Project Approach

The flexible & easily implemented CA

[13] Multiple customized Root Certificates, Intermediate Root Certificates and EU Qualified Certificates can also be catered for. Every aspect of the Digital Certificate including Certificate fields can all be customized to meet any x.509 standard requirement.

Whether your requirement is for a simple to use and operate CA that is installed as software inside the organization or a totally outsourced service, Digi-CA™ can meet your precise requirements. Highly customized and complex CA environments and even a certified Trust Centre [10] that complies with international standards [9] can be built-to-order using Digi-CA™ Server. And you can also have almost all these same functionalities, no matter how complex, delivered as a service from outside the organization using the Digi-CA™ Service. No matter how it’s delivered, Digi-CA™ is the most flexible, efficient and cost effective CA system for you.

Digi-CA™ can be delivered exactly to your requirements. You can choose to have Digi-Sign do everything for you and ‘Fast Track’ your requirements, or you can be proactively involved at whatever level you like.


Your Approach at Your Speed

Implementing a Certificate Authority is not a ‘one size fits all’ project. Your requirement might be for a few hundred users with exceptionally high security parameters or you could be looking to authenticate several million hardware devices. The commercial organization’s requirements are typically related to cost, benefit, risk and return whilst the government project is more concerned with statutory requirements, IT standards and compliance [9].

No matter how small or large your requirement, you’ll have restrictions on what your current environment can cope with; availability of staff; budgetary constraints and other parameters within which you must choose the correct CA for your organization. You may want to be very ‘hands on’ at every stage of the project and even want to conduct some of the integration and even programming or you may decide you want us to do everything for you. Just as Digi-CA™ is totally flexible, so too is the Digi-Sign approach.

‘Fast Track’ Approach

Everything Delivered as Instructed

[13] AACD™ System [14] ‘Fast Track’ is exactly as it sounds, you want everything done as quickly as possible and you want the professionals to do it for you. This is a total ‘turn key’ approach where we take your instructions, document them and deliver the entire solution back to you in the shortest possible time. Once the Digi-CA™ is delivered, you nominate personnel within your organization to take responsibility for it and we support them in the background.


Total Trust Management™ Approach

This is where we not only ‘Fast Track your requirements through to delivery but actually assume responsibility for the total management of your CA environment for as long as you need us too.

Total Trust Management™ [TTM™] [15] is a unique offering from Digi-Sign (although some try to copy it) and it means that you Trust us to Totally Manage the Digi-CA™ for you. TTM™ is much more than a dedicated telephone support line, it’s a service where Digi-Sign personnel effectively work for you. We ensure that the CA technology is introduced to the end users with the minimum of fuss. All you do is agree how you want us to operate the Digi-CA™, and we do everything for you. It’s a bit like travelling First Class.

75% of our customers use TTM™ in the first year, at least, so that they can see how we do everything and then learn by watching us, see section 3.3 for more details.

Build-Box-Deliver Approach

You call us, we document your requirement, you sign the order and then we build, box and either ship it to you for installation or we host it for you so that it only needs to be activated.

If your requirements include integration work or customization, this is scheduled and delivery is subject to Production scheduling and all of this is agreed in advance.

‘Fast Track’ Your Requirements

The success or failure of any project can normally be traced back to the start, where bad planning will be found. This poor initial planning will either be as a result of bad management and leadership and to a lesser extent, the selection of technically inexperienced personnel. That is why Digi-Sign insists that no matter how much 'trouble' the project encounters en route, if it is properly planned initially, it will succeed.

Digi-CAST™ [8] is factual, high-quality, Digital Certificate and CA advice from experienced personnel that can show you how your CA should be implemented, integrated and maintained. The C-A-S-T method was pioneered by Digi-Sign in 2005 after many years of developing and deploying CAs around the world.

Technical Overview

System Specification & Configuration

[16] The Digi-CA™ system is a complete system containing all of the necessary Operating System [OS], modules, directories and engines required to operate a fully functional CA system.


Security

Digi-CA™ has been designed by some of the foremost experts in Internet Application Security. All modules are contained in one Linux / Unix based system. Specific care has been taken in the design of Digi-CA™ to ensure that no outside intrusion can take place and that all the private Keys for the Digi-CA™ are secure (if they are not stored on a HSM).

To ensure the uniqueness of the keys in the Digi-IDs™, Digi-CA™ uses its own entropy system. Digi-CA™ can create Key lengths up to 9192-bits. It can also support all key ciphers and signature algorithms.

Depending on the level of security required, Administrators must be authenticated by either a smart card [Digi-Card™], a USB Tokens [Digi-Tokens™] and/or a biometric reader.

Encryption

The entire Digi-CA™ system infrastructure is formed mainly around x.509 certificates, produced with accordance to the internationally recognized RFC 2459 standard and is maintained in accordance to the same internationally recognized RFC 3647 standard.

The design of a typical x.509 Certificate includes the following cryptographic algorithms that are approved for commercial use by governments and related agencies and institutions around the world.

Signature Algorithms

The Signature Algorithm uses RSA and DSA and as these algorithms are always used in conjunction with a one-way hash function, the following hash functions can be applied:

• MD2 (not in common use anymore)
• MD5
• SHA-1
• SHA-256 (Digi-CA™ Server only)
• SHA-512 (Digi-CA™ Server only)

Algorithms & Compatibility

Key Algorithms & Browser Compatibility

Signature Key Algorithms

[16] The Signature Key generation algorithms use RSA and DSA (Digi-CA™ Server only).

Other Standards & Algorithms

The x.509 certificate can be used for many purposes, such as: electronic signature, two factor authentication [4], client authentication, email signing and encryption and many other applications.

The most common and most frequently used purposes can be included using further layers of security protocols and cryptographic algorithms, the most common of which are:

• AES: Advanced Encryption Standard;
• S/MIME AES: Secure / Multipurpose Internet Mail Extensions [S/MIME] Advanced Encryption Standard for secure email [3] messaging;
• 3DES Encryption: Triple DES encryption algorithm standard;
• IDEA Encryption: IDEA encryption algorithm standard;
• SSLv3: version 3 of the Secure Socket Layer [17] protocol used for secure web access;
• TLSv1: version 1 of the Transport Layer Security protocol used for secure web access;
• and Others in accordance with specific customer projects and requirements.

Compatibility

Digi-SSLs™ and Digi-Codes™ require browser compatibility. Digi-IDs™ require browser compatibility and email software compatibility when being used for Digi-Mail™ [18]

Browser Client Compatibility

The following is a list of browsers that are compatible with Digi-SSLs™, Digi-Codes™ and Digi-IDs™:

• Microsoft® Internet Explorer 5.5
• Microsoft® Internet Explorer 6.x+
• AOL® 5+*
• Opera 5+*
• Safari 1.2*
• Mozilla/5 1.7.2*
• Firefox 1.0*
• Netscape 4.x*
• Netscape 8.1+*

Email Client Compatibility

The following is a list of browsers that are compatible with the Digi-IDs™ used for Digi-Mail™:

• Microsoft® Outlook Express 5.5
• Microsoft® Outlook Express 6.x+
• Microsoft® Outlook 98, ME, 2000, 2003, XP
• AOL® Instant Messenger 5.2+
• Eudora 3.1+ (with EMS API plug-in)*
• Safari 1.2*
• Mozilla/5 1.7.2*
• Firefox 1.0*
• Netscape 4.x*
• Netscape 8.1+*

Performance Data

Cryptography, Speed & System Capabilities

[16] Number of certificates: 200 up to 200,000,000

Production speed: Without HSM up to 5,000 1024-bits Digi-IDs™/hour
With HSM up to 10,000 1024-bits Digi-IDs™/hour

Key length: Root and Intermediate Certificates 9196-1024 bits
Digi-IDs™ 1024-2048 bits
Symmetric Keys 56 to 256 bits

Key validity: Root Key 1 to 25 years
Intermediate Keys 1 to 10 years
Client Keys 1 to 10 years (as per Digi-ID™ Policy)

Key storage: Root Key off-line and stored in several separate pieces Intermediate (signing) keys access through HSM, biometric client certificates [3], smart card or USB tokens

Cryptographic Ciphers: AES, Blowfish, CAST5, DES, 3DES, IDEA, RC2, RC4, RC5 and RSA

Signature Algorithms: MD2, MD4, MD5, MDC2, SHA1 (DSSI) and RIPEMD-160

Entropy: 2127

Using Digi-IDs™

Uses for Digital Certificates

Certificate Authentication, Privacy & Integrity

[16] The authentication, privacy and integrity of the Digi-ID™ is governed by several factors:

Security Protocols

Root Key Ceremony [19]

Distribution Processes

S/MIME Technology

Validations

• Security Protocols

SSL and TLS are protocols that are used to provide secure Web communications on intranets and the Internet. TLS is the standardized (by the Internet Engineering Task Force [IETF]) version of SSL and is also referred to as SSL version 3.1, whereas the most commonly used SSL version is 3.0. Both protocols can provide the following basic security services:

• Mutual Authentication

Mutual Authentication verifies the identities of both the server and the client through the exchange and validation of their Digital Certificates.

• Communication Privacy

Communication Privacy encrypts information exchanged between secure servers and secure clients using a secure channel.

• Communication Integrity

Communication Integrity verifies the integrity of the contents of messages exchanged between the client and the server, which ensures that messages haven’t been altered en route.

Digi-IDs™ are an integral part of a total environment. Whether it is a simple case of using Digi-IDs™ to secure email [3] or using them for authentication purposes in a larger workflow business process, in all cases, Digi-IDs™ are easy to deploy.

Root Key Ceremony

Overview of the Key Ceremony Requirements

[16] At the heart of every Digi-CA™ are at least one Root Key(s) or Root Certificate(s) and one Intermediate Root Certificate(s). Every Digi-CA™ Certificate is made from a Public and a Private Key. A Root Key Ceremony is a procedure where a unique pair of Public and Private Root Keys is generated. Depending on the Certificate Policy, the generation of the Root Keys may require notarization, legal representation, witnesses and ‘Key Holders’ to be present. This process is best explained with some examples:

Example A: Strong identification & non-repudiation for email & web access

Unless the information being accessed or transmitted is valued in terms of millions of dollars, it is probably sufficient that the Digi-CAST2™ Team [8] conduct the Root Key Ceremony within the security of the Digi-CAST2™ Laboratory. The customer may opt to have the Root Key stored on a Luna Card or HSM, but in most cases the safe storage of the Root Key on a CD or hard disk is sufficient. The Root Key is never stored on the Digi-CA™ server.




Example B: Machine Readable Travel Document [MRTD [6]] ID Card or e Passport [20]

This type of environment requires much higher security than a commercial one. When conducting the Root Key Ceremony, the Government or Organization will require rigorous security checks to be conducted on all personnel in attendance. Those that are normally required to attend the Key Ceremony will include a minimum of two Administrators from the organization, two signatories from the organization, one lawyer, a notary and two video camera operators in addition to the Digi-CAST2™ Team.

The actual Root Key-Pair generation is normally conducted in a secure vault that has no communication or contact with the outside world other than a single telephone line or intercom. Once the vault is secured, all personnel present must prove their identity using at least two legally recognized forms of identification. Every person present, every transaction and every event is logged by the lawyer in a Root Key Ceremony Log Book and each page is notarized by the notary. From the moment the vault door is closed until it is re-opened, everything is also video recorded. The lawyer and the two organization’s signatories must sign the recording and it too is then notarized.

Finally, as part of the above process, the Root Key is broken into as many as twenty-one parts and each individual part is secured in its own safe for which there is a key and a numerical lock. The keys are distributed to as many as twenty-one people and the numerical code is distributed to another twenty-one people.


Important Note: Example A and B are at opposite ends of the security spectrum and no two environments are the same. When considering the Root Key Ceremony, the Digi-CAST1™ Team [8] of professional advisors can assist you in deciding on the most efficient level of security to reflect the level of protection required.

Processes

Processes Used in Issuing a Digi-ID™

[16] A standard process for issuing a Digi-ID™ [21] Certificate involves the following stages:

• Using the Digi-CA™ Control Centre, the Administrator initiates a Digi-ID™ invitation email message that is sent to the intended recipient (user)




• The recipient (user) enters the Digi-ID™ Application Online Form using the URL provided in the Digi-ID™ invitation email message




• The user completes the Digi-ID™ Application Online Form by providing personal information such as:
• Full name
• Email address
• Organisation (it is possible to restrict the value of the Organisation to a pre-defined read-only string)
• Organisational Unit/Department
• Locality
• Telephone
• Country (it is possible to restrict the value of the Country to a pre-defined read-only option)
• Secret Question
• Secret Answer
• Other custom values based on the customer requirements




• A Key-Pair (Private and Public Key) and a PKCS#10 Certificate Signing Request [CSR] code is generated on the user PC using a local Cryptographic Service Provider [CSP] engine installed on the user’s computer. It can be either a built-in Microsoft CryptoAPI software engine or a hardware USB Token or Smart Card CSP engine




• Using HTTP POST method over SSL/TLS all the user data is transferred securely to the RA [Registration Authority] Server




• The system Administrator/Validations Officer verifies and validates the user application data and depending on the content of the application, it is either approved or rejected




• If the Digi-ID™ application is approved, the application data is passed to the Certificate Engine core server and the CSR is signed by the Certification Authority Certificate




• The Certificate Engine core server generates a unique key/PIN number and sends a Digi-ID™ Activation email message to the end user. The message contains a URL to activate and install the Digi-ID™ Certificate




• The recipient (user) enters the Digi-ID™ Activation screen from the URL provided in the Certificate activation email and completes the installation of the Digi-ID™ Certificate by clicking the installation button on the screen




• The Digi-ID™ Certificate is collected from directly the Certificate Directory via a background TCP/IP connection and installed on the user’s PC using the CSP engine chosen at the time of the Certificate application




• The user may now use the Digi-ID™ Certificate

Applying for Digital Certificates

Digital Certificate Processing

[16] Digi-IDs™ are requested by the end user at the Enrollment Application Form or by the Administrator (on the users behalf) using the Digi-CA™ Control Centre.

From the Digi-CA™ Control Centre, all Digi-ID™ [21] requests are either entered into the database on an individual basis, using a batch upload file or automatically, depending on the Class of Digi-CA™ you are using. Similarly, all requests for Digi-IDs™ are accepted, rejected or deferred either manually or automatically, depending on the Class of Digi-CA™ you are own, using the RA Control Centre of the Digi-CA™.

The Digi-CA™ system automatically generates a Certificate Signing Request [CSR [22]] if the requesting party did not already supply one and then generates the Digi-ID™. The generation is done in batch processes according to schedules set in crontab. The default is to run the process every hour.

After generation, the Digi-ID™ is activated at the users PC or it can be delivered by email as a .p12 file. Storage of the Digi-ID™ can be on the PC or any suitable media such as a Digi-Card™ or a Digi-Token™. Similarly, the Administrator can pre-install the Digi-ID™ on the Digi-Card™ or Digi-Token™ prior to dispatch. This is particularly convenient where the Administrator wants ‘Zero Touch’ at the user’s location.

The method of distribution is set in the database at the time of the validation. The default is that Digi-IDs™ are distributed over the web, with the Digi-IDs™ holder getting an email containing a one-time password needed to pick it up.

If the billing module is installed, this module is updated with information and then passed on to your billing system.

Digital Signature Overview

Issuing Digi-ID™ Digital Signatures

The following are the steps for issuing a Digi-ID™ Digital Signature:

• Proof of Identity – When the end user first applies for the Digi-ID™, in most cases they must prove their identity. The information or documents required to provide ‘proof of identity’ are decided by the issuing authority and may include official papers and/or other documents. The precise requirement will be clearly identified in the Certificate Policy

• Application Form - An application form must be completed

• Data Check – Once the end user’s application form details are received, the Registration Authority [RA] cross checks or validates the data for accuracy and authenticity

• Approval/Rejection – The RA either approves or rejects the application

• Notification – End user is notified that their Digi-ID™ is available for collection or it is sent out automatically

• Collection – The end user receives the Digi-ID™ and can use this to prove their identity

• Renewal – All Digi-IDs™ are renewed at fixed intervals. Usually the Digi-ID™ is renewed each year or over a longer time period

Dteps for re-issuing/replacing a Digi-ID™

The following are the steps for re-issuing/replacing an existing Digi-ID™ Digital Signature:

• Proof of Identity – When the end user first applies for a Digi-ID™, the information or documents required to provide ‘proof of identity’ are decided in the Certificate Policy

• Application Form - An online application form must be completed

• Data Check – Once the end user’s application form details are received, the Registration Authority [RA] cross checks or validates the data for accuracy and authenticity

• pproval/Rejection – The RA either approves or rejects the application using the online RA Control Centre

• Notification – End user is notified that their Digi-ID™ is available for collection as the final part of the Process or it is simply sent out automatically in a Package

• Collection – The end user receives the Digi-ID™ and can use this to prove their identity

• Renewal – All Digi-IDs™ are renewed at fixed intervals. Usually the Digi-ID™ is renewed each year

Typically the renewal process is simply a case of presenting the previous Digi-ID™ and a new one is issued to replace it

Viewing Your Digital Signature

Custom Breadcrumb: 

<a href="/">Home</a> › <a href="/digi-id">Digi-ID&trade;</a> › View

How to view your Digi-ID™ Digital Signature

Depending on your operating system and browser version, you can view your Digi-ID™ digital signature using the instructions below:

Microsoft® Internet Explorer®		Mozilla/Firefox/Safari
1. To view your Digi-ID™ digital signature in Microsoft® Internet Explorer®, use the Tools menu (you may have to press the 'Alt' button on your keyboard to view this menu) and then select Internet Options 2. In the Internet Options dialog box, select the Content tab and then click the Certificates button 3. In the Certificates dialog box, select the certificate/digital signature you wish to examine and then click the View button 4. The chosen digital signature will be displayed where you will be able to see: The name of the person the digital signature was Issued To The fact that is a Digi-ID™ digital signature issued by Digi-Sign When the digital signature was issued (Valid from) and when it will expire (Valid to) Here is an en example of such a Digi-ID™ digital signature:		1. To view your Digi-ID™ digital signature in Mozilla, Firefox or Safari, use the Tools menu and then select Options 2. In the Options dialog box, select the Encryption tab and then click the View Certificates button 3. In the Certificate Manager dialog box, select the certificate/digital signature you wish to examine and then click the View button 4. The chosen digital signature will be displayed where you will be able to see: The name of the person the digital signature was Issued To The fact that is a Digi-ID™ digital signature issued by Digi-Sign That the digital signature was Issued on and the date it Expires on Here is an en example of such a Digi-ID™ digital signature:

Thumbnail: 

Revoking Digital Signatures

Digi-ID™ Digital Certificate Revoking

Digi-ID™ Revocation

[16] All Digi-ID™ revocations are initiated either by the user or by the Administrator. Revocations are required for a number of reasons, for example:

1. the user has lost the PC or media where the Digi-ID™ was stored.

