov 2011 21:29:57 +0530 Kashyap Chamarthy <kashyap.cv@gmail.com> написа:
Heya,
Here is my talk/demo submission for "Hardware Security and Cryptography" room at Fosdem. I also added it to the below wiki (I'd prefer to do a demo if time permits)
http://www.opensc-project.org/opensc/wiki/FOSDEM2012
Abstract for 'Dogtag Certificate System': -------------------------------------------------- This talk gives a brief overview of Dogtag Certificate System, an open-source and open-standards based scalable PKI(public-key infrastructure) solution. It lets you manage digital certificate life cycle -- common operations like certificate issuance, revocation, retrieval, renewal, manage Certificate Revocation Lists, certificate status checking using OCSP, key archival/recovery.
The talk also provides a deployment overview of different configurable subsystems like CA(Certificate Authority) -- this is the core part of certificate system which handles basic certificate management operations. Other subsystems include DRM(data recovery manager) -- which is used for 'key' archival and recovery; OCSP(online certificate status protocol) -- for checking whether a certificate is valid. RA(Registration Authority) -- for locally generating and submitting certificate requests(and validate them) effectively reducing load on CA. There are couple of other subsystems for token management (TKS/TPS)
Demonstration: ------------------- If possible, I'd also prefer to show a quick demo of configuring different subsystems like CA, KRA(Key Recovery Archival), OCSP, RA(Registration Authority) using virtual machines on my laptop with the current upstream dogtag pki . This would hopefully be useful for sys. admins trying to deploy an enterprise class PKI. (I'd be using some test scripts[2], but, I may use slightly updated scripts at that time of demo.)
-- Branko Majic Jabber: branko@majic.rs Please use only Free formats when sending attachments to me. Бранко Мајић Џабер: branko@majic.rs Молим вас да додатке шаљете искључиво у слободним форматима.
On Fri, Nov 18, 2011 at 1:13 AM, Бранко Мајић <branko@majic.rs> wrote:
Hello Kashyap,
I look forward to hearing some more about Dogtag system, especially from the system-administrator perspective. What I'd be interested as well would be possibility of interoperability between EJBCA and Dogtag (since I'm planning on extending my cookbook at some point).
Branko, Sure, we can try out. I haven't tried EJBCA yet, would be interesting to see how they play together.
Deploying Dogtag on a non-Fedora/RHEL/CentOS system would also be an interesting thing to see.
Best regards :)
P.S. Any chance of setting-up some kind of LiveCD with Dogtag on top of it for handing out to people - or even downloadable image would do?
That's a neat idea. I'll spin up a live-iso(mostly Fedora-16 based) w/ dogtag pki and will put it out on web. Will respond here once I'm done. (My travel is not yet confirmed.) -- /kashyap
Дана Wed, 16 Nov 2011 21:29:57 +0530 Kashyap Chamarthy <kashyap.cv@gmail.com> написа:
Heya,
Here is my talk/demo submission for "Hardware Security and Cryptography" room at Fosdem. I also added it to the below wiki (I'd prefer to do a demo if time permits)
http://www.opensc-project.org/opensc/wiki/FOSDEM2012
Abstract for 'Dogtag Certificate System': -------------------------------------------------- This talk gives a brief overview of Dogtag Certificate System, an open-source and open-standards based scalable PKI(public-key infrastructure) solution. It lets you manage digital certificate life cycle -- common operations like certificate issuance, revocation, retrieval, renewal, manage Certificate Revocation Lists, certificate status checking using OCSP, key archival/recovery.
The talk also provides a deployment overview of different configurable subsystems like CA(Certificate Authority) -- this is the core part of certificate system which handles basic certificate management operations. Other subsystems include DRM(data recovery manager) -- which is used for 'key' archival and recovery; OCSP(online certificate status protocol) -- for checking whether a certificate is valid. RA(Registration Authority) -- for locally generating and submitting certificate requests(and validate them) effectively reducing load on CA. There are couple of other subsystems for token management (TKS/TPS)
Demonstration: ------------------- If possible, I'd also prefer to show a quick demo of configuring different subsystems like CA, KRA(Key Recovery Archival), OCSP, RA(Registration Authority) using virtual machines on my laptop with the current upstream dogtag pki . This would hopefully be useful for sys. admins trying to deploy an enterprise class PKI. (I'd be using some test scripts[2], but, I may use slightly updated scripts at that time of demo.)
