Digital Certificate IP Address Test Procedure

Transcription

1 Digital Certificate IP Address Test Procedure Testing Firewall Access to New CA IP Addresses May 11 th to 15 th Verizon is making some test servers with the new Certificate Authority (CA) system IP addresses temporarily available May 11 th to May 15 th for the ability of Market Participants to test their firewall rules in preparation of the June 5 th CA datacenter move. The new IP addresses and ports that require firewall rule configuration are: Cybertrust Production System CA Manager IP Address = TCP ports 829 Cybertrust Production System Directory Server IP Address = TCP ports 389 Step 1 Download the Test Batch file for Testing the New CA IP Addresses A zipped test batch file is located on the Digital Certificate Systems update web page. The direct URL is: Download this zipped file and unzip it to a location such as the CLSv1.7 directory where the other 2 batch files included with CLSv1.7 exist. The directory location may be different if it was installed in a different drive and directory. For example some Market Participants may want to install it on D: drive etc. or a network server location. Alternatively the batch file can be put in a temporary location of the user s choice. Step 2 Run the Test Batch file to test Access to the Test CA systems with new IP Addresses Locate and confirm the existence of the test batch file: Test New CA IP Addresses.bat. See the example screen capture in Figure 1 below. 1 April 23, 2009

2 Figure 1 This batch file can be used to test participant firewall access to the Verizon test servers with the new CA system IP addresses at Verizon. The test batch file instructions use IP Addresses instead of Domain names for establishing Telnet sessions to the CA servers for communication channel verification through the Market Participant s firewall. Double click the mouse cursor on the Test New CA IP Addresses.bat file. A DOS command window will activate as shown below. Figure 2 Hit any key to continue. As indicated in the screen capture below (Figure 3), the batch file will then start the procedure to test access to the CA Manager and Directory server through the participant s firewall using the new IP addresses. The Globalsign root CRL server is unchanged for the CA Data center move but access to it is also tested. 2 April 23, 2009

3 Figure 3 Hit any key to continue. The batch file procedure will then display what the expected results will be for both successful and unsuccessful communications to the CA servers through the participant s firewall as shown in the next screen capture below (Figure 4): Figure 4: Hit any key to continue to begin the testing. The test batch file procedure will then start up three telnet sessions in minimized mode to connect to the 3 CA servers with the new IP addresses at Verizon. These will show on the bottom status bar as shown in the example below (Figure 5). Figure 5: The batch file procedure will allow the tenet sessions to be set up before continuing as shown in 3 April 23, 2009

4 the screen capture of the DOS window below (Figure 6). Figure 6: Hit any key to continue the testing. The procedure will then show the status of the connectivity via the Telnet session to the CA servers. If successful, the results should be at least the following: (There may be some Time Wait status lines as well for the same IP addresses.) PROTOCOL LOCAL ADDRESS/PORT CA ADDRESS/PORT STATUS TCP : :80 ESTABLISHED TCP : :829 ESTABLISHED TCP : :389 ESTABLISHED If the new IP addresses have not been configured, the results will likely show as: PROTOCOL LOCAL ADDRESS/PORT CA ADDRESS/PORT STATUS TCP : :829 SYN_SENT TCP : :389 SYN_SENT TCP : :80 ESTABLISHED The SYN_SENT status indicates that no communication to the CA server is established at the indicated IP address and that the participant s firewall rules are not allowing access. An example of this is shown in the next screen capture (Figure 7). 4 April 23, 2009

5 Figure 7: Hit any key to continue. The next screen will instruct the user to close down the 3 telnet sessions. The test batch file can be stopped at this point by closing the DOS command window. Closing the tenet sessions can be done by using the right mouse button on the status bar item to close them. An example of this is shown below: Figure 8: If the testing shows that firewall rules are OK, testing is complete and the Market Participant firewall at the location tested is ready for the Verizon CA Data center move. If not the Market Participant (or their vendor) will need to correct the firewall rules and the test should be conducted again. 5 April 23, 2009