2. the user no longer has any affiliation with the organisation that issued the Digi-ID™.

3. the user changed position in the organisation and no longer has any right to the Digi-ID™.

4. the Administrator believes a Digi-ID™ has been misused.

5. the Administrator believes a Digi-ID™ used to misrepresent the organization that issued the Digi-ID™.

The following sub sections detail how Revocation requests are made and the resulting actions and uses for this important feature.


Revocation Process

The following diagram explains the events that occur within the Digi-CA™ and how a revocation request is executed:

S/MIME Technology

Digital Certificates for Digi-Mail™

[16] The digital signature [3] and message encryption implementation on email messages is achieved by mechanisms implemented directly in the email client software and that follows the S/MIME standard.

Both S/MIME message encryption and Digital Signatures are based on encryption technologies. Message body encryption creates a completely unreadable message body and Digital Signature. The diagram below shows how the encryption process generates a one-time Symmetric Key (also called a Session Key) that encrypts the message body.

The Symmetric Key is then encrypted with each recipient’s Public Key so that only the recipient can decrypt the Symmetric Key. The message is then sent. On the recipient end, the Private Key is used to decrypt the Symmetric Key, which is then used to decrypt the message. This process is transparent to the user and is performed with no interaction between clients. Symmetric encryption is much faster than asymmetric encryption. The reason is because symmetric encryption encrypts the data (message body) in bulk.

The following diagram describes how email encryption is achieved:

The diagram illustrates the message encryption and decryption process. The four main steps detailed in the illustration are as follows:

1. Message is encrypted with Session Key.

2. Session Key is encrypted with recipient’s Public Key.

3. After encrypted message is received, recipient decrypts Session Key with the recipient’s Private Key.

4. Message is decrypted with Session Key.

When you add a Digital Signature to a message, a hash value of the message contents is computed. User Keys aren’t used to compute the hash value and the hash doesn’t identify anyone. The hash is only a small, unique digital fingerprint of the message. This hash value is then encrypted with the sender’s Private Key, and can be decrypted with the Public Key found in the sender’s certificate.

The recipient decrypts the original hash value with the sender’s Public Key, which might be sent with the signed message or can be found in the sender’s certificate. Your client verifies signatures. For encrypted messages, it decrypts the message first. The client computes a new hash value based on the text received and compared to the original hash value. If they match, you can trust the content’s integrity and the sender’s identity.

Flexibility & Capability

Designed at its 'Core' to meet your needs

The Digi-CA™ system can create multiple instances of unique CAs in a single Digi-CA™ system. The Digi-CA™ model imposes delegation of trust downwards from CAs to their Subordinate Certification Authorities [Sub-CAs]. The same Digi-CA™ system also enables any CA or Sub-CA to be signed or cross signed by an external third party CA. And any number of CAs can have any number of cross signed Sub-CAs. As a result of this design principal, the Digi-CA™ model for trust levels increases towards the highest authority. This type of arrangement facilitates easy deployment and scalability of any PKI requirement from the smallest to the largest.

Digi-CA™ replaces older Traditional PKI [28] technology and CA systems using the latest in CA technology. With Digi-CA™, all of the complexities and onerous technical overhead that were required by Traditional CAs have been simplified to a ‘user-friendly’ and usable level. Digi-CA™ can also be ‘dropped’ on top of these Traditional CA environments and seamlessly migration [29] the older system’s users into this more modern and flexible replacement.

At its core, the Digi-CA™ system works on Unix/Linux operating systems and was written using C programming language for the low application level and PHP at the high level. The design philosophy was that the simplicity of the complete system should also be capable of large scale enterprise or national CA system, so that it could be delivered and scaled, easily. This critical design component has not changed in the past seven years.

To enable this, the modular design of Digi-CA™ allows easy and flexible service distribution to multiple numbers of servers, thus achieving high level of service availability. Each system component [30], for example the Cryptographic Service Provider [CSP], and all system modules [31] can be installed and operated on a multiple number of servers that can further be configured in a variety of high availability modes such as fail over, cluster and load balanced.

In each case, software or hardware high availability solution can be independently implemented to achieve best option suitable for your environment. And even more importantly, Digi-CA™ has the ability to scale, easily and without interrupting the live production environment at any stage during the life of your system.

The Digi-CA™ System can issue, revoke, suspend, de-suspend and re-sign x.509v3 Digital Certificates. Time-Stamping, Online Certificate Status Protocol [OCSP], Certificate Revocation Lists [CRLs] and many other features of a PKI system can be activated as required using the administration console of the system.

End user information and certificate requests are entered through the web based Registration Authority [RA] Management Console [32]. This powerful RA Management Console manages the entire Certificate Life cycle. Basic Certificate issuing and revocation by Operatives can be further delegated through a basic and modified RA Management Console interface called the Digi-CA™ Control Centre. It is the Digi-CA™ Limited RA [LRA] - Control Centre [33] that is used by the RA Operator on a day-to-day basis.

Replace an Existing CA

Migrating to Digi-CA™

Unlike any other CA system in the market, Digi-CA™ is specifically designed to easily migrate any other existing PKI system. By design Digi-CA™ [23], as a entirely self dependent system, allows its easy migration from one data centre to another in an almost seamless manner. The transfer can be accomplished either physically through hardware transportation or by secure software and data migration whereby all software and database data is securely migrated in an encrypted format from one location to another.

The key features necessary for running your existing framework PKI infrastructure are already embedded in the Digi-CA™ System as standard. It additionally offers a much wider scale of possibilities in using PKI throughout your entire organisation. Where Traditional CA [28]s offer most modules as add-ons (and at additional cost), Digi-CA™ offers these 'as standard' and provides alternative key generation, certificate enrolment and certificate installation features, with policy based controls, in compliance with most current commercial and open standards. Digi-CA™ also supports a large variety of third party software and cryptographic hardware devices such as smart cards, USB tokens and Hardware Security Modules [HSMs].

In conjunction with your existing on line applications and PKI infrastructure, features provided by Digi-CA™ can introduce and add enhanced support and security to inbound and outbound email exchange communications through the use of S/MIME. Also, web server and web client strong and multi factor authentication using Public Key Certificates and SSL/TLS communication protocols, signing of application code, authentication of network routers, firewalls and Virtual Private Network [VPN] devices and many other business-to-client and business-to-business PKI aware solutions too.

To migrate your system, the Digi-CAST™ [36] methodology, you will experience a smooth transition process from your current PKI framework. The Digi-CAST™ Team consists of highly qualified, expert IT engineers responsible for providing analysis, planning and implementation services to meet the your requirements and allows you to completely 'off load' all activities in these areas. The Digi-CAST™ method will provide for a detailed migration plan that outlines all phases of the migration process and provides estimated delivery schedules for each phase of the project, leaving no space for omissions or lengthy implementation delays by providing best Digi-CAST™ guaranteed quality of service.

System Design

Certificate Authority System Design

[16] The Digi-CA™ system is built in several modules. Each module communicates with other modules either directly through a programmable socket interface or an API interface. The system design is such that no access is allowed to the system Certificate Engine core level, except through the web based interface panel or through SSH for power low level administrators only [super users].

There is one operating system and four principle modules in the Digi-CA™ and how they are implemented for your requirements depends on the Certificate Policy:

• Digi-CA™ Operating System
• Digi-CA™ Certificate Engine
• Digi-CA™ Information Database [37]
• Digi-CA™ Control Centre [38]
• Digi-CA™ CRL [39]

As an option the following sub-systems can also be installed:

• Specific Database Nomination (Oracle, MsSQL ,Websphere, etc)
• Hardware Security Module(s) [HSM]
• On-Line Certificate Status Protocol [OCSP]
• Time Stamping Server

The above options are available subject to consultation and are listed here for indicative purposes only.

Digi-CA™ Operating System

Digi-CA™ has been designed and is built for Unix / Linux compatible operating system platforms. Typical installations use FreeBSD 5.4+ Unix or a RedHat Enterprise Linux based operating system.

Digi-CA™ Certificate Engine

The main module of the system is the Digi-CA™ Certificate Engine core that is used for the creation and revocation of Certificates based on the system Certificate Policy. It uses a direct interface to the Digi-CA™ Information Database that contains information about all Digi-ID™ [21] Certificate holders and the issued (or pending to be issued, suspended or revoked) Certificates. Output from the Digi-CA™ Certificate Engine core is directed to:

• The database Digi-CA™ Information Database for updated user information after the Certificates are created or revoked.
• The LDAP Digi-CA™ Directory that contains information about all issued and valid Certificates.
• Smart card or USB token support system (if installed) for the generation of the Digi-Card™, Digi-Token™, etc.
• Email system for distribution of Digi-ID™ Certificate collection notices for the Process Method or the actual PKCS#12 [.p12] package in if the Digi-ID™ is distributed using the Package Method.

The Digi-CA™ Certificate Engine core is designed so that no Administrator intervention is necessary. Using a daemon server, important maintenance tasks occur automatically.

Information Database

The Database, Control Centre & CRL

[16] The Digi-CA™ This module is used for storing:

• information about the Digi-CA™ Certificate Structure
• user information
• Certificate data
• billing information (if included)

The database is SQL based and by default the system is installed with MySQL database server. At an additional cost, the Administrator can define what database to use (PostGRE SQL, Oracle®, DB2®, SQL Server®, Websphere®, etc).

Based on information stored in the database, the system generates requests for creation, suspension (if enabled) and revoking of Digi-ID™ [21] certificates to the Digi-CA™ Certificate Engine core.

The Digi-CA™ Directory stores Digi-ID™ Certificates and user data according to current international RFC standards. The schemas used are core, cosine and internetperson. The schemas are stored in a directory. Access to the directory is available through an LDAP compatible client.


Digi-CA™ Control Centre

The Digi-CA™ Control Centre is the Administrators’ interface for controlling the day-to-day operation of the Digi-CA™ system. The Digi-CA™ Control Centre provides all of the deployment and life cycle management functions of the Digi-IDs™ and any other Digital Certificates [3] the system issues. One or more Administrators can manage the Digi-CA™ Control Centre. Depending on the level of security required, Administrators must be authenticated using Digi-Access™ [40], Digi-Card™, Digi-Token™ and/or a biometric reader.

Digi-CA™ CRL

Digi-CA™ uses the x.509 standard Certificate Revocation List [CRL] format so that Digi-ID™ information can be made publicly available at a designated web address. This is the repository for all issued Digi-IDs™ and enables integration of Digi-IDs™ into third party or custom applications an easy task.

Recent ANSI, ETSI and ICAO guidelines have recommended the use of Online Certificate Status Protocol [OCSP] [11] for certain environments. Offering OCSP as a service can cause considerable traffic on your network and should only be considered where there is a statutory or compliance [9] requirement.

In all other cases, the CRL service is the preferred method of communicating the status of the Digi-ID™.

Preparation & Configuration

Outline Requirements for Digi-CA™

[16] After the environment has been prepared and the Certificate Policy (and in the case of Xg the Digi-Sign Certificate Practice Statement [12]) agreed, the software is configured. Software configuration may be as simple as designing the SSRoot & Intermediate Certificates or it can be a complex environment requiring compliance and standards, integration and application development.

A simple configuration can be completed in 2-3 days with full-scale projects running into several months of configuration, documentation and implementation. The following descriptions are provided here as guidelines only:

• Digi-CA™ Service Xs for two factor authentication [4] access to an online subscription service for 5,000 users with no integration necessary

Configuration Time: 2 Days

• Digi-CA™ Server Xp for device-to-device authentication with 200,000 devices and a single API development for integration is required

Configuration Time: 25 Days

• Digi-CA™ Service Xp for 10,000 users for email communication signing, workflow signing and extranet access

Configuration Time: 5 Days

• Digi-CA™ Xg Trust Centre requirement conforming to ANSI, ETSI and other national standards [9] for unlimited users

Configuration Time: 90+ Days

Activation

Once the software is configured, installation of the Digi-CA™ can begin. Subject to project scheduling, and Digi-CAST2™ [8] availability, the following are indicative installation times. You should also note that the installation also includes Administrator and RA training:

• Digi-CA™ Xs 3-5 days
• Digi-CA™ Xp 5-10 days
• Digi-CA™ Xg 10-15 days

As Digi-CA™ Xg is usually a highly customized setup [41], the following sections focus on the installation of the Xs and Xp environments for Digi-CA™ Server and Digi-CA™ Service.

Service Setup

Managed Certificate Authority Requirement

[16] Ordering and operating a Digi-CA™ Service Xs or Xp couldn’t be simpler. All you require is a single internet enabled PC with Internet Explorer 5.5+ and the Digi-CAST2™ Team [8] will either send you a Digi-Card™ and smart card reader or a Digi-Token™ USB token that enables you to access the Service or you will be permitted to store the Administrator’s Digi-ID™ [21] in the Certificate Store of the PC.

Whoever logs into the system first is assigned PRIMARY Administrator status with access to all areas and functions of the system. The PRIMARY can invite other Administrators onto the system and may even reassign PRIMARY status to another person.

The Digi-CA™ Service ‘ownership’ is strictly controlled so that the identity of the PRIMARY Administrator is a carefully monitored process. Once the identity of this Administrator is Validated, they are invited to enroll for the Administrator’s Digi-ID™ and this used as two factor authenticated access to the Service. The first time this Administrator logs into the system, they must agree to the Terms & Conditions of the service by clicking the ‘I Agree’ log in button on the index page (see Appendix V.iii). This acceptance uses the electronic signature capability of the Digi-ID™ to sign the Digi-CA™ Service contract with Digi-Sign before permitting access to the system. All subsequent Administrators, regardless of their status, must also digitally sign the same contract but ultimate responsibility resides with the very first Administrator to access the system.

There are no other hardware, software or contracts required by the Administrators of the Digi-CA™ Service and, subject to the Digi-CAST2™ [8] Production Schedule, they can usually order and receive their required system in a few days.

Server Setup

Certificate Authority Requirements

[16] The Digi-CA™ Server, by nature of the fact that it is installed software (usually at the customer site), is a more involved process with hardware, software, documentation and installation requirements. The basic requirements for every Digi-CA™ Server installation are the same and in most instances, Digi-CAST2™ [8] install the Digi-CA™ Server system on your server(s). As more sophisticated environments arise for Digi-CA™ Server Xp or Digi-CA™ Server Xg, the requirements increase accordingly.

The following sections describe the basic requirements for installing the three classes of Digi-CA™ Server and the three main components are detailed in each case:

• Physical Environment
• Equipment Specification
• Installation Requirements

Digi-CA™ Server Xs Requirements

The Digi-CA™ Server Xs is usually installed on a single server and if the correct internet connection and secure Virtual Private Network [VPN] can be provided to the server, it is possible that the installation of the software can be carried out virtually.

The benefit of this is that it reduces the cost of travel and accommodation. When examining each of the following three sub sections you can consult with the Digi-CAST2™ Team at any time to check configurations and access for you.

Xs Physical Environment

These are the minimum suitable conditions for the correct operation of the single server Digi-CA™ Server Xs:

• Dry area with good ventilation or air-conditioning if possible




• Secure room or computer cabinet with restricted, controlled and logged access




• Broadband or leased line internet access




• Power supply with optional backup power supply




• Availability of IT Professional (MCSE or higher/other on a part-time basis, 4-hour call-in contract will suffice) with good working knowledge of computers, networking and general knowledge of TCP/IP protocols

Server Xs Requirements

Certificate Authority Specification

[16] These are the minimum equipment specification for the correct operation of the single server Digi-CA™ Server Xs:

• Server: Dell®/Compaq (FreeBSD 5.4+ compatible)
• Processor: Intel® Pentium® III family
• Memory: 512MB RAM
• Hard Drive: 15 GB SCSI/ATA
• SCSI Controller (optional)
• RAID Controller: RAID PERC 3/4/SC (optional)
• 100/10 MB Intel® Compatible Network Card
• CD-RW/DVD 4x Combo
• Monitor
• Keyboard
• Router
• Software/Hardware Firewall (optional)

Digi-CA™ Server Xs is supplied complete and ready for total install on the server. There is no requirement for any Operating System [OS] or pre-configuration, whatsoever. In fact, if the Server is not completely free of any OS or software, it must be formatted to return it to its original ‘as manufactured’ state.

During the installation, the Digi-CA™ Server will use versions of the following software that will be hardened and modified by the Digi-CAST2™ [8] Team during their installation work:

• OpenSSL
• mod_SSL
• Apache
• PHP
• cURL
• OpenLDAP
• BerkeleyDB
• MySQL
• WebMin

The previous list is provided for information purposes only.


Xs Installation Requirements

These are the minimum requirements for the correct installation of the single server Digi-CA™ Server Xs:

• Hardware as per Equipment Specification
• FreeBSD 5.4+ installed
• 512Kbs network (via Internet) access to the server
• VPN software installed and tested (optional)
• VPN client software sent to Digi-CAST2™ (optional)
• SSH interface to the server
• ‘Root’ login credentials for remote server access

Server Xp Requirements

Certificate Authority Requirements

[16] The Digi-CA™ Server Xp is usually installed on two servers and if the correct internet connection and a VPN can be provided to the servers, it is possible that the installation of the software can be carried out virtually.

The benefit of this is that it reduces the cost of travel and accommodation. When examining each of the following three sub sections you can consult with the Digi-CAST2™ Team [8] at any time to check configurations and access for you.