-- Branko Majic Jabber: branko@majic.rs Please use only Free formats when sending attachments to me.
Бранко Мајић Џабер: branko@majic.rs Молим вас да додатке шаљете искључиво у слободним форматима.
_______________________________________________ Security-devroom mailing list Security-devroom@lists.fosdem.org http://lists.fosdem.org/mailman/listinfo/security-devroom
2011/11/18 Kashyap Chamarthy <kashyap.cv@gmail.com>:
On Fri, Nov 18, 2011 at 1:13 AM, Бранко Мајић <branko@majic.rs> wrote:
Hello Kashyap,
I look forward to hearing some more about Dogtag system, especially from the system-administrator perspective. What I'd be interested as well would be possibility of interoperability between EJBCA and Dogtag (since I'm planning on extending my cookbook at some point).
Branko,
Sure, we can try out. I haven't tried EJBCA yet, would be interesting to see how they play together.
Deploying Dogtag on a non-Fedora/RHEL/CentOS system would also be an interesting thing to see.
Best regards :)
P.S. Any chance of setting-up some kind of LiveCD with Dogtag on top of it for handing out to people - or even downloadable image would do?
That's a neat idea. I'll spin up a live-iso(mostly Fedora-16 based) w/ dogtag pki and will put it out on web. Will respond here once I'm done. (My travel is not yet confirmed.)
-- /kashyap
Дана Wed, 16 Nov 2011 21:29:57 +0530 Kashyap Chamarthy <kashyap.cv@gmail.com> написа:
Heya,
Here is my talk/demo submission for "Hardware Security and Cryptography" room at Fosdem. I also added it to the below wiki (I'd prefer to do a demo if time permits)
http://www.opensc-project.org/opensc/wiki/FOSDEM2012
Abstract for 'Dogtag Certificate System': -------------------------------------------------- This talk gives a brief overview of Dogtag Certificate System, an open-source and open-standards based scalable PKI(public-key infrastructure) solution. It lets you manage digital certificate life cycle -- common operations like certificate issuance, revocation, retrieval, renewal, manage Certificate Revocation Lists, certificate status checking using OCSP, key archival/recovery.
The talk also provides a deployment overview of different configurable subsystems like CA(Certificate Authority) -- this is the core part of certificate system which handles basic certificate management operations. Other subsystems include DRM(data recovery manager) -- which is used for 'key' archival and recovery; OCSP(online certificate status protocol) -- for checking whether a certificate is valid. RA(Registration Authority) -- for locally generating and submitting certificate requests(and validate them) effectively reducing load on CA. There are couple of other subsystems for token management (TKS/TPS)
Demonstration: ------------------- If possible, I'd also prefer to show a quick demo of configuring different subsystems like CA, KRA(Key Recovery Archival), OCSP, RA(Registration Authority) using virtual machines on my laptop with the current upstream dogtag pki . This would hopefully be useful for sys. admins trying to deploy an enterprise class PKI. (I'd be using some test scripts[2], but, I may use slightly updated scripts at that time of demo.)
Hi, for those interested, slides and some examples scripts for instance creation - I've posted here: http://kashyapc.fedorapeople.org/fosdem2012-dogtag-pki-demo/
-- Branko Majic Jabber: branko@majic.rs Please use only Free formats when sending attachments to me.
Бранко Мајић Џабер: branko@majic.rs Молим вас да додатке шаљете искључиво у слободним форматима.
_______________________________________________ Security-devroom mailing list Security-devroom@lists.fosdem.org http://lists.fosdem.org/mailman/listinfo/security-devroom
My presentation, slightly spell corrected can be found at: http://wwwpriv.primekey.se/~tomas/presentations/commoncriteria-opensource-5-... Cheers, Tomas
participants (4)
-
Kashyap Chamarthy -
Stef Walter -
Tomas Gustavsson -
Бранко Мајић