PKI Competition and EJBCA Integration

Transcription

1 PKI Competition and EJBCA Integration 5th Marco Reichwald, LVM Michael Pollmeier, S&N AG

2 Agenda LVM and S&N The PKI-Study Why did EJBCA win? Integration in our large environment Experiences 2

3 LVM and S&N LVM Versicherungen Founded in 1896 One of the 20 largest insurers in Germany About 3m customers and 9m contracts Head office in Münster, approx agencies all over Germany 3

4 LVM and S&N S&N Established in 1991 Private limited company since 1999 Head office in Paderborn Subsidiaries in Berlin, Frankfurt/Main, München Approx. 150 employees (S&N Group) Network of partners worldwide 4

5 LVM and S&N Financial statements IT Infrastructure Financing SOA Expertise Business Process Management Groupware and Messaging - Balance sheets, compilation, acquisition - Transfer, valuation, rating - Citrix Terminal Server, data bases - Web and application servers, monitoring - Basel II and credit processes - Consumer credits, object financing - Process evaluation from the business side - Introduction of SOA architecture - DWH, data bases, data mining, - Data modelling, reporting and OLAP - Infrastructure, migration, roll out - System operations / application development Process optimisation Open Source for Enterprises - Process integration, connection - Analysis, modelling, prototyping - Portals, customised/verified products - Service and Support Multi Channel Support SAP Projects - Branch, mobile, iinternet - Self service terminals - SAP R/3, SAP BW, SAP EP, SAP IS-U, - Insurance AddOn InSTRA Output management Banking periphery - Design, forms - Print management AFP - Device integration and architecture - Solutions for