Xp Physical Environment

These are the minimum suitable conditions for the correct operation of the dual server Digi-CA™ Server Xs:

• Dry area with good ventilation or air-conditioning if possible
• Secure room or computer cabinet with restricted, controlled and logged access
• Broadband or leased line internet access
• Power supply with optional backup power supply
• Availability of IT Professional (MCSE or higher/other on a part-time basis, 4-hour call-in contract will suffice) with good working knowledge of computers, networking and general knowledge of TCP/IP protocols

Xp Equipment Specification

These are the minimum equipment specification for the correct operation of the dual server Digi-CA™ Server Xp:

• 2 x Servers: Dell®/Compaq (FreeBSD 5.4+ compatible)
• Processor: Intel® Pentium® III family
• Memory: 512MB RAM
• Hard Drive: 15 GB SCSI/ATA
• SCSI Controller (optional)
• RAID Controller: RAID PERC 3/4/SC (optional)
• 100/10 MB Intel® Compatible Network Card
• CD-RW/DVD 4x Combo
• Monitor
• Keyboard
• Router
• Software/Hardware Firewall (optional)

Digi-CA™ Server Xp is supplied ready for total installation on the two servers. There is no requirement for any Operating System [OS] or pre-configuration, whatsoever. In fact, if the servers are not completely free of any OS or software, they must be formatted to return them to their original ‘as manufactured’ state.

During the installation, the Digi-CA™ [23] will use versions of the following software that will be hardened and modified by the Digi-CAST2™ Team during their installation work:

• OpenSSL
• mod_SSL
• Apache
• PHP
• cURL
• OpenLDAP
• BerkeleyDB
• MySQL
• WebMin

The above list is provided for information purposes only.


Xp Installation Requirements

These are the minimum requirements for the correct installation of the dual server Digi-CA™ Server Xp:

• Hardware as per Equipment Specification
• FreeBSD 5.4+ installed
• 512Kbs network (via Internet) access to the server
• VPN software installed and tested (optional)
• VPN client software sent to Digi-CAST2™ [8] (optional)
• SSH interface to the server
• ‘Root’ login credentials for remote server access

Server Xg Requirements

Certificate Authority Requirements

[16] The Digi-CA™ Server Xg is completely customizable and can be installed across many servers, even if they are in different locations. A Trust Centres [10] example would use four servers and if the correct internet connection and a VPN can be provided to the server, it is possible that much of the installation of the software can be carried out virtually. However, the Digi-CA™ Server Xg will require at least one site visit from a Digi-CAST™ Team Member [8] to conduct certain specialist tasks.

The benefit of using the VPN connection as much as possible is that it reduces the cost of travel and accommodation. When examining each of the following three sub sections you can consult with the Digi-CAST2™ Team at any time to check configurations and access for you.


Xg Physical Environment

These are the minimum suitable conditions for the correct operation of the multiple server Digi-CA™ Server Xg:

• Two dry areas with good ventilation or air-conditioning
• Two secure rooms or computer cabinets with restricted, controlled and logged access
• Broadband or leased line internet access
• Power supply with optional backup power supply
• Availability of IT Professional (MCSE or higher/other on a part-time basis, 4-hour call-in contract will suffice) with good working knowledge of computers, networking and general knowledge of TCP/IP protocols

Xg Equipment Specification

These are the minimum equipment specification for the correct operation of the multiple server Digi-CA™ Server Xg:

• 4+ x Servers: Dell®/Compaq (FreeBSD 5.4+ compatible)
• Eracom / nCipher HSM
• Processor: Intel® Pentium® III family
• Memory: 512MB RAM
• Hard Drive: 15 GB SCSI/ATA
• SCSI Controller (optional)
• RAID Controller: RAID PERC 3/4/SC (optional)
• 100/10 MB Intel® Compatible Network Card
• CD-RW/DVD 4x Combo
• Monitor
• Keyboard
• Router
• Software/Hardware Firewall (optional)

Digi-CA™ Server Xg is supplied ready for total installation on the desired number of servers. There is no requirement for any Operating System [OS] or pre-configuration, whatsoever. In fact, if the servers are not completely free of any OS or software, they must be formatted to return them to their original ‘as manufactured’ state.

During the installation, the Digi-CA™ [23] will use versions of the following software that will be hardened and modified by the Digi-CAST2™ Team during their installation work:

• OpenSSL
• mod_SSL
• Apache
• PHP
• cURL
• OpenLDAP
• BerkeleyDB
• MySQL
• WebMin

The above list is provided for information purposes only.


Xg Installation Requirements

These are the minimum requirements for the correct installation of the multiple server Digi-CA™ Server Xg:

• Hardware as per Equipment Specification
• FreeBSD 5.4+ installed
• 512Kbs network (via Internet) access to the server
• VPN software installed and tested (optional)
• VPN client software sent to Digi-CAST2™ (optional)
• SSH interface to the server
• ‘Root’ login credentials for remote server access

Sample Project

Sample Certificate Authority Project

[16] Once the Certificate Policy Requirements are documented and available, the project process can begin. The Digi-CA™ project can be sub-divided into five separate undertakings:

• Software Configuration
• Root Key Ceremony [19]
• System Installation
• System Testing
• System Activation
• Software Configuration

The Certificate Policy sets out the system design, RA function and overall workflow of the system and also the Root Certificate(s) and Intermediate Root Certificate(s) design. As explained in the Requirements section of this document, the Digi-CA™ is pre-configured prior to delivery at the customer site.

During the software configuration, the Digi-CAST2™ Team [8] will produce test Root Certificate(s) and Intermediate Certificates(s) for your approval. Again, depending on the Certificate Policy, the actual Root(s) and Intermediate Certificate(s) may be generated prior to delivery. Other workflow and processes may also need to be verified. Finally, all the interfaces for the End User and Administrators can be customized to reflect the organization’s identity and/or local language.

Once the configuration is complete it is compiled, complete with ‘hardened’ Operating System [OS] and software, and delivered on a CD or DVD to the customer site.


Root Key Ceremony

At the heart of every Digi-CA™ are at least one Root Key or Root Certificate and one Intermediate Root Certificate(s). Every Digi-CA™ Certificate is made from a Public and a Private Key. A Root Key Ceremony is a procedure where a unique pair of Public and Private Root Keys is generated. Depending on the Certificate Policy, the generation of the Root Keys may require notarization, legal representation, witnesses and ‘Key Holders’ to be present. This process is best explained with some examples:



Root Certificate

The Root Certificate is only ever used to sign the Intermediate Root Key(s). After signing this Key(s) the Root Key is 3-DES encrypted and split into a minimum of 4 Key shares that are each stored on 3-DES encrypted smartcard and signed with SHA-1. All Key shares will have a unique password and should be stored separately in different secure locations (bank vault, safety deposit box, attorney’s office, etc). A Key generation log is kept in the system and in a separate physical log.

Important Note: the Root Certificate should not exceed a 25-Year life duration.


Intermediate Root Certificate

The Intermediate Root Certificate is protected by 3-DES encryption and all key shares have unique passwords.

Important Note: the Root Certificate should not exceed a 25-Year life duration.


Creating a Digi-CA Root Certificate

In order to create Digi-IDs™ from the system, at least one self-signed Digi-CA™ Root Certificate must be generated. There is a possibility in the system, depending on ordered options, to create any number of Digi-CA™ Root Certificates and Digi-CA™ Intermediate Roots with different policies and validity. The figure below represents a theoretical relationship between Digi-CA™ Root Certificates. Please consult Digi-CAST1™ before setting up your specific schema.

System Installation

Certificate Authority Installation

[16] Digi-CA™ is normally installed by Digi-CAST2™ [8] but in the case of a very basic Digi-CA™ Xs installation (and based on the availability of experienced Network Engineers), you may be capable of installing the Digi-CA™ Xs using its documentation and simple telephone support from a Digi-CAST2™ Team member.

The basic Digi-CA™ Xs installation can be completed in three to five days. See Appendix II for two examples of a Single Server and a Dual Server installation. The following is a brief installation schedule:

• Day 1. System architecture check and testing
• Day 2. Digi-CA™ software installation
• Day 3. Root & Intermediate Certificate installation
• Day 4. Digi-CA™ testing, training and demonstration
• Day 5. Digi-CA™ training and deployment

A Digi-CA™ Xs customized installation may take additional time to configure and a Digi-CA™ Xp or Digi-CA™ Xg installation, using the basic outline as described above, takes longer.


System Testing

The testing of the Digi-CA™ is an integral part of the installation process and is completed, checked and approved by the customer before the Digi-CAST2™ Team leaves the customer site.

System Activation

The system activation of the Digi-CA™ is also an integral part of the installation process and is completed, checked and approved by the customer before the Digi-CAST2™ Team leaves the customer site. The online flash presentation of Digi-CA™ [42] explains the benefits in a simple and easy to understand manner.

Customisation

Certificate Authority Customisation

[16] The Digi-CA™ is probably the most flexible and capable CA system available in the market today. Unlike the other Traditional CA [28]s, Digi-CA™ takes advantage of the many advances in technology over the past seven years and you benefit by getting the most flexible, cost effective and easily integrated and/or migrated [43] CA system you need.


Intelligent use of Open Source PKI

The Digi-CA™ still uses Unix in its Certificate Engine core but by using Open Source PKI technology in other modules, Professional Services and upgrade costs are substantially less than those normally associated with the complex and costly modifications of the less flexible Unix Traditional CAs.

In the larger or more complex environment, the organization may require a workflow process to control the use of the Digi-CA™ usage from a cost, security or for general management reasons. The following is an example of a customization currently in use by a Digi-Sign customer for issuing Digi-SSLs™:

This type of customization is not unusual but it does add to the initial cost of deploying a Digi-CA™ system.

Process Automation

Every aspect of the Digi-CA™ can be automated. Examples of this would be where the Digi-IDs™ are being used to replace Usernames and Passwords for login to a secure website, to replace hardware tokens like SecurID®, to issue Digi-IDs™ for secure email [3] on a closed network or to replace an existing Traditional CA with Digi-CA™.

Using the Digi-CA™ technology and its capabilities, it is possible to use existing LDAPs or other databases such as Oracle®, Active Directory® or any other SQL or flat file format to automate the Digi-ID™ [21] issuing, renewal, suspension and revocation processes.

Migration from a Traditional CA

Using the authentication and validation Certificate Policies from your Traditional CA, Digi-CA™ can migrate users automatically without requiring any IT resources or Administrators’ time.

Interface Customization

Certificate Authority Customisation

[16] The entire Digi-CA™ system and all of the interfaces used by the Administrators and users can be completely customized on request. Typical reasons for the graphical changes are for integrating Digi-CA™ into a larger application to make a complete package or the simpler integration of the Digi-CA™ into the organization’s web systems or extranet.


Technical Specification & Help Files

The specification of the Digi-CA™ at the time of going to print is available in Appendix IV. All specification updates and technical help files are updated using the online support section of the Digi-Sign website located at www.digi-sign.com [44].

Language Capabilities

As is the case with sub section 6.5, Digi-CA™ offers the capability to completely localize all interfaces, help files and user screens into your local language(s). This is particularly important to organizations where English is not used. It is also possible to have multiple interfaces with multiple languages for the same system. The following two samples show the Digi-CA™ Control Centre screen in Chinese and the user enrollment screen where users can apply for a [21]Digi-ID™ in Turkish.

The importance of the capability to produce the Digi-CA™ in the local language(s) cannot be over stated. It will result in faster training of the RA personnel and will significantly reduce the Help Desk Support calls (where users are seeking help to with translations from English rather than actual technical support related issues).

It is also possible to have a single Digi-CA™ configured in multiple languages so that different Digi-RAs™ in different countries can use the same Digi-CA™ Control Centre in their native language. Similarly, the users requesting Digi-IDs™ can do so from the same system but again in their native language.

To have your Digi-CA™ localized in your language, the system files and instructions are available in Appendix V.

Installation Guidelines

The following are sample Digi-CA™ installation diagrams, schedule and technical schematics for review.

Introduction

Digi-CA™

Digi-CA™ is the complete CA system for organisations that would like to have their own CA or would like to own and manage a Public Key Infrastructure [PKI] for digital certificates, inside the organisation, or over the Internet. Digi-CA™ generates and manages digital public key certificates that are used for a variety of different purposes, most commonly for secure server connection [51], electronic signatures, natural person and/or device authentication and for secure email.

The Digi-CA™ system can create multiple instances of independent CAs in a single Digi-CA™ system deployment. The Digi-CA™ model imposes delegation of trust downwards from Root CAs to their Subordinate CAs using a concept called ‘layered hierarchy’. The same Digi-CA™ system also enables a CA to be cross signed by an external third party CA. As a result of this design principal, the Digi-CA™ model for trust levels increases towards the highest authority. This type of arrangement facilitates easy deployment and scalability of any PKI requirement from the smallest to the largest.

Digi-CA™ Service

Digi-CA™ can be delivered as an installed Software CA, or as a Managed CA service [59]. Uniquely, both the Managed Digi-CA™ Service and the installed Digi-CA™ Server software [60] use the same common, core technology. This is important because in selecting Digi-CA™ it is possible to begin with Digi-CA™ Service and migrate to Digi-CA™ Server with ease.

It is possible to use the distributed architectural design of Digi-CA™ to implement the concept of a ‘Shared CA’ where different modules of the system are hosted and managed in separate geographical locations.

Benefits

Digi-CA™

Digi-CA™ replaces older Legacy CA systems using the latest in CA and PKI technologies and benefits from combining commercial and open source software initiatives. With Digi-CA™, all of the complexities and onerous technical overhead that were required by Legacy CAs have been simplified to a ‘user-friendly’ and usable level.

By combining the consulting and professional services [51] offered by Digi-CAST™ with the functions provided by Digi-CA™, can bring an organisation to a highly professional PKI level, meeting the criteria for internationally recognised accreditation standards such as WebTrust® and ISO 27001 certifications.

Choosing

Digi-CA™

The simplicity of the design of the complete Digi-CA™ system means that the same system can be purchased initially as a service [64]. Later, if needed, the software [65] version can be deployed and later scaled for enterprise, large scale and even national PKI use, with minimum or no disruption. This is made possible by the modular architecture used in the development of the Digi-CA™ system.

Modular Architecture

The modular architecture of Digi-CA™ provides its components in Service Modules [64]. Here is the list of modules currently available (for further details, refer to the Digi-CA™ Deployment Guide).

Module Name	Code	Services Provided
Cryptographic Service Provider	CSP	Certificate & CRL Generation Services
Time-Stamping Gateway	TSG	Digital Time-Stamping Service
OCSP Gateway	OCSPG	Real time Revocation Status Service
CA Application Service	CAAS	TSG and OCSPG gateway services connector
CA Management Console	CAMC	Web based Certification Authority management
RA Management Console	RAMC	Web based Registration Authority management
Entity Registration Service	ERS	Web based End Entity Registration management
Content Dissemination Service	CDS	Certificate and CRL dissemination management

Deployment Models

The above diagram shows each module of Digi-CA™ [64] distributed across multiple servers for use in a large scale enterprise/government PKI.

Versions

Digi-CA™ Versions

This modular architecture permits Digi-CA™ to meet almost any requirement. The principal delivery models are:

	Digi-CA™ Service - Managed CA [59]
	Digi-CA™ Server - CA Software [60]
	Digi-CA™ Shared - Dedicated CA [61]

It is possible to build [66] a custom Digi-CA™ solution that will meet all your requirements. This sophisticated online shopping cart assist you in selecting the correct Digi-CA™ and also demonstrates the many add-ons available to meet those requirements. For further information use this URL:

http://www.digi-sign.com/product/digi-ca [67]

Service

Digi-CA™ Versions

Digi-CA™ Service is the Managed CA [59] and is the service that is provided online using the Application Service Provider [ASP] or Software-as-a-Service [SaaS] delivery model. There is no hardware or software requirement at the customer site.

Choosing Digi-CA™ Service

Unless there is a very specific reason why your organisation must own and locate its own CA system [51], then Digi-CA™ Service will most probably meet all of your requirements. As a service offering it is more cost effective both financially and from a human resource/time consumption perspective.

Digi-CA™ Service Charges

Digi-CA™ Service is charged on an annual recurring fee that is based on the number of digital certificates [51] issued each year. The annual fee covers all maintenance, administration and day-to-day system support that is required to keep the Digi-CA™ operational. For further information use this URL:

http://www.digi-sign.com/product/digi-ca [67]

Server

Digi-CA™ Versions

Digi-CA™ Server is the CA Software that is installed on a server in a data centre [60] or at the customer site. Digi-CA™ charges a ‘once off’ initial license fee that is based on the cost of the software, its configuration and installation and then the number of certificates required over the life of the product's use.

Choosing Digi-CA™ Server

Unless there is a very specific reason why your organisation must own and locate its own CA system, then Digi-CA™ Service [59]will most probably meet all of your requirements. If ownership and specific geographic location are specific requirements, the Digi-CA™ Server is probably your best choice.

Once personnel are properly trained, they should be able to manage and administer the system with ease. Digi-CA™ Server also has the ability to be accessed using a highly secure Virtual Private Network [VPN] connection, where Digi-CAST™ personnel can assist with escalated technical matters using direct access to the system.

Digi-CA™ Server Charges

Apart from the initial license fee, the only other fees you pay are the annual license fee to cover upgrades, patches and application telephone support and optional annual support fees that can be purchased in ‘blocks of tickets’ where a single support case uses one support ticket until the case is solved.

Server Deployment

When considering a centralised or distributed deployment model of Digi-CA™ [60], one must consider the fact, that Digi-CA™ requires a pre-established network infrastructure that is a key objective to a successful deployment of this system.

Although Digi-CA™ does not require, or rely on, a specific network design, careful network architecture planning [51] is strongly recommended prior to the deployment of this system. Diagrams below – as an example only - illustrate two most common deployment methodologies, one with all Service Modules centralised on a single server and the other with distributed services as an alternative.

Related Digi-CA™ Server Cost Considerations

As an installed Software CA [60], Digi-CA™ Server will require at least one, if not multiple servers, networking and at least one internet connection. The minimum software and hardware requirement to deploy a standard Digi-CA™ on a single server device is as follows:

Component	Minimum Requirements Specification
Server OS Platform	Unix®, Linux® [x86 / x86-64 / ia64]
Operating System	Red Hat Enterprise Linux® 4.x, 5.x ; FreeBSD® 5.x, 6.x, 7.x, 8.x
RAM Memory	1GB RAM
Hard Disk Device	15GB ATA/SCSI/SAS
CPU	Intel® Pentium® IV 2.4 MHz
Network Interface Card	Intel® compatible 10/100 Megabits NIC
Database server software	MySQL Community Server 5.0.45

For further information use this URL:

http://www.digi-sign.com/product/digi-ca [67]

Shared

Digi-CA™ Shared

Digi-CA™ [68] Shared was a concept conceived by Digi-Sign in 2006 that has only recently been acknowledged by potential customers as a real alternative to providing Digi-CA™ Service. Although implementations of this concept CA are limited, the capability and the option are important.

Typical enquiries come from large industry or government agencies where ownership of the entire CA is not a requirement, but ownership of specific components is preferred (e.g. data files, HSMs or the requirement to have a complete, hosted disaster recovery system). When considering Digi-CA™, the availability of this concept may not be of paramount importance, but its availability may be very useful during the continued growth and expansion of the total environment.

Choosing Digi-CA™ Shared

Digi-CA™ Shared can be a dedicated instance of the Digi-CA™ Service [69] that is completely separate from all other Digi-Sign systems; or it can be a combination of the Digi-CA™ Server system, hosted at a location of your choosing, with certain functions hosted by at one of our nominated data centres.

Digi-CA™ Shared Charges & Cost Considerations

Estimating the annual charges and other cost considerations for Digi-CA™ Shared is calculated on a case-by-case basis. For further information use this URL:

http://www.digi-sign.com/product/digi-ca [67]

Summary

Digi-CA™

Digi-CA™ replaces older Legacy CA systems using the latest in CA and PKI technologies and benefits from combining commercial and open source software initiatives. With Digi-CA™, all of the complexities and onerous technical overhead that were required by Legacy CAs have been simplified to a ‘user-friendly’ and usable level.

The Digi-CA™ Team combine consulting and professional services with the functions provided by Digi-CA™ and can bring an organisation to a highly professional PKI level whilst meeting the criteria for internationally recognised accreditation standards such as WebTrust® and ISO 27001 certifications.

Advice on selecting the modules and services you may require are in the next section.

System

Digi-CA™ Summary

This section of the Guide provides general information on the functional concepts for each Digi-CA™ Service Module and related Digi-CAST™ services to consider when selecting the correct Digi-CA™ system for your environment. As a guide, it is recommended that you familiarise yourself with the general concepts and then contact us directly for more information, or use the online shopping cart or more detailed information:

http://www.digi-sign.com/product/digi-ca [67]

Standard System Components

Regardless of what Digi-CA™ system you elect to use, the following service modules will always be active, albeit in some cases, transparent to the administrators or end users. These are:

	Cryptographic Service Provider
	CA Management Console [CAMC]
	RA Management Console [RAMC]
	Entity Registration Service [EERS]
	Certificate & CRL Dissemination Services [CCDS]

Cryptographic Service

Digi-CA™

The Cryptographic Service Provider [CSP] Service Module is a software application that ultimately provides the most of cryptographic operations to the system and is effectively responsible for generating all public key certificates. Due to the high severity for the security of this module, it is not accessible through any network communications protocol. This design imposes an asynchronous certificate generation and distribution model.

CA Management Console [CAMC]

The CA Management Console [CAMC] Service Module is the central graphical user interface [GUI] for managing Certification Authorities, Registration Authorities, Service Modules and other services provided within the Digi-CA™ system infrastructure.

The following table presents a general overview on the functionalities provided by CAMC.

CAMC functionality overview
Management of CA accounts		Management of internal Master CA key pair
CA Key Pair management		Management of Digi-CA™ system user accounts
CA Certification and Cross-Certification management		Management of End Entity certificate policies
Service Module Registration and Management		Management of Time-Stamping Authorities
Digi-CA™ main configuration		Management of OCSP Validation Authorities
Registration and management of X.509 certificate profiles		Digi-CA™ system status overview
End Entity Certificate reporting		CSP cryptographic request queue reporting
Management of RA accounts		Activity Dual Control authorization

RA Management Console [RAMC]

The RA Management Console [RAMC] Service Module is the central graphical user interface [GUI] for operating Registration Authorities and managing End Entity Certificates.

The following table presents a general overview on the functionalities provided by RAMC.

RAMC functionality overview
End Entity account management		Management of RA user accounts
End Entity key pair life cycle management		Management of End Entity certificate policies
End Entity certificate request registration		End Entity Validation
End Entity certificate authorization		Activity Dual Control authorization
End Entity certificate revocation		End Entity certificate reporting
End Entity certificate suspension		End Entity certificate de-suspension
End Entity certificate replacement (re-issuance)		Management of TSA clients

Entity Registration

Digi-CA™

The Entity Registration Service [ERS] Service Module is the central graphical user interface [GUI] provided to End Entities for user account and certificate related activity registration purposes.

The following table presents a general overview on the functionalities provided by ERS.

ERS functionality overview
End Entity initial account registration		End Entity certificate status reporting
End Entity certificate request registration		End Entity certificate collection
End Entity certificate revocation requests		End Entity certificate replacement (re-issuance) requests
End Entity certificate suspension requests		End Entity certificate de-suspension requests
TSA client token reporting

Certificate & CRL Dissemination Services [CCDS]

The Certificate & CRL Dissemination Services [CCDS] Module is a software application that ultimately provides dissemination service for End Entity Public Key Certificates, Key Pairs and Certificate Revocation Lists.

From an Operating System perspective, the CDS is a client application to the CA database server. It sustains a persistent connection to the database from where dissemination requests are loaded and subsequently served. The following table presents a general overview of the functionality the CDS module is designed to provide.

CSP functionality overview
End Entity public key publication in LDAP directory		CRL publication in web repository
End Entity public key distribution		CRL distribution
End Entity certificate expiration notification		TSA Client notifications

System Components

Digi-CA™

The following optional additional services are categorised as being available as follows:

		Unique to Digi-CA™ Service Only
		Available on all Versions of Digi-CA™
		Restricted to Certain Versions of Digi-CA™

Unique Service

Digi-CA™

The following services are only available with Digi-CA™ Service

Total Trust Management™ [TTM™]

Total Trust Management™ is much more than direct telephone support line or a dedicated Account Manager. Total Trust Management™ is the total out sourcing of your Digi-CA™ Service management, where Digi-CAST™ personnel effectively work for you and every aspect of the certificate life-cycle management is done for you.

We pioneered the Total Trust Management™ [TTM™] in 2004 and have been offering this valuable service to our customers ever since. Under TTM™ we act as the Trusted Administrator of your Digi-CA™ Service and carry out all of the duties of the CAMC and RAMC operator on your system. TTM™ is an option that is only available with Digi-CA™ Service.

Automated Service

Automatic Failover & Load Balancing

Digi-CA™ Service automatically offers fail-over and load balancing as part of the standard service provisioning and strictly speaking, is not an optional addition. It is listed here for illustration purposes only.

Automatic Backup & Disaster Recovery

Digi-CA™ Service automatically offers backup and disaster recovery as part of the standard service provisioning and strictly speaking, is not an optional addition. It is listed here for illustration purposes only.

Available Versions

Available on all Versions of Digi-CA™

The following services are available on all versions of Digi-CA™.

Additional Certificates

When purchasing your Digi-CA™system, the initial order will contain a fixed number of digital certificates/signatures. In the case of Digi-CA™Service, the entire annual cost is based on the number of certificates in use. With Digi-CA™Server, the system is supplied, as standard, with 100 multi-use certificates.

Therefore, additional certificates must be ordered on an, as needed basis. Additional single use (e.g. for encryption only) or multi-use (e.g. authentication and digital signature, etc.) certificates must be ordered separately.

RAMC Automation

Digi-CA™

When issuing large numbers of certificates in a single instance (e.g. several thousand in one hour or day) this will result in many users completing the online application form very soon after receiving the invitation email. Manually approving each request may not be possible and in such cases, RA Automation is the recommended option.

RA Automation can be as simple or as integrated as your environment requires and can be enabled on any version of Digi-CA™.

TimeStamping

TimeStamp Authority

The TimeStamp Authority [TSA] provides digital TimeStamping network based services in compliance with RFC 3161 standard, Internet X.509 Public Key Infrastructure TimeStamp Protocol [TSP]. The TimeStamp Protocol, or TSP, is a cryptographic protocol for certifying timestamp tokens using X.509 public key certificates and public key infrastructure.

The timestamp token is the signer's assertion that a piece of electronic data existed at, or before, a particular time. TimeStamp tokens are effectively used to provide evidence data in the process of validating long-term electronic signatures applied to digital communication or payment transactions and electronic documents such as Adobe® Acrobat® PDF.

Gateway

OCSP Gateway

The OCSP Gateway [OCSPG] Service Module is intended to provide digital
Online Certificate Status Protocol [OCSP] network based services in compliance with RFC 2560 standard, X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP.

The OCSP is an Internet protocol used for obtaining the revocation status of an X.509 digital public key certificate. It was created as an alternative to Certificate Revocation Lists [CRL], specifically addressing certain problems associated with using CRLs in a public key infrastructure [PKI].

Recovery

Backup & Disaster Recovery

A CA or PKI, although not mission critical, must ensure that all its data is protected and available at all times. Using fail-over may ensure that no data is lost, but the best option is to ensure that there is a back-up system that is completely separate from the main system.

This is referred to as disaster recovery and in high security situations, this backup disaster recovery is usually located at a separate geographic location from the main system.

Versions

Backup & Disaster Recovery

The following services are only required on certain versions of Digi-CA™Server. This is because in the case of Digi-CA™Server Xg, fail-over and load balancing are component parts of the overall system delivery and parts of the overall system delivery of Digi-CA™Service.

Fail Over on Digi-CA™Server Xs

Fail-over is where a second system is enabled so that if the primary system ceases to function for any reason, the fail-over, or second system, temporarily assumes the primary role until normal service can resume. As Digi-CA™Server Xp and Xg are automatically supplied with fail-over, this is the only version of Digi-CA™Server where fail-over must be ordered separately (and is a good reason why most customers order Digi-CA™Server Xp).

Load Balancing on Digi-CA™Server Xs & Xp

Load balancing is where a minimum of two machines are configured so that all traffic across the system is balanced equally across the machines to ensure the highest performance of the overall system. Load balancing is only required where high volumes, or high production peaks, are expected in the einvironment.

Key Ceremony

Key Ceremony on Digi-CA™Server

A Key Ceremony is only required when your organisation wishes to achieve your own independent root, or intermediate, Certificate Authority. This typically occurs where an organisation wants to create and own its own Root CA for reasons relating to compliance to specific standards (e.g. ISO 27001, WebTrust, EU Qualified Certificates, etc).

A Root Key Ceremony is a procedure where a unique pair of Public and Private Root Keys is generated. Depending on your requirements and specifications, the generation of the Root Keys may require notarisation, legal representation, witnesses and ‘Key Holders’ to be present. This process is best explained with some examples:

Example A: Strong identification & non-repudiation for email & web access

Unless the information being accessed or transmitted is valued in terms of millions of dollars, it is probably sufficient that the Digi-CAST2™ Team conduct the Root Key Ceremony within the security of the Digi-CAST2™ Laboratory. The customer may opt to have the Root Key stored on a Luna Card or HSM, but in most cases the safe storage of the Root Key on a CD or hard disk is sufficient. The Root Key is never stored on the Digi-CA™server.

Example B: Machine Readable Travel Document [MRTD] ID card or e Passport

This type of environment requires much higher security than a commercial one. When conducting the Root Key Ceremony, the Government or Organization will require rigorous security checks to be conducted on all personnel in attendance. Those that are normally required to attend the Key Ceremony will include a minimum of two Administrators from the organisation, two signatories from the organisation, one lawyer, a notary and two video camera operators in addition to the Digi-CAST2™ Team.

The actual Root key-pair generation is normally conducted in a secure vault that has no communication or contact with the outside world other than a single telephone line or intercom. Once the vault is secured, all personnel present must prove their identity using at least two legally recognised forms of identification. Every person present, every transaction and every event is logged by the lawyer in a Root Key Ceremony Log Book and each page is notarized by the notary. From the moment the vault door is closed until it is re-opened, everything is also video recorded. The lawyer and the two organisation’s signatories must sign the recording and it too is then notarized.

Finally, as part of the above process, the Root Key is broken into as many as twenty-one parts and each individual part is secured in its own safe for which there is a key and a numerical lock. The keys are distributed to as many as twenty-one people and the numerical code is distributed to another twenty-one people.

Important Note:

Example A and B are at opposite ends of the security spectrum and no two environments are the same. When considering the Root Key Ceremony, the Digi-CAST1™ Team of professional advisors can assist you in deciding on the most efficient level of security to reflect the level of protection required.

Introduction

Introduction

This Guide is intended to provide general information on the basic concepts, design, deployment and use of the Digi-CA™ Public Key Infrastructure [PKI] system. It is assumed that the audience and readers of this guide have a basic understanding of the concepts of information technology, PKI and the use of X.509 digital public key certificates.

If you are planning to deploy Digi-CA™ inside your organisation, ensure your read this document first, before attempting to perform a new standalone or distributed installation of this system.

General Information

In cryptography, a Certificate Authority or Certification Authority [CA] is an entity that issues digital certificates for use by other parties. It is an example of a trusted third party. A CA issues digital certificates that contain a public key and the identity of the public key owner. The matching private key is not similarly made available publicly, but kept secret by the end user who owns the key pair. The certificate is also an attestation by the CA that the public key contained in the certificate belongs to the person, organization, software or hardware device or other entity noted in the certificate. A CA's obligation in such schemes is to verify an applicant's credentials, so that users and relying parties can trust the information in the CA's certificates.

Deployment Introduction

Introduction

Digi-CA™is the complete Certificate Authority system for organisations that would like to have their own CA, like to own and manage a PKI for digital certificates inside the organisation or over the Internet. Digi-CA™generates and manages digital Public Key Certificates that are used for a variety of different purposes, most commonly for electronic signatures, natural person or device authentication and secure email.

The Digi-CA™system can create multiple instances of independent Certification Authorities in a single Digi-CA™system deployment. The Digi-CA™model imposes delegation of trust downwards from Root CAs to their Subordinate CAs that meets the concepts of layered hierarchy. The same Digi-CA™system also enables a CA to be cross signed by an external third party CA. As a result of this design principal, the Digi-CA™model for trust levels increases towards the highest authority. This type of arrangement facilitates easy deployment and scalability of any PKI requirement from the smallest to the largest.

Digi-CA™can be delivered as an installed Software CA, or as a Managed CA service. Uniquely, both the Managed Digi-CA™Service and the installed Digi-CA™Server software use the same common, core technology. This is important because in selecting Digi-CA™it is possible to begin with Digi-CA™Service and migrate to Digi-CA™Server with ease.

It is possible to use the distributed architectural design of Digi-CA™to implement the concept of a Shared CA where different modules of the system are hosted and managed in separate locations.

services

Digi-CA™

The Digi-CA™System provides a full scale of services necessary for the management of X.509 certificates. An overview of these services is presented in the table below.

Digi-CA™ service overview
End Entity registration		Time-Stamping
Certificate issuance		Online Certificate Status Protocol
Certificate re-signing		Multi-CA system engine
Certificate renewal		Cross-Certification management
Certificate dissemination		CRL generation
Certificate revocation		CRL distribution and dissemination
Certificate suspension		Entity based multi-key management
Certificate de-suspension		Certificate Profile management
Certificate Expiration Notification		Certificate Enrolment Policy Management
Event logging and auditing service		Support for Hardware Cryptographic Module devices
Hierarchical CA operations		Support for Smart Cards and USB Tokens

In principle and in compliance with internationally recognised PKI standards, Digi-CA™offers the following core Certification Authority services:

• End Entity Registration Service
• Certificate Generation Service
• Certificate Dissemination Service
• Revocation Management Service
• Revocation Status Service

As an addition, Digi-CA™offers the following supplementary services:

• Time-stamping Service

Software

General Information

At its core, Digi-CA™ software was designed for Unix and Linux operating systems that provide a robust and stable operating environment. The simplicity of the architectural design of the complete Digi-CA™ system means that the same software can be deployed on a single server device and later scaled for enterprise or Internet PKI use with minimum or no disruption.

Typically, scaling may start from a 'handful' of servers acting in a basic
fail-over mode. Such basic setup can be later extended to reach greater capacity and performance by introducing additional servers as required. This scaling of the capacity can occur almost without, or completely without, interrupting the operation of the existing production environment. This is a critical component when deciding on a CA that may scale considerably over time and allows organisations to carefully plan their investment costs, whilst also achieving all functional goals.

The following table presents a minimum software and hardware requirement to deploy a standard Digi-CA™ on a single server device.

Component		Minimum Requirements Specification
Server OS Platform		Unix®, Linux® [x86 / x86-64 / ia64]
Operating System		Red Hat Enterprise Linux® 4.x, 5.x ; FreeBSD® 5.x, 6.x, 7.x, 8.x
RAM Memory		1GB RAM
Hard Disk Device		15GB ATA/SCSI/SAS
CPU		Intel® Pentium® IV 2.4 MHz
Network Interface Card		Intel® compatible 10/100 Megabits NIC
Database server software		MySQL Community Server 5.0.45

Modular Architecture

Digi-CA™ software is a multi-application component based system for generating and managing cryptographic keys, digital X.509 public key certificates and providing supplementary PKI services. In this model, each application component, referred to as a "Service Module", provides a series of both cryptographic and non-cryptographic functionalities to other application components within the system’s infrastructure.

Modules

Digi- CA™

The following table presents a list of Service Modules currently available within Digi-CA™.

Component	Code	Minimum Requirements Specification
Cryptographic Service Provider	CSP	Certificate & CRL Generation Services
Time-Stamping Gateway	TSG	Digital Time-Stamping Service
OCSP Gateway	OCSPG	Real time Revocation Status Service
CA Application Service	CAAS	TSG and OCSPG gateway services connector
CA Management Console	CAMC	Web based Certification Authority management
RA Management Console	RAMC	Web based Registration Authority management
Entity Registration Service	EERS	Web based End Entity Registration management
Content Dissemination Service	CCDS	Certificate and CRL dissemination management

The modular design of Digi-CA™allows its seamless deployment in almost every scenario:

	a	where it is required to centralise all Module Services on a single dedicated server to reduce costs and where large certificate volumes are not a demand;
	b	in a most complex environment, for very high volume certificate processing and where all Module Services are distributed separately to a number of server devices, most often in combination with network hardware load balancing, database data replication as well as hardware and software fail-over that combine to form the so called ‘High Availability’ model.

This unique feature of Digi-CA™software provides not only a flexible range of possible configuration variations but allows organisations to slowly build their own PKI infrastructure from a very small environment and carefully control their expenditure related to purchasing and maintenance of hardware devices.

Models

Deployment models

When considering a centralised or distributed deployment model of Digi-CA™, one must consider the fact, that Digi-CA™requires a pre-established network infrastructure that is a key objective to a successful deployment of this system. Although Digi-CA™does not require, or rely on, a specific network design, careful network architecture planning is strongly recommended prior to the deployment of this system. Diagrams below – as an example only - illustrate two most common deployment methodologies, one with all Service Modules centralised on a single server and the other with distributed services as an alternative.

Diagram 1.0: Digi-CA™with centralised Service Modules

Diagram 2.0: Digi-CA™with distributed Service Modules

Summary

Digi-CA™Summary

Digi-CA™replaces older Legacy CA systems using the latest in CA and PKI technologies and benefits from combining commercial and open source software initiatives. With Digi-CA™, all of the complexities and onerous technical overhead that were required by Legacy CAs have been simplified to a ‘user-friendly’ and usable level.

The Digi-CAST™ Team combine consulting and professional services with the functions provided by Digi-CA™and can bring an organisation to a highly professional PKI level whilst meeting the criteria for internationally recognised accreditation standards such as WebTrust® and ISO 27001 certifications.

Diagram 1.0: Digi-CA™with centralised Service Modules

Service Modules : Public Key Cryptography : Digi-Sign.com

Digi-CA™Service Modules explained

This section of the Guide provides general information on the functional concepts for each Digi-CA™Service Module. More detailed information as well as usage instructions for these modules are available in the following associated documents:

• Digi-CA™Administrator Guide
• Digi-CA™RA Operation Guide

Cryptographic Service Provider

The Cryptographic Service Provider [CSP] Service Module is a software application that ultimately provides the most of cryptographic operations to the system and is effectively responsible for generating all public key certificates. Due to the high severity for the security of this module, it is not accessible through any network communications protocol. This design imposes an asynchronous certificate generation and distribution model.

The only allowed control mechanism for this software module is manual, through the use of Operating System console command line interface [CLI]. CLI control options are limited to start, stop, key activation and general module configuration operations.

CSP in the overview of the CA core services acts as the Certificate Generation Service.

From an Operating System perspective, CSP is executed as a software daemon being also a client to the CA database server and Content Distributing Service. It sustains a persistent connection to the database from where cryptographic operation requests are loaded and subsequently served. The following table presents a general overview of the cryptographic functionality the CSP module is designed to provide.

CSP functionality overview
CA Key Pair generation		End Entity Key Pair generation
Root CA public key certification		End Entity public key certification
Subordinate CA public key certification		Certificate Revocation List certification
CA Public Key Cross-Certification		CA Private Key Storage in Software Security Module
Table 3.0

Certified (digitally signed by the CA private key) public key certificates are instantly stored in a CA database and where immediate certificate dissemination is required, a Content Distributing Service is optionally called through an Uniform Resource Identifier [URI], further resulting in a certificate being distributed to the End Entity and, if necessary, published in a certificate LDAP directory.

CSP makes regular use of CA private keys and associated public key certificates and therefore it must have uninterrupted access to these keys at all times. Private keys used by CAs to certify public key certificates are by nature security sensitive. A CA must therefore provide sufficient security mechanisms and procedures to protect the CA private key from an illegitimate use by others.

CSP is designed to meet the highest security demands and simultaneously support two different types of Security Modules for secure private key access and storage:

• Software Security Module [SSM]
• Hardware Security Module [HSM]

The SSM is a CSP’s built-in cryptographic hardware-less feature. SSM uses PKCS#8 (Public Key Cryptography Standard) format to store private keys on a local file system in an encrypted manner. Private key encryption is accomplished by the use of encryption algorithm sets as defined in PKCS#5 standard.

Access to private keys in SSM is protected by a key activation password, which is used by the CSP to derive a "secret" further used to effectively encrypt CA private key information. Although a System Administrator or Security Officer may be aware of the SSM activation password, direct access to raw private key information is not likely possible, unless a successful attempt is made to reverse engineer the CSP source code in order to establish the precise secret derivation algorithms in use.

Once an instance of a CSP is launched, all private keys residing in the SSM private key repository configured for activation are loaded and remain in computer RAM memory until the CSP process is purposefully or unexpectedly terminated. Upon successful shutdown of the CSP process, the RAM memory area designated for private key storage is programmatically zeroed.

The SSM option for CA private key storage is designed to provide a cost-effective way of CA private key storage for small organisations, that intend to deploy Digi-CA™only for private use and where corporate security policies are actively maintained and followed by IT personnel and finally where the organisation has full control of the use of public key certificates.

Where greater CA private key protection mechanisms are a security demand, SSM option is strongly NOT recommended and this is where CSP offers a simultaneous use of hardware based cryptographic devices - HSMs - for secure private key storage and access.

HSMs introduce a very high level for private key protection and provide enhanced performance for cryptographic operations with the use of private keys, for example in the process of creating digital signatures.

There are two general types of HSM devices: host-attached and network-attached. The CSP supports both types of HSMs. A host-attached HSM device can be a device connected directly to a host server through a PCI, USB or SCSI interface. A network-attached HSM is a device connected to the host server over network using a Network Interface Card [NIC] attached to the server. Both types of HSM devices provide enhanced private key protection and meet the highest security criteria demand such as certification to FIPS 140-2 level 4 and/or Common Criteria EAL4+.

CSP communicates with the HSM device using a software library API, provided by the device vendor. When using HSM devices, private keys are physically stored and protected inside a hardware device and are never accessible as plain text. In fact, CSP has no real control over private keys stored on an HSM device as it merely makes the use of the hardware device layer to perform cryptographic operations.

HSM devices are therefore strongly recommended typically everywhere, where organisations intend to provide CA services to the public community or where the use of public key certificates is outside of the organisation’s exclusive control.

The table below presents example HSM models, that have been successfully tested with the CSP Service Module.

Supported Hardware Security Modules

AEP Keyper Professional (FIPS 140-2 level 4)

AEP Keyper Enterprise (FIPS 140-2 level 4)

Thales nCipher NetHSM 500 (FIPS 140-2 level 3)

Thales nCipher NetHSM 2000(FIPS 140-2 level 3)

Thales nCipher nShield PCI (FIPS 140-2 level 3)

Configuration

Digi-CA™

Usage and configuration instructions for this module are available in the following associated documentation: Digi-CA™Administrator Guide.

CA Management Console [CAMC]

The CA Management Console [CAMC] Service Module is the central graphical user interface [GUI] for managing Certification Authorities, Registration Authorities, Service Modules and other services provided within the Digi-CA™system infrastructure.

The following table presents a general overview on the functionalities provided by CAMC.

CAMC functionality overview
Management of CA accounts		Management of internal Master CA key pair
CA Key Pair management		Management of Digi-CA™system user accounts
CA Certification and Cross-Certification management		Management of End Entity certificate policies
Service Module Registration and Management		Management of Time-Stamping Authorities
Digi-CA™main configuration		Management of OCSP Validation Authorities
Registration and management of X.509 certificate profiles		Digi-CA™system status overview
End Entity Certificate reporting		CSP cryptographic request queue reporting
Management of RA accounts		Activity Dual Control authorization
Table 5.0

The CAMC is essentially a web based application designed to work with an instance of an Apache web server.

System users, such as CA Administrators can access the console interface only by using a web browser client application such as Microsoft Internet Explorer or Mozilla Firefox.

CAMC provides support for a combination of two user authentication factors: traditional username and password and X.509 certificate based client authentication, which is a feature enabled by the use of SSL/TLS communication encryption protocol on the Apache web server. CAMC allows you to decide what authentication factor should be used to authenticate console users or whether to use both authentication factors at the same time.

The console is capable of supporting multiple language locales.

The great advantage of this module is that it allows different CA users to independently access separate CA accounts at the same time using the same console interface.

To store and retrieve information, the console uses an interface connection to the CA database. The fact it is a web based application, makes it easy to deploy and protect on a common installation of an Apache web server.

Management

Summary

Usage and configuration instructions for this module are available in the following associated documentation: Digi-CA™Administrator Guide.

RA Management Console [RAMC]

The RA Management Console [RAMC] Service Module is the central graphical user interface [GUI] for operating Registration Authorities and managing End Entity Certificates.

he following table presents a general overview on the functionalities provided by RAMC.

RAMC functionality overview
End Entity account management		Management of RA user accounts
End Entity key pair life cycle management		Management of End Entity certificate policies
End Entity certificate request registration		End Entity Validation
End Entity certificate authorization		Activity Dual Control authorization
End Entity certificate revocation		End Entity certificate reporting
End Entity certificate suspension		End Entity certificate de-suspension
End Entity certificate replacement (re-issuance)		Management of TSA clients
Table 6.0

The RAMC is essentially a web based application designed to work with an instance of an Apache web server.

System users, such as RA Administrators and RA Operators can access the console interface only by using a web browser client application such as Microsoft Internet Explorer or Mozilla Firefox.

The RAMC provides support for a combination of two user authentication factors: traditional username and password and X.509 certificate based client authentication, which is a feature enabled by the use of SSL/TLS communication encryption protocol on the Apache web server. RAMC allows you to decide what authentication factor should be used to authenticate console users or whether to use both authentication factors at the same time.

The console is capable of supporting multiple language locales.

The great advantage of this module is that it allows different RA users to independently access separate RA accounts at the same time using the same console interface.

To store and retrieve information, the console uses an interface connection to the CA database. The fact it is a web based application, makes it easy to deploy and protect on a common installation of an Apache web server.

Entity Registration

Summary

Usage and configuration instructions for this module are available in the following associated documentation: Digi-CA™RA Operation Guide.

End Entity Registration Service [EERS]

The Entity Registration Service [EERS] Service Module is the central graphical user interface [GUI] provided to End Entities for user account and certificate related activity registration purposes.

The following table presents a general overview on the functionalities provided by EERS.

EERS functionality overview
End Entity initial account registration		End Entity certificate status reporting
End Entity certificate request registration		End Entity certificate collection
End Entity certificate revocation requests		End Entity certificate replacement (re-issuance) requests
End Entity certificate suspension requests		End Entity certificate de-suspension requests
TSA client token reporting
Table 7.0

The EERS is essentially a web based application designed to work with an instance of an Apache web server.

End Entity users, such as Public Key Certificate subscribers or TSA Clients can access the module interface only by using a web browser client application, such as Microsoft Internet Explorer or Mozilla Firefox.

EERS provides support for traditional username and password based authentication. The console is capable of supporting multiple language locales.

To store and retrieve information, the module uses an interface connection to the CA database. The fact it is a web based application, makes it easy to deploy and protect on a common installation of an Apache web server.

CRL Dissemination

Summary

Usage and configuration instructions for this module are available in the following associated documentation: Digi-CA™RA Operation Guide.

Certificate & CRL Dissemination Services [CCDS]

The Certificate & CRL Dissemination Services [CCDS] Module is a software application that ultimately provides dissemination service for End Entity Public Key Certificates, Key Pairs and Certificate Revocation Lists.

The CCDS, in the overview of the CA core services, acts as the Dissemination Service.

From an Operating System perspective, the CCDS is a client application to the CA database server. It sustains a persistent connection to the database from where dissemination requests are loaded and subsequently served. The following table presents a general overview of the functionality the CCDS module is designed to provide.

CSP functionality overview
End Entity public key publication in LDAP directory		CRL publication in web repository
End Entity public key distribution		CRL distribution
End Entity certificate expiration notification		TSA Client notifications
Table 8.0

Public Key Certificates generated by the CSP Service Module are stored in a CA database and CCDS is responsible for distributing the certificates to End Entities and if necessary, publishing these in a certificate LDAP directory.

For distribution, CCDS primarily uses Internet mail messaging [email], where public key certificates are attached to email messages. Another common method is to notify End Entities of a specific certificate collection web access point where End Entities can collect certificates by using a web browser, which is provided as part of the Entity Registration Service.

Time Stamp

Summary

Usage and configuration instructions for this module are available in the following associated documentation: Digi-CA™Administrator Guide.

TimeStamp Authority Gateway [TSAG]

The TimeStamp Authority Gateway [TSAG] Service Module is intended to provide digital Time-Stamping network based services in compliance with RFC 3161 standard, Internet X.509 Public Key Infrastructure Time-Stamp Protocol [TSP].

The Time-Stamp Protocol, or TSP, is a cryptographic protocol for certifying time-stamp tokens using X.509 public key certificates and public key infrastructure. The time-stamp token is the signer's assertion that a piece of electronic data existed at, or before, a particular time. Time-Stamp tokens are effectively used to provide evidence data in the process of validating long-term electronic signatures applied to digital communication or payment transactions and electronic documents such as Adobe® Acrobat® PDF.<,/

TSAG, in the overview of the CA supplementary services, acts as the Timestamping Service.

The term "Gateway" in the module name is purposely used to describe what the TSAG really does. It is essentially a network gateway between the TSP Client and TSP Server. The design concept for this Service Module arose from the results of security assessments applied to RFC 3161 standard.

A typical implementation model for a TSP Server allows that server to directly access the Timestamp Authority’s [TSA] Private Key designated for certifying TimeStamp tokens. Due to the fact that the TSP Server is very likely to be exposed for public use, the likelihood of the TSA’s private key accidental exposure to an illegitimate party is relatively high, regardless whether the TSA’s private key is stored in a Software or Hardware Security Module. The TSA forms a key party in the process of validating electronic signatures and non-repudiation and therefore an illegitimate exposure of the TSA’s private key in any form could lead to a potential risk of TSA signature forger that would further result in invalidation of any previously certified Time-Stamp tokens and further invalidation of any electronic signatures that these tokens would provide an evidence of.

TSAG was designed to eliminate the above risks. It is a software library built to work with an instance of an Apache web server software and it can be therefore considered as an Apache software module. Its functionality is limited to the following purposes:

		a. Optionally authenticate connecting TSP Clients against a database
		b. Qualify correctly formatted TSP requests
		c. Transparently pass TSP requests to the CA Application Service [CAAS]
		d. Retrieve responses from CAAS
		e. Transparently pass responses retrieved from CAAS to TSP Clients

The TSP Clients can connect to the TSAG using standard HTTP or secure HTTPS [HTTP over SSL/TLS] protocol using a Uniform Resource Locator [URL] method. TSP requests are accepted either as HTTP POST or HTTP GET requests.

The optional Client Authentication is accomplished by the use of Simple HTTP Authentication where TSP Clients are requested to provide a username and password before their TSP request is accepted. To authenticate a TSP Client, the TSAG will transparently connect to a CA database, where End Entity account information is stored.

The TSAG module is configured and activated inside the Apache web server configuration and can be applied per site, virtual realm or per physical directory configuration. It is loaded the very moment the Apache web server is started.

Important Note: TSAG Service Module can place significant demands on your servers and IT hardware environment and should only be deployed and offered to relying parties if you have the correct infrastructure that meets the recommended model of High Availability.

Online Certificate

Summary

Usage and configuration instructions for this module are available in the following associated documentation: Digi-CA™Administrator Guide.

Online Certificate Status Protocol [OCSP]

The Online Certificate Status Protocol [OCSP] Gateway Service Module is intended to provide digital network based services in compliance with RFC 2560 standard, X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP.

The OCSP is an Internet protocol used for obtaining the revocation status of an X.509 digital public key certificate. It was created as an alternative to Certificate Revocation Lists [CRL], specifically addressing certain problems associated with using CRLs in a public key infrastructure [PKI].

Messages communicated via OCSP are effectively used to provide real time certificate revocation status service in the process of validating a public key certificate. This service can greatly support the validation process of the long-term electronic signatures applied to digital communication or payment transactions and electronic documents, such as Adobe® Acrobat® PDF. OCSP, in the overview of the CA core services, acts as the Revocation Status Service.

The OCSP is provided in a Gateway mode and the term "Gateway" in the module name is purposefully used to describe what the OCSPG really does. It is essentially a network gateway between the OCSP Client and OCSP Responder. The design concept for this Service Module arose from the results of security assessments applied to RFC 2560 standard. A typical implementation model for an OCSP Responder allows that server to directly access the OCSP Validation Authority’s [VA] Private Key designated for certifying OCSP response messages. Due to the fact that the OCSP Responder is very likely to be exposed for public use, the likelihood of the VA’s private key accidental exposure to an illegitimate party is relatively high, regardless whether the VA’s private key is stored in a Software or Hardware Security Module. The VA forms a key party in the process of validating electronic signatures and non-repudiation and therefore an illegitimate exposure of the VA’s private key in any form could lead to a potential risk of VA signature forgery that would further result in invalidation of any previously certified OCSP responses and further invalidation of any electronic signatures that these responses would provide evidence of.

OCSPG was designed to eliminate the above risks. It is a software library built to work with an instance of an Apache web server software – it can be therefore considered as an Apache software module. Its functionality is limited to the following purposes:

		a. Qualify correctly formatted OCSP requests
		b. Transparently pass OCSP requests to the CA Application Service [CAAS]
		c. Retrieve responses from CAAS
		d. Transparently pass responses retrieved from CAAS to OCSP Clients

OCSP Clients can connect to OCSP Gateway using standard HTTP or secure HTTPS [HTTP over SSL/TLS] protocol using a Uniform Resource Locator [URL] method. OCSP request messages are accepted either as HTTP POST or HTTP GET requests.

OCSP Gateway module is configured and activated inside the Apache web server configuration and can be applied per site, virtual realm or per physical directory configuration basis. It is loaded the very moment the Apache web server is started.

Important Note: OCSP Gateway Service Module can place significant demands on your servers and IT hardware environment and should only be deployed and offered to relying parties if you have the correct infrastructure that meets the recommended model of High Availability.

CA Application

Summary

Usage and configuration instructions for this module are available in the following associated documentation: Digi-CA™Administrator Guide.

CA Application Service [CAAS]

The CA Application Service [CAAS] Service Module is intended to provide target TSP Server and OCSP Responder services to the Time-Stamping Gateway and OCSP Gateway Service Modules.

The CA Application Service [CAAS] Service Module is intended to provide target TSP Server and OCSP Responder services to the Time-Stamping Gateway and OCSP Gateway Service Modules.

The design concept for this Service Module arose from the results of security assessments applied to RFC 3161 and RF 2560 standards and these concepts are further described in the above chapters 3.2 and 3.3.

CAAS has direct access and makes regular use of the TSA and OCSP VA Private Keys designated for certifying Time-Stamp tokens and OCSP response messages. Due to the fact that CAAS is NOT likely to be exposed for public access, the likelihood of the TSA or VA private key accidental exposure to an illegitimate party is relatively very small, regardless whether the TSA or VA private key is stored in a Software or Hardware Security Module.

CAAP was designed to remain in a protected network zone where public access is physically made impossible. It is a software library built to work with an instance of an Apache web server software – it can be therefore considered as an Apache software module. Its functionality is limited to the following purposes:

		a. Receive and serve Time-Stamp Requests
		b. Receive and serve OCSP Requests
		c. Respond to relevant requests by producing Time-Stamp tokens
		d. Respond to relevant requests by producing OCSP responses

Note: although CAAS will only accept legitimate requests from either of the Gateway Service Modules, it is still possible to setup the CAAS in combination with any of the Gateway Service Module in a traditional manner. Such a setup would allow you to install CAAS with TSG and/or OCSPG on a single server. This type of deployment is very useful in a closed private environment where volumes of requests are predictable and where corporate security policies are actively maintained and followed by IT personnel.

The CAAS uses the same private key storage and access techniques as the CSP Service Module and these techniques are described in more detail above.

Gateway Service Modules can connect to CAAS using secure HTTPS [HTTP over SSL/TLS] protocol with a Uniform Resource Locator [URL] method. Request messages are accepted as HTTP POST requests.

The CAAS module is configured and activated inside the Apache web server configuration and can be applied per site, virtual realm or per physical directory configuration basis. It is loaded the very moment the Apache web server is started.

Important Note: CAAS Service Module can place significant demands on your servers and IT hardware environment and should only be deployed and offered to relying parties if you have the correct infrastructure that meets the recommended model of High Availability.

Standalone

Summary

Usage and configuration instructions for this module are available in the following associated documentation: Digi-CA™Administrator Guide.

Performance Data

Using a standalone deployment of Digi-CA™with basic Service Modules on a mid-spec Intel® processor based computer, Digi-CA™CSP Service Module has recorded the following performance data.

CSP Performance Data
Number of Certificates	500 up to 500,000,000+
Production speed	5,000 1024-bits key signatures using SSM / hour 20,000 1024-bits key signatures using HSM / hour
Key lengths	1024-8192 bits using SSM and HSM
Signature algorithms	PKCS#1: RSA with SHA-1

Compliance to standards

Digi-CA™has been verified to comply with the following standards. For a complete and current list of standards, refer to the official Digi-Sign website URL:

www.digi-sign.com/about/compliance [72]

Digi-CA™standard compliance list
RFC 5280, RFC 3647, RFC 2587, RFC 3161, RFC 3628, RFC 3629, RFC 2560		RFC standards or standard candidates
PKCS#1, PKCS#3, PKCS#5, PKCS#7, PKCS#8, PKCS#9, PKCS#10, PKCS#11, PKCS#12		RSA Public Key Cryptography Standards
FIPS 46, FIPS 180-2, FIPS 186-2, FIPS 197, FIPS 198		US Federal Information Processing Standards
ETSI TS 102 280, ETSI TS 102 042, ETSI TS 102 040, ETSI TS 102 023, ETSI TS 101 861		European Telecommunications Standards Institute standards
CWA 14167-1		CEN Workshop Agreement standards

Introduction

High Level Overview of Digi-CA™

[1] The Digi-CA™ system can create multiple instances of unique CAs in a single Digi-CA™ system. The Digi-CA™ model imposes delegation of trust downwards from CAs to their Subordinate Certification Authorities [Sub-CAs]. The same Digi-CA™ system also enables any CA or Sub-CA to be signed or cross signed by an external third party CA. And any number of CAs can have any number of cross signed Sub-CAs. As a result of this design principal, the Digi-CA™ model for trust levels increases towards the highest authority. This type of arrangement facilitates easy deployment and scalability of any PKI [7] requirement from the smallest to the largest. Also, the Digi-CA™ can be offered as a managed service outside your environment Digi-CA™ Service, or as the installed software Digi-CA™ Server.

The Digi-CA™ System can issue, revoke, suspend, de-suspend and re-sign x.509v3 Digital Certificates [3]. Time-Stamping [75], Certificate Revocation Lists [CRLs], Online Certificate Status Protocol [OCSP] [11] and many other features of a PKI system can be activated as required using the administration console of the system.

The end user information and certificate requests are entered through the web based Registration Authority [RA] Management Console. This powerful RA Management Console manages the entire Certificate Life cycle. Basic Certificate issuing and revocation by Operatives can be further delegated through a basic and modified RA Management Console interface called the Digi-CA™ Control Centre. It is the Digi-CA™ Control Centre or Limited Registration Authority [LRA] that is used by the RA Operator day-to-day.

Digi-CA™ replaces older Traditional PKI [28] technology and CA systems using the latest in CA technology. With Digi-CA™, all of the complexities and onerous technical overhead that were required by Traditional CAs have been simplified to a ‘user-friendly’ and usable level. The Digi-CA™ can even be ‘dropped’ on top of these Traditional CA environments and seamlessly migrate the older system’s users into this more modern and flexible replacement.

Combining the consulting and professional services [8] offered in the Digi-CAST™ methodology [8] with Digi-CA™ can meet all national and international standards [9] such as:

• Common Criteria,
• Sarbanes Oxley,
• SB 1386,
• BS 7799-3:2006,
• ISO 17799,
• FFIEC,
• HIPAA,
• ACSI 33,
• 1999/93/EC,
• ANSI,
• CWA 14167-1,
• ETSI 101 456,
• EAL,
• FIPS,
• RFC,
• ICAO,
• MRTD [6],
• CONOPS,
• ALGO,
• Gramm-Leach Bliley
• and many other compliance [9] and certification [9] requirements.

The remainder of this online manual is for use by Managers [74], Administrators [32] and Operators [73] of the Digi-CA™ system. If you have not already done so, please download and read the Digi-CA™ Manual [76], before proceeding further.

See the Digi-CA™ Flash Presentation [77] that explains the issues and benefits of using the system.

System Details

Certificate Authority System Details

[1] Digital Certificates [3] are issued and managed using a Certificate Authority or CA [2]. In the market, there are two main types of CA systems that are explained in more detail in the Digi-CA™ Manual download [45] or in the Managed CA – Digi-CA™ Service [78] and CA Software – Digi-CA™ Server [79] sub sections of the Certificate Authority online book.

Then there is the innovative CA combination that is unique to Digi-CA™ because of the principals used in the Core Design of Digi-CA™:

This unique offering is called the Shared CA: Digi-CA™ Shared

See the Digi-CA™ Flash Presentation [77] that explains the design principals that have made this innovation possible.

So with Digi-CA™ there are in fact three types of Certificate Authority system to choose from:

Managed CA: Digi-CA™ Service
Shared CA: Digi-CA™ Service
CA Software: Digi-CA™ Server [78]

Core Principals

Digi-CA™ Important Core Design Principals

[1] The Shared CA - Digi-CA™ Shared is a concept and capability that is unique to Digi-CA™. It is made possible by the component design and flexibility that is at the core design of Digi-CA™ and is not available from Traditional CA [28] vendors.

The concept is simple: The benefits of outsourcing the entire CA to a Trusted Third Party [TTP] as a Managed CA [78] may meet most of your main business objectives. In a second scenario, your organization may require total ownership of the CA in which case Managed CA is suitable. But there is a third scenario where you want to own the critical assets but do not wish to manage everything internally. In this case, the Digi-CA™ Shared system is the solution.

In instances where critical assets, such as, the Hardware Security Modules [HSMs], databases, key storage and other functions must be retained by your organization and the day-to-day administration, support, help desk, ‘critical response’ and other ‘non critical’ components can be outside your organization, then Digi-CA™ will be your choice.

Digi-CA™ Shared offers all the technical backup and support components of your CA requirements and ‘fills in any gaps’ in your current environment. The external infrastructure, the team of professionals and specialist you require and other critical resources such as Disaster Recovery, critical response and Service Level Agreement [SLA], components can be outsourced with ease. At the same time, the principal assets and integrity you wish to own and control can remain inside your organization.

Digi-CA™ Shared can be designed and delivered to meet your precise requirements and can combine physical IT assets, personnel, help desk, internal and external networks and servers. For further details contact a member of the Digi-CAST1™ [8] Technical Advisor Team and they will advise you accordingly.

Selection

Selecting the Correct CA for You

[1] To decide on the best CA system for your environment, there are three key considerations you need to take into account and they are explained in the following sub sections of this online manual:

• the type of user group you have
• the type of Certificate this group needs
• the technical personnel you have available

Open & Closed User Groups

When deciding on whether the Managed CA [78] or the Managed CA [79] is most suited to you, you should understand the difference between an open and a closed user group. From a CA perspective, this relates to the extent of end user control you have. If the CA exercises some degree of control over the end user’s environment then it is a closed user group and if it doesn’t, it is in an open group.

The following are examples of the two types of user group:

• If you have sufficient control over your users and can ensure they all have Outlook® 2003, then this is considered a closed user group
• If you issue all the Digi-IDs™ on smart cards, from a CA perspective, you control every aspect of the environment and this is a closed group
• If you send thousands of email newsletters to a wide user group, you have no idea what email software they use, so this is an open group
• If you have a small group of extranet users that you manage and they trust you, then this could be considered a closed user group
• The tax payers in a country all belong to the closed group: tax payers and the tax authorities can enforce certain practices on its users
• The e Passport [20] of the citizen from one country is still valid in another country is a closed group by conforming to international standards [9]
• Two friends communicating over the internet but not knowing each others software is an open group because neither controls the other

It is not always immediately obvious whether a group is open or closed and it is important that this is determined accurately if your CA is to meet your precise requirements. If there is any doubt, contact the Digi-CAST1™ Team [8] and ask them to advise you.


The Correct Certificate for the Group

If the user group is closed, then you may be able to use either CA. There are two exceptions to this when you want to secure:

• a server using a Secure Socket Layer [17] [SSL] server Certificate
• email using a client certificate [3]

In 99% of cases an SSL Certificate [17] must be Trusted and if there is any possibility that the secure email [3] is required outside the closed group, then the Trusted Certificate is required here too. In both of these special cases, the Managed CA is your only choice.


Availability of Technical Personnel

The third consideration needed to help you select the correct CA for your organisation is the availability of the type of suitably trained and experienced technical personnel required to run and operate a CA. Most organisations don’t have this type of specialist staff within their organisation and therefore are best advised to use a Managed CA to deliver the required service.

Class Distinction

Different Classes of the Digi-CA™ System

[1] The majority of the remainder of this online manual describes and explains the functionality and flexibility of the Digi-CA™ Server system. With few exceptions, the Digi-CA™ Service can be configured in the same way as Digi-CA™ Server and then offered as a managed service, specifically to meet the needs of your environment.

There are three classes of Digi-CA™ Server:

• Digi-CA™ Xs [80]




• Digi-CA™ Xp [80]




• Digi-CA™ Xg [81]

The principal difference between Xs, Xp and Xg in each case relates to the degree of integration and customization required. For example, Digi-CA™ Xs can be pre-configured and delivered to the customer for installation without any assistance from Digi-Sign whilst Digi-CA™ Server Xg projects can run for weeks and even months or years.

Depending on type of Digi-CA™ you order and the level of customisation and modification it requires to meet the needs of your specific environment, will dictate the best installation approach. At a basic level (and depending on your qualifications, knowledge, experience, etc.), you can probably install the required operating system and the Digi-CA™ software using help files and telephone support.

Note: If you have technical personnel that can correctly configure a network environment, install the necessary operating systems and provide secure access to the server(s), the Digi-CAST2™ Installations Team [8] may be able to conduct a large part of the installation process prior to visiting your site. In some cases, the complete installation can occur without the need for Digi-CAST2™ to visit your site at all.

Digi-CAST™

Certificate Authority Methodology

[1] The Digi-CAST™ methodology was pioneered in 2004 and is a unique approach to simplifying the design, installation, management, certification [9] and re-certification of any CA environment.

The Digi-CAST™ methodology [8] has four distinctly separate components that are adapted and designed specifically to meet the needs of any Digi-CA™ environment:

• Digi-CAST1™ - [82] Consultation, Assessment, Security & Technical




• Digi-CAST2™ - [83] Certificate Authority Solutions Team




• Digi-CAST3™ - [84] Compliance, Audit, Standards & Training




• Digi-CAST4™ - [85] Continued Assessment & Security Testing

Digi-CAST1™ and CAST2™ are used on all Digi-CA™ Server projects whereas, Digi-CAST3™ and CAST4™ are used on larger projects such as enterprise, public sector or national government environments.

The Digi-CA™ Manual covers the Digi-CAST™ methodology in more detail as does our website: www.digi-sign.com [44]

This online manual examines Digi-CAST1™ and CAST2™ in more detail here as these specific relate to issues that an Administrator or Manager would be directly concerned with.


Digi-CAST1™

Just as there is no such thing as a typical IT environment, there is no such thing as a typical Digi-CAST™ [8] service. Some Digi-CAST1™ projects (where we are assisting or advising on a project before it starts) can last only a few hours, whilst other CAST1™ projects can last for months.

Digi-CAST1™ is concerned with project planning excellence, cause and affect planning, 'skills pool' analysis, personnel selection and management. The most important thing to remember about all Digi-CAST™ modules is that the entire service is tailored to your specific needs. For further details download the Digi-CA™ Manual [76].

Digi-CAST2™

Depending on the findings of Digi-CAST1™ regarding the available personnel and their skills, you might decide that you need us for some or all of the project implementation phase. As explained in the Digi-CAST1™ phase, all of this is decided at the project evaluation and planning stage.

Digi-CAST2™ is concerned with detailing the actual project as documented in Digi-CAST1™. Its concern is with personnel, availability, time lines, 'choke points' and overall project delivery. Combining your resources with ours, we begin the project and work together to a common goal. For further details download the Digi-CA™ Manual.

The basic requirements for every Digi-CA™ Server installation are the same and in most instances, Digi-CAST2™ install the Digi-CA™ Server system on your server(s). As more sophisticated environments arise for Digi-CA™ Server Xp or Digi-CA™ Server Xg, the requirements increase accordingly.




You may require a Subscription [1] to Read more [1]

Digi-CA™ Server Xs & Xp

Digi-CA™ Server Xs

[1] Digi-CA™ Server Xs is Managed CA [79] for installation on a single server and comes complete with all the different sub-systems designed to run and operate efficiently on that single machine.

As a software product, Digi-CA™ Server Xs only generates client certificates [3] [Digi-IDs™] that can be used for email, two-factor authentication, secure web access, as electronic signatures, for use within a Virtual Private Networks [VPN] or for device-to-device authentication. Like all professional CA systems it allows the Administrator to set up policies and to manage all of the Digi-ID™ [21] life cycle services.

Even with all of the powerful functionality and capabilities that Digi-CA™ Server Xs offers, it is easy to install, configure and operate. A competent Network Engineer or qualified IT Technician could install a fully functional version of Digi-CA™ Server Xs and be fully competent in its operation a few days.

Digi-CA™ Server Xs can only be installed on a single server and is typically used where high availability is not a key component of the environment. As a single server installation, there is no mirroring, load balancing, fail over or synchronizing of data. All records and data are protected by periodic backups only. Typical installations would be small to medium environments where high system availability is not an issue.

Digi-CA™ Server Xp

Digi-CA™ Server Xp is Managed CA for installation on two servers and offers the same services as Digi-CA™ Server Xs but on a larger scale and with many additional services including Certificate deployment and renewal automation. The primary reason for selecting Xp instead of Xs is because Digi-CA™ Server Xp offers fail-over functionality.

Digi-CA™ Server Xp can also be configured to generate Secure Socket Layer [17] [Digi-SSL™ [86]] web server Certificates, Software & Code Signing Certificates [Digi-CAST™ methodology [8]] in addition to the Digi-ID™ Xp Certificates.

Most Digi-CA™ Server Xp installations are carried out by the Digi-CAST2™ Installations Team. This installation may require the Digi-CAST2™ Team to physically conduct the installation on site, however, if a competent Network Engineer can provide a reliable connection to the correctly configured servers, then it may be possible to conduct the installation over the internet, without incurring travel and accommodation costs. The fully functional version of Digi-CA™ Server Xp can be completed in three to five days on average.

Digi-CA™ Server Xp is installed on two servers and is typically used where high availability is a component of the environment. As a dual server installation, there is mirroring and synchronising of data. All records and data are protected by this fail-over service. The Digi-CA™ Server Xp is split over two servers and gives the option to include a firewall and load balancing device in between. Typical installations would be large enterprise or government environments.

Digi-CA™ Server Xg

[1] Digi-CA™ Server Xg is the CA for commercial Trust Centres [10] and other large scale PKI [7] deployments. The entire system and its components parts can be split over many servers and systems as required with a minimum of four servers and a single Hardware Security Module [HSM] being the basic deployment.

Digi-CA™ Server Xg is used where high availability and reliability are a key component of the environment. As a multi-server installation, there is mirroring, fail over and synchronizing of data. All records and data are protected by this fail-over service. The Digi-CA™ Server Xg separates the CA services so that seven layers of security can be applied to the Trust Centre environment. The CA services are located in the Certificate Engine core with the RA, Certificate Revocation List [CRL], Lightweight Directory Access Protocol [LDAP] and Time Stamping [75] services located in the Outer Core (see Appendix II). Typical installations are government and commercial CA Trust Centres.

This class of Digi-CA™ Server has four levels of security including two or three levels of firewalls with fail over facilities and can incorporate hot standby, disaster recovery and a single system can operate from multiple locations.

Digi-CA™ Server Xg customization, configuration and testing is conducted off site after detailed requirements are documented and agreed with the customer. This off site work can take several weeks, or months, depending on the level and scale of the customizations required. Once configured, the fully functional version of Digi-CA™ Server Xg can be completed in five to ten days.

All Digi-CA™ Server Xg installations must be carried out by the Digi-CAST2™ Installations Team and requires that the Team conduct the installation on site with the associated travel and accommodation costs.

Digi-CA™ System Components

[1] The Digi-CA™ is a complete Digital Certificate [3] and certificate management system. It has three main components that are explained in more detail in their respective sub sections:

• Digi-CA™ Administration Management Console [CA AMC [87]] ->

• Digi-CA™ RA Management Console [RA MC [32]] ->

• Digi-CA™ LRA Control Centre [LRA [73]]

• Digi-CA™ RA Registration Services [RA RS [88]]

The Digi-CA™ Administration Management Console is for use by Senior Administrators. At a minimum, these should be qualified Senior Administrators with in-depth knowledge and qualifications specifically in IT and IT security networks. Suitable personnel would be the CTO, CIO, CISO, IT Director, Systems Manager, Systems Analyst, Analyst Programmer, Software Engineer, Technical Engineer and similar job functions with ‘hands on’ technical experience of five or more years. The sections of this online manual relevant to these Senior Administrators are marked in blue.

The Digi-CA™ RA Management Console is for use by RA Administrators. At a minimum, these should be qualified network Administrators with good working knowledge and qualifications specifically in IT and IT security networks. Suitable personnel would be the Technical Managers, Information Systems Manager, QA Manager, Product Manager, Systems Analyst, System Administrator, Senior Systems Engineer, Unix Administrator and similar job functions with ‘hands on’ technical experience of three or more years.

The Digi-CA™ Control Centre or LRA Management Console is for use by RA Operators. This is the most basic component of the Digi-CA™ system and the Operator needs only to have basic PC skills to adequately fulfill this role.

Installations Time Lines

Sample Digi-CA™ Installations

[45] The flexibility of the Digi-CA™ [23] Certificate Authority [CA] system design means that each installation is unique and customised to the precise needs of the customer. Once the Digi-CAST™ [36] Team have agreed and documented your requirements, your Managed CA [89], Digi-CA™ Service or CA Software [90], Digi-CA™ Server, is configured and activated. In certain projects, your specific needs may require a combination of CA Software and a Managed CA, to achieve the best results. Uniquely and unlike any other Traditional CA [28] system on the market, Digi-CA™ can offer the Shared CA [91] option.

The following are samples of different CA projects that use the different Digi-CA™ options and also combine other valuable services like the Digi-CAST™ Methodology [36] and consulting advice; the Total Trust Management™ [92] [TTM™] CA Management service; and the Digi-TaSC [93] on line system for CA Management and compliance.

Management Consoles & Interfaces

CA Administration Management Console [CA AMC]

[1] The Digi-CA™ Administrators Master Console is the central core of the entire CA system. From this Administrators Master Console the Administration of the CA is implemented and managed. The Administrators Master Console creates the Root CA, CA, Intermediate and Subordinate or Sub-CAs, the RAs and the Control Centres or LRAs.

The Digi-CA™ system model is a hierarchical trust model, in which, each entity implicitly trusts the entity above it. This model imposes the delegation of trust downwards from Root CAs to its Subordinate CAs. As a result, inherent in the design of the Digi-CA™ is the fact that the levels of trust increase as you go upwards to the higher authority. By its very design, this type of system architecture facilitates easy deployment of a large scale PKI [7]. The Administrators Master Console, its function and detailed instructions on how to use it are further described in Section 5 of this on line manual.

Read the on line Training Manual [97] for the CA AMC.

RA Management Console [RA MC]

The Digi-CA™ RA Management Console is the primary management interface for a specific CA or Sub-CA. The RA Management Console provides an interface to access and manage RAs and LRAs, that are created through the CA Administration Management Console. Each RA or LRA can interface multiple CAs to allow the issuance of different types of digital Certificates through different CAs from a single central and easily manageable location. The remainder of the functions of the RA Management Console its function and detailed instructions on how to use it are further described in Section 6 of this on line manual.

Read the on line Training Manual [98] for the RA MC.

Management Console [LRA] Control Centre

The Digi-CA™ Control Centre is more commonly known in the PKI [7] industry as an LRA and is the RA Operator interface for accessing the RA with limited features provided. For the remainder of this document and to avoid confusion, the LRA is referred too as the Control Centre. The Control Centre is a ‘stripped down’ version of the RA Console. The Control Centre is used to manage individual Certificate life cycle functions such as issuing, revoking, suspending and renewing Certificates. The remainder of the functions of the Control Centre, its function and detailed instructions on how to use it are further described in Section 5 of this on line manual.

Read the on line Training Manual [99] for the LRA Control Centre.

RA Registration Service [RA RS]

Depending on the configuration, policy and distribution of your Digi-CA™, some service may be publicly available. These public services are typically to enable basic end user requirements for Digital Certificates and the following sub sections describe the four main functions:

• Request
• Renew
• Revoke/Suspend
• Check Status

Read the on line Training Manual [100] for the RA RS.

Digi-CA™ Technical Specifications

Digi-CA™ Components & Specification

[101] The following table sets out the principal technical specifications of the Digi-CA™:

• Platform Unix®, Linux®
• Server Operating System FreeBSD 5.x®, 6.x®, Red Hat Enterprise 4.x, 5.x®
• Server Memory Requirement 1GB RAM Minimum
• Server Disk Requirement 1GB Minimum
• Server CPU Speed Intel® Pentium® III 650 MHz or better
• Certificate Standards X.509 v3 (including all standard extensions)
• PKIX
• SSL
• S/MIME
• IPSec
• and other custom X.509 Certificates
• PKI Features Natively supports Real-Time OCSP [11]
• X.509 CRLs and Certificates with custom extensions
• Time-Stamping [75] Services
• Unlimited Sub-CA Certificate chaining (hierarchical PKIs
• Certificate Features X.509 v1, v3 Certificates
  RSA, DSA Certificates
• Up to 2048-bit keys for authentication
• Flexible DN configuration for Certificates
• S/MIME Certificates
• Object Signing (JavaTM, ActiveX®) Certificates
  PKIX v3 extensions
• Cryptographic Support RSA
• DSA
• Cryptographic Hardware Storage of CA Private Keys on PKCS #11 devices
• FIPS 140-1 level 1 through 3 for key storage and protection (via nCipher)

Digi-CA™ System Architecture

[101] The Digi-CA™ PKI [7] System software suite is a multi application component based PKI system for managing cryptographic keys, Digital [X.509] Certificates and supplemental PKI related services. Each application component provides a series of defined functionalities to other PKI application components of the system, as well as to administering and operating parties, and to end entities, to whom certificates are issued. This system is built with the following modules:

a. CA Application Server [CA AS]

b. Cryptographic Service Provider [CSP]

c. Time-Stamp Gateway Server [TSA]

d. Online Certificate Status Protocol Gateway Server [OCSP [11]]

e. CA Administration Management Console [CA AMC]

f. Registration Authority [RA] Management Console [RA MC]

g. Registration Authority [RA] Registration Service [RA RS]

All Digi-CA™ components providing core functionalities were developed using C programming language and the software operates under Unix/Linux operating system environment, which has proven to be a solid, reliable – and if not the best - platform family choice for server side applications.

Diagram below illustrates the overall logical and high level hardware architecture design of a complex PKI infrastructure that Digi-CA™ can be deployed in. This includes multi-server based system component distribution, replication and failover of various PKI services and load balancing.

Digi-CA™ System Modules

[101] Whilst Digi-CA™ software can meet most complex requirements, in many scenarios it is often required to operate all PKI [7] related services on a single dedicated server hardware. Digi-CA™ can easily meet this requirement and the diagram below illustrates overall logical and high level hardware architecture design of the basic infrastructure utilizing a single server to operate all Digi-CA™ PKI services. This unique feature of Digi-CA™ software suite provides not only a flexible range of possible configuration variations but allows organizations to slowly build their own PKI infrastructure from a very small environment, thus carefully control their expenditure related to purchasing and maintenance of hardware devices.

Digi-CA™ PKI System provides a wide range of PKI related functionalities and introduces a variety of services and features including:

• Multi-CA system engine allowing operation of multiple Certification Authorities
• Hierarchical CA operations
• Cross-Certification management with external CAs
• Certificate Generation service
• Certificate Dissemination service
• Certificate Renewal service
• Certificate Revocation service
• Certificate Suspension and De-Suspension service
• Certificate Revocation List generation, management and distribution service
• Support for multiple methods of certificate delivery
• Support for multiple key pairs for different purposes bound to a single end entity
• Certificate Profile Management
• Certificate Policy Management
• Certificate Expiration Warning Management
• Key generation and management service
• Cryptographic Service Provider
• Time-Stamping [75] service
• Online Certificate Status Protocol
• Multi-role administration and operation of the CA infrastructure provided by a multi-task web based CA Administration Management Console.
• Interface to Registration Authority provided by a multi-task web based RA Management Console.
• Certificate Subscriber Registration provided by Registration Authority Registration Service
• Event logging and auditing service
• Support for HSM device(s)
• Vendor independent support for a variety of Smart Card and USB Token cryptographic devices

Performance Data

[101] Number of certificates:

• 200 up to 200,000,000

Production speed:

• Without HSM up to 5,000 1024-bits Digi-IDs™/hour
• With HSM up to 10,000 1024-bits Digi-IDs™/hour

Key length:

• Root and Sub-CA 9196-1024 bits
• Digi-IDs™ 1024-2048 bits
• Symmetric Keys 56 to 256 bits

Certificate validity:

• Root CA 1 to 25 years
• Sub-CA 1 to 10 years
• End Entity 1 to 10 years (as per Certificate Policy)

Key storage:

• Root CA Key can be stored off-line, in an encrypted format, within the boundary of an HSM device and protected by several separate Operator Cards that usually are stored securely in multiple offsite safe locations. Other keys, such as Subordinate CA, can also be stored within a boundary of an HSM device and regularly used by the Digi-CA™ PKI [7] System on a day to day basis. Access to these keys can be also protected with multiple Operator cards.

Cryptographic Ciphers:

• AES,
• Blowfish,
• CAST5,
• DES,
• 3DES,
• IDEA,
• RC2,
• RC4,
• RC5
• and RSA

Signature Algorithms:

• MD2,
• MD4,
• MD5,
• MDC2,
• SHA1 (DSSI)
• and RIPEMD-160

Entropy:

• 2127

Preparing for Digi-CA™

[101] The success or failure of any project can usually be traced back to the original plans. As explained, the Digi-CAST™ methodology [8] is a unique approach to a CA project and its purpose is to ensure the successful delivery of Digi-CA™, every time.

Simply buying Digi-CA™ (or any Managed CA [79]) is not a guarantee that your environment and your project will succeed. To achieve success, the organization must actively participate in the project from the outset. To do this, you must gain a clear understanding of the Digital Certificate [3] technology and the functions, uses and capabilities of a Certificate Authority [2].

If you have not already done so, download the Digi-CA™ Manual [76] for further information.


Digi-CA™ Options

The simplest way to select the correct Digi-CA™ for your organization is to decide how many users you have (or in some cases the number of physical devices you need to identify). This should include employees, customers, partners or suppliers and the individual people that work in each of these areas that you wish to issue a Digital Certificate [Digi-ID™ [21]] too.


Environment Requirement Users Recommended Digi-CA™

Environment A Strong two factor identification for web access 2,500 Digi-CA™ Server Xs

Environment B Online transaction and document signing [102] for application forms and business processes 40,000 Digi-CA™ Server Xs

Environment C Device authentication 100,000 Digi-CA™ Server Xp

Environment D Manufacturer or Large Software House with fail over Unlimited Digi-CA™ Server Xp

Environment E National Security requirement for foreign delegates 1,000 Digi-CA™ Server Xg
(customised)

Environment F National Identity Card and/or Smart Passport 25,000,000 Digi-CA™ Server Xg
(customised)

Environment G Digi-CA™ Xg Trust Centre Unlimited Digi-CA™ Server Xg

Another alternative is to look at the level of security that you wish to achieve. If the security is relating to corporate secrets, national security or can be regarded as critical, regardless of cost, then Digi-CA™ Xg may be the only option for you. The Digi-CAST1™ Team [36] of professional advisors will guide you toward the optimum solution.

The most important benefit of Digi-CA™ is that every aspect of the final solution can be tailored to meet your precise user, security and policy requirements.

The most important benefit of Digi-CA™ is that every aspect of the final solution can be tailored to meet your precise user, security and policy requirements.

The following table can be used as a guide to assist in choosing the best Digi-CA™ Server for your environment.

Selecting Your Digi-CA™

The Correct Digi-CA™ for you

[101] You should clearly identify if your user group is open or closed, what you want to use your Certificates for and whether you have the staff required to run and operate the Digi-CA™. If, having downloaded and read the Digi-CA™ Manual [76] that advises you on how to select your Digi-CA™ and you are still not clear, then contact the Digi-CAST1™ Team [36] and seek their advice before proceeding further.


Migration from a Traditional CA

Using the authentication and validation Certificate Policies from your Traditional CA, Digi-CA™ can migrate users automatically without requiring any IT resources or Administrators’ time.


Customization & Flexibility

The Digi-CA™ is probably the most flexible and capable CA system available in the market today. Unlike the other Traditional CAs, Digi-CA™ takes advantage of the many advances in technology over the past seven years and you benefit by getting the flexible, cost effective and easily integrated CA system you need.

The Digi-CA™ still uses Unix in its Certificate Engine core but by using Open Standard Architecture in other modules, the Digi-CAST2™ Team customisation and upgrade costs are substantially less than those normally associated with the complex and costly modifications of the less flexible Unix Traditional CAs.

This section explains the design principles and also gives typical examples of previous customizations . The most important feature of Digi-CA™ is that your precise requirements can be delivered, exactly as you require.


Process Customization

In the larger or more complex environment, the organization may require a workflow process to control the use of the Digi-CA™ usage from a cost, security or for general management reasons. The following is an example of a customization currently in use by a Digi-Sign customer for issuing Digi-SSLs™:

This type of customization is not unusual but it does add to the initial cost of deploying a Digi-CA™ system.

Process Automation

Every aspect of the Digi-CA™ can be automated. Examples of this would be where the Digi-IDs™ are being used to replace Usernames and Passwords for login to a secure website, to replace hardware tokens like SecurID®, to issue Digi-IDs™ for secure email [3] on a closed network or to replace an existing Traditional CA with Digi-CA™.

Using the Digi-CA™ flexible design technology and capabilities, it is possible to use existing LDAPs or other databases such as Oracle®, Active Directory® or any other SQL or flat file format to automate the Digi-ID™ [21] issuing, renewal, suspension and revocation processes.

Reasons for Choosing Digi-CA : X509 Certificate : Digi-Sign.com

Read more on why you should choose Digi-Sign [103]

Customising Your Digi-CA™

Interface Customization

[101] The entire Digi-CA™ system and all of the interfaces used by the Administrators and users can be completely customized on request. Typical reasons for the graphical changes are for integrating Digi-CA™ into a larger application to make a complete package or the simpler integration of the Digi-CA™ into the organization’s web systems or extranet.


Technical Specification & Help Files

The specification of the Digi-CA™ at the time of going to print is available in Appendix IV. All specification updates and technical help files are updated using the online support section of the Digi-Sign website located at www.digi-sign.com [44].


Language Capabilities

Digi-CA™ offers the capability to completely localise all interfaces, help files and user screens into your local language(s). This is particularly important to organisations where English is not used. It is also possible to have multiple interfaces with multiple languages for the same system. The following two samples show the Digi-CA™ Control Centre screen in Chinese and the user enrollment screen where users can apply for a Digi-ID™ [21] in Turkish.

Note: Sample Only – Grammar & Diction not checked

The importance of the capability to produce the Digi-CA™ in the local language(s) cannot be over stated. It will result in faster training of the RA personnel and will significantly reduce the Help Desk Support calls (where users are seeking help to with translations from English rather than actual technical support related issues).

It is also possible to have a single Digi-CA™ configured in multiple languages so that different Digi-RAs™ in different countries can use the same Digi-CA™ Control Centre in their native language. Similarly, the users requesting Digi-IDs™ can do so from the same system but again in their native language.

To have your Digi-CA™ localized in your language, the system files and instructions are available in Appendix I.

Digi-CA™ RA/API

Digi-CA™ Registration Authority [RA] Access Point Interface [API]

[101] The Digi-CA™ RA/API system is a highly customisable way to issue and manage x.509 Certificates issued for digital signature [3], secure email [3], two factor authentication [4] and other purposes. It:

• allows full control over the contents of the "Subject" field of the certificate
• allows full control over certificate authorisation process (rejection/approval)
• allows full control over certificate status (revocation/suspension/de-suspension)
• allows fully customisable user interface web page design, which can be hosted anywhere, for the certificate enrolment and installation process.
• works with Microsoft Internet Explorer 5+ (and with Outlook 2000+/Outlook Express 5.x+).

RA Account Point Interface Setup

The Digi-CA™ RA/API system is account based, therefore in order to be able to implement and use the system, the RA API account needs to be setup first on the Digi-CA™ Certificate Engine core system. Before implementing the RA API you must contact the Digi-CAST™ [8] Team to ensure you have the latest version and release notes.


Overview of the RA API System

The entire RA/API system is based on a flat and secure communication between the RA API and the Digi-CA™ Certificate Engine Core system. It is achieved using the HTTP ‘POST’ method secured with an SSL/TLS layer on top of a standard TCP/IP connection.


Flow Process

a. The RA API initiates the connection to the Digi-CA™ Certificate Engine Core system via the SSL/TLS layer and accesses a specific URL and passes the HTTP ‘POST’ parameters in the following pair format: {itemName}=, where {itemName} is the name value for the parameter key and {itemName} is the value of the parameter.

Depending on the specific action that needs to be completed by the Administrator, i.e.: Digi-ID™ [21] request, Digi-ID™ approval, Digi-ID™ suspension, Digi-ID™ revocation or other request, a different URL will be used for each individual action.

b. The Digi-CA™ Certificate Engine Core verifies all received data against local policy applied for the relevant RA API. If all data are correct, Digi-CA™ Certificate Engine Core executes the requested action and provides a real time response, so the success or error message can be collected by the RA Point and further used for appropriate Registration Authority actions.

Relevant points below are an overview of the steps involved in the Digi-CA™ RA operations using the RA/API.

The Digi-CA™ Certificate Enrolment API

[101] The user will browse to a fully customized Digi-ID™ Application Form Enrolment page. They will complete the details in the web form and click the ‘submit’ button. Depending on the chosen Certificate delivery method (Process/Package), a VB script or Java applet on the webpage can then initiate the chosen Cryptographic Service Provider [CSP] engine to generate the Private Key and Certification request (PKCS#10), before submitting all data (with the exception of the Private Key if the Process Method is chosen) to the Digi-CA™ Certificate Engine core system.


Allowed Subject Attributes

You will need to decide the type and order of the attributes that will appear in the "Subject" field of your Digi-ID™ [21] Certificate. You may have multiple attributes of the same type (e.g. multiple ‘OU’s are common). You will also need to consider what attributes are required and which of these, if any, are optional. These settings may also be overwritten by the Digi-Policy™ applied on the Digi-CA™ Certificate Engine Core system for the specific RA API. The following table is a list of the common attribute types that are currently recognized by the Digi-CA™ Certificate Engine core system:

Installing Dig-CA™ Server

[101] The type of Digi-CA™ Server you choose for your environment will dictate what information you need to install it and if you will need assistance from the Digi-CAST2™ Installations Team [36].

The basic requirements for installing any Digi-CA™ Server are very similar and the four main components are detailed for each case:

• Physical Environment
• Equipment Specification
• Network Configuration
• Operating System

Before proceeding with any installation of Digi-CA™, it is strongly recommended that a thorough study of the download Digi-CA™ Manual [45] Manual is undertaken. Ultimately, Digi-CA™ is software, however, all Certificate Authorities [2] need careful planning and decision making by informed personnel if the project is to be a success.

Careful consideration should also be given to using the Digi-CAST1™ [36] professional services and from the advice received whether it is recommended that Digi-CAST2™ Installation Team support.


Digi-CA™ Server Xs

Digi-CA™ Server Xs is Managed CA [79] for installation on a single server and comes complete with all the different sub-systems designed to run and operate efficiently on that single machine.

The basic Digi-CA™ Server Xs software is supplied on a DVD, or as a downloadable binary file inside a .zip file from the www.digi-sign.com [44] website. Subject to ordering and purchasing, the version of Digi-CA™ Server Xs you receive may be modified to meet your specific requirements. These modifications will result in a different install sequence in some cases. To ensure the installation instructions are compatible with the customized version of your Digi-CA™ software, the specific installation guide is included in the software delivered. Once received, install it by using the ‘Digi-CA Install Guide.doc’ supplied with the specific software on the DVD, or in the .zip file.

If a secure VPN connection to the single server can be provided, it is possible that the installation of the software can be carried out virtually by the Digi-CAST2™ Installation Team if required. The benefit of this is that it reduces the cost of travel and accommodation. When examining each of the following four sub sections you can consult with the Digi-CAST2™ Installations Team, at any time, to check configurations and access for you.

Digi-CA™ Server Xs Requirements

[101] These are the minimum suitable conditions for the correct operation of the single server Digi-CA™ Server Xs:

• Dry area with good ventilation or air-conditioning if possible
• Secure room or computer cabinet with restricted, controlled and logged access
• Broadband or leased line internet access
• Power supply with optional backup power supply
• Availability of IT Professional (MCSE or higher/other on a part-time basis, 4-hour call-in contract will suffice) with good working knowledge of computers, networking and general knowledge of TCP/IP protocols

Server Xs Equipment Specification

These are the minimum equipment specification for the correct operation of the single server Digi-CA™ Server Xs:

• 2 x Server: Dell®/HP®/IBM®
• Processor: Intel® Pentium® III family
• Memory: 1 GB RAM
• Hard Drive: 15 GB SCSI/ATA
• SCSI Controller (optional)
• RAID Controller: RAID PERC 3/4/SC (optional)
• 100/10 MB Intel® Compatible Network Card
• CD-RW/DVD 4x Combo
• Monitor
• Keyboard
• Router
• Software/Hardware Firewall (optional)

Digi-CA™ Server Xs is supplied complete and ready for total install on the server but it must have a Unix or Linux Operating System [OS] pre-configured.

During the installation, the Digi-CA™ Server will use versions of the following software that will be hardened and modified by the Digi-CAST2™ Team [36] during their installation work:

• OpenSSL Cryptographic Toolkit
• Apache Web Server
• PHP Scripting Language
• OpenLDAP Server and Client
• MySQL Database Server

The previous list is provided for information purposes only.


Server Xs Network Configuration

These are the minimum requirements for the correct installation of the single server Digi-CA™ Server Xs:

• Hardware as per Equipment Specification
• 512Kbs network (via Internet) access to the server
• VPN software installed and tested (optional)
• VPN client software sent to Digi-CAST2™ (optional)
• SSH interface to the server
• ‘Root’ login credentials for remote server access

Server Xs Operating System

Digi-CA™ Server Xs can be installed on any Unix or Linux platform once it is compiled in advance. The Digi-CAST1™ Team will advise you on the best Operating System [OS] for your environment and here is a suggested list:

• Sun Solaris 10.x+
• Red Hat Linux Enterprise 4.x+
• FreeBSD 5.4+

Digi-CA™ Server Xp Requirements

[101] Digi-CA™ Server Xp is Managed CA [79] for installation on two or more servers and comes complete with all the different sub-systems designed to run and operate efficiently on these machines. Customizations and certain specific requirements can be facilitated in this class of the Digi-CA™ software and HSM hardware can also be included in the design of the CA network as required.

The basic Digi-CA™ Server Xp software is supplied on a DVD, or as a downloadable binary file inside a .zip file from the www.digi-sign.com [44] website. Subject to ordering and purchasing, the version of Digi-CA™ Server Xs you receive may be modified to meet your specific requirements. These modifications will result in a different install sequence in some cases. To ensure the installation instructions are compatible with the customized version of your Digi-CA™ software, the specific installation guide is included in the software delivered. Once received, install it by using the ‘Digi-CA Install Guide.doc’ supplied with the specific software on the DVD, or in the .zip file.

As with Digi-CA™ Server Xs, if a secure VPN connection to the server environment can be provided, it is possible that the installation of the software can be carried out virtually by the Digi-CAST2™ Installation Team [36] if required. The benefit of this is that it reduces the cost of travel and accommodation. When examining each of the following four sub sections you can consult with the Digi-CAST2™ Installations Team, at any time, to check configurations and access for you.


Server Xp Physical Environment

The minimum suitable conditions for the correct operation of the dual server Digi-CA™ Server Xp are the same as those for [106].


Server Xp Equipment Specification

These are the minimum equipment specification for the correct operation of the dual server Digi-CA™ Server Xp are the same as the specifications for [107] except 2 x Servers: Dell®/HP®/IBM®, are required.

During the installation, the Digi-CA™ will use versions of the same software that is used by [106] will be hardened and modified by the Digi-CAST2™ Team during their installation work.


Server Xp Network Configuration

The minimum requirements for the correct installation of the dual server Digi-CA™ Server Xp are the same as those for [108].


Server Xp Operating System

As with Digi-CA™ Server Xs [109], Digi-CA™ Server Xp can be installed on any Unix or Linux platform once it is compiled in advance. The Digi-CAST1™ Team will advise you on the best Operating System [OS] for your environment.

Digi-CA™ Server Xg Requirements

[101] The Digi-CA™ Server Xg is completely customizable and can be installed across many servers, even if they are in different locations. As stated, Digi-CA™ Server Xg customisation, configuration and testing is conducted off site after detailed requirements are documented and agreed with the customer. This off site work can take several weeks, or months, depending on the level and scale of the customisations required.

As an example, when Digi-CA™ Server Xg is used to build a Trust Centre [10], a minimum of four servers are required and if the correct internet connection and a VPN can be provided to the servers, it is possible that much of the preparation and network testing prior to the installation of the software can be carried out virtually. However, the Digi-CA™ Server Xg will require at least one site visit from a Digi-CAST2™ Team Member [36] to conduct certain specialist tasks.

The benefit of using the VPN connection as much as possible during this preparatory work is that it reduces the cost of travel and accommodation. When examining each of the following three sub sections you can consult with the Digi-CAST2™ Team at any time to check configurations and access for you.

Server Xg Physical Environment

These are the minimum suitable conditions for the correct operation of the multiple server Digi-CA™ Server Xg:

• Two dry areas with good ventilation or air-conditioning
• Two secure rooms or computer cabinets with restricted, controlled and logged access
• Multiple broadband and/or leased line internet access
• Power supply with optional backup power supply
• Availability of IT Professional (MCSE or higher/other on a part-time basis, 4-hour call-in contract will suffice) with good working knowledge of computers, networking and general knowledge of TCP/IP protocols

Server Xp Equipment Specification

These are the minimum equipment specification for the correct operation of the dual server Digi-CA™ Server Xp are the same as the specifications for [107] except 4 x Servers: Dell®/HP®/IBM®, are required and we also recommend using at least one HSM (nCipher, Utimaco, etc).

During the installation, the Digi-CA™ will use versions of the same software that is used by [106] will be hardened and modified by the Digi-CAST2™ Team [36] during their installation work.


Server Xp Network Configuration

The minimum requirements for the correct installation of the Digi-CA™ Server Xg are the same as those for [108].


Server Xp Operating System

As with [110], Digi-CA™ Server Xg can be installed on any Unix or Linux platform once it is compiled in advance. The Digi-CAST1™ Team will advise you on the best Operating System [OS] for your environment.

[101] The Digi-CA™ PKI [7] System supports a variety of Unix and Linux operating systems. It was also designed to use various third party software libraries that are required to be present on your operating system prior to the beginning of the installation of any version of Digi-CA™.

The support and ongoing development of third party software applications and libraries that are necessary to install and operate Digi-CA™ software is not part of the system or license provided. However, for your reference, you can find a set of stable software applications and libraries provided as part of the distribution of the Digi-CA™ PKI System. A list of these applications and libraries and a set of quick installation guides for each of the necessary applications or libraries is included in this sub section.

Digi-CA™ Hierarchy

[101] As can be seen from the extensive documentation relating to the Key Ceremony [19], at the heart of every Digi-CA™ is at least one Root CA. Every Digi-CA™ Certificate is made from a Public and a Private Key. After the Root Key Ceremony procedure has produced the unique pair of Public and Private Root Keys is generated and depending on the Certificate Practice Statement [12] [Certificate Practice Statement [12]] and Certificate Policy [CP], the generation of the Root Keys may require notarization, legal representation, witnesses and ‘Key Holders’ to be present. This process is best explained with some examples and for further details review the Root Key Ceremony [19].


Root Certificate

The Root Certificate is only ever used to sign the Intermediate Root Key(s). After signing this Key(s) the Root Key is 3-DES encrypted and split into a minimum of 4 Key shares that are each stored on 3-DES encrypted smartcard and signed with RSA SHA-1. All Key shares will have a unique password and should be stored separately in different secure locations (bank vault, safety deposit box, attorney’s office, etc). A Key generation log is kept in the system and in a separate physical log.

Important Note: the Root Certificate should not exceed a 25-Year life duration.


Creating a Digi-CA™ Root Certificate

In order to create Digi-IDs™ from the system, at least one self-signed Digi-CA™ Root Certificate must be generated. There is a possibility in the system, depending on ordered options, to create any number of Digi-CA™ Root Certificates and Digi-CA™ Intermediate Roots with different policies and validity. The figure below represents a theoretical relationship between Digi-CA™ CA Certificates. Please consult Digi-CAST1™ [36] before setting up your specific schema.


Intermediate CA Certificate

The Intermediate CA Certificate is protected by 3-DES encryption and all key shares have unique passwords.

Important Note: the Root Certificate should not exceed a 25-Year life duration.


Intermediate Trusted CA

The Digi-CA™ PKI [7] System provides the ability to operate a Sub-CA that can be signed by a publicly recognized CA. This enables the Digi-CA™ to issue and manage Digital Certificates [3] for S/MIME and SSL, that are globally trusted throughout the Internet Community. To get a globally Trusted Root [TRoot] to sign the Sub-CA, consult the Digi-CAST™ [8] Team leader for your project.

Guide

Intended Audience

The Audience of this Guide should have a basic understanding of computers, how to use office software, send and receive email and how to browse the internet.

Your Approach at Your Speed

Implementing a certificate Authority is not a ‘one size fits all’ project. Your requirement might be for a few hundred users with exceptionally high security parameters or you could be looking to authenticate several million hardware devices. The commercial organisation’s requirements are typically related to cost, benefit, risk and return whilst the government project is more concerned with statutory requirements, IT standards and compliance.

No matter how small or large your requirement, you’ll have restrictions on what your current environment can cope with; availability of staff; budgetary constraints and other parameters within which you must choose the correct CA for your organisation. You may want to be very ‘hands on’ at every stage of the project and even want to conduct some of the integration and even programming or you may decide you want us to do everything for you. Just as Digi-CA™ is totally flexible, so too is the Digi-Sign approach.

Approach

The ‘Fast Track’ Approach

‘Fast Track’ is exactly as it sounds, you want everything done as quickly as possible and you want the professionals to do it for you. This is a total ‘turn key’ approach where we take your instructions, document them and deliver the entire solution back to you in the shortest possible time. Once the Digi-CA™ is in ‘production status’, you nominate personnel within your organisation to take responsibility for it and we support them in the background.

Total Trust Management™ Approach

This is where we not only ‘Fast Track your requirements through to delivery but actually assume responsibility for the total management of your CA environment for as long as you need us too.

Total Trust Management™ [TTM™] is a unique offering from Digi-Sign (although some vendors have tried to copy it) and it means that you Trust us to Totally Manage the Digi-CA™ for you. TTM™ is much more than a dedicated telephone support line, it’s a service where Digi-Sign personnel effectively work for you. We ensure that the CA technology is introduced to the end users with the minimum of fuss. All you do is agree how you want us to operate the Digi-CA™, and we do everything for you. It’s a bit like travelling First Class.

75% of our customers use TTM™ in the first year, at least, so that they can see how we do everything and then learn by watching us.

Build-Box-Deliver Approach

For an installation of Digi-CA™ Server (see sub section 3.7.3.2), we document your requirement, you sign the documented order and then we build, box and either ship it to you for installation or, in the case of Digi-CA™ Service (see sub section 3.7.3.1) we host it for you so that it only needs to be activated.

If your requirements include integration work or customisation, this is scheduled and delivery is subject to Production scheduling and all of this is agreed in advance.

Delivery by an ARP Member

Most Digi-CA™ systems are delivered by a member of the Digi-Sign Affiliates, Resellers & Partners [ARP] Network. The ARP member will co-ordinate all aspects of the delivery, installation, configuration and setting the system to production status for you.

Benefits

Digi-CA™

Digi-CA™ replaces older Legacy CA systems using the latest in CA and PKI technologies and benefits from combining commercial and open source software initiatives. With Digi-CA™, all of the complexities and onerous technical overhead that were required by Legacy CAs have been simplified to a ‘user-friendly’ and usable level.

By combining the consulting and professional services offered by Digi-CAST™ (see sub section 3.1) with the functions provided by Digi-CA™, can bring an organisation to a highly professional PKI level, meeting the criteria for internationally recognised accreditation standards such as WebTrust® and ISO 27001 certifications.

Choosing

Reasons for Choosing Digi-CA™

Compliance to international standards		Digi-CA™ follows the international industry standards for PKI and CA systems so that is can easily fit into almost any certificated IT infrastructure and work seamlessly within that environment.  This compliance to standards is important when considering current requirements and potential future requirements too
Programming language		All components of the Digi-CA™ system kernel have been developed in C on Unix and this is considered the most stable, secure and efficient language and operating system for the development of PKI & CA systems
Centralised Management		Web based ‘system management centre’ for all operated CAs, RAs & LRAs makes it ideal for operation as an installed standalone CA system or as a Managed CA
‘futureproof’		By its very design, the entire Digi-CA™ system can be in house, totally out sourced or a combination of the two and this can be decided at any stage during the life of the system. So you can purchase what it needs today, safe in the knowledge that you can easily migrate and move all or part of the system to the Managed CA alternative to meet your future demands
Ease of integration		Whether now or in the future, because it is LDAPv3 compliant, Digi-CA™ can publish X.509 certificates and certificate Revocation Lists [CRL] to other directories. This is a significant factor when considering integration with existing or future environments
Scalability		Digi-CA™ can scale, easily and with minimal/no interrupting of live operations. This is important when considering the future growth of your requirements. It is also possible to add additional hardware to expand the system capacity and services and to conduct cross certification
Continuous operation		When considering the future growth of your requirements, live production can continue uninterrupted while adding more CAs, RAs and LRAs. These capabilities ensure the CA remains operational and without interruption throughout
Customisation to your requirements		Custom multi-layer CA hierarchy, RA and LRA distribution can be modified, extended and changed at any stage and again, this can be done without affecting the operation of the live environment
‘look & feel’ customisation		The entire Digi-CA™ system interfaces and all its levels can be easily changed using Cascade Style Sheet [CSS]. This ability to completely change the ‘look and feel’ of the system eases the deployment to your end users because they know you but may not be familiar with the CA vendor.  It also helps with integrating into web sites and other online systems seamlessly
Multiple Languages		Language localisation is “plug n’ play” for displaying all interfaces in your desired language(s). This further helps the deployment to end users and reduces ‘help desk calls’ (where users are really looking for translation of help files, etc)
Custom profile, enrolment & DN capabilities supplied as standard		Certificate profiles and enrolment policies can be customised and therefore full custom certificate subject Distinguished Name [DN] attributes and certificate extensions are possible.  This is particularly important when meeting national & international standards and the cost of providing these capabilities from other systems can be considerable
CA Flexibility		Ability to operate multiple independent CA hierarchies from a single system instance without the need of installing multiple software applications on multiple server computers to run each CA hierarchy
RA Flexibility		Multiple independent Registration Authority [RA] instances from a single system without needing to install multiple applications on multiple servers to run each RA
100% browser independent		100% certificate enrolment web browser platform and operating system independency
Root CA cross certification		Digi-CA™ offers the capability of cross certification between the your Root CA and any other CA
Trusted Root capability		Also it can be cross certified by a Trusted Root CA of issuing trusted SSLs and secure, signed and/or encrypted email
Best training & knowledge transfer		With the largest online searchable PKI & CA KnowledgeBase, the extensive documentation offered, the Digi-TaSC system and the many different types of training offered, this proposal offers the most comprehensive that programme for your personnel
Overall most capable & most competitively priced		Digi-CA™ achieves the best blend of meeting your current requirements and possible future ones too. It’s highly customisable and flexible features means it will meet future demands easily, without incurring downtime, service interruption or unwieldy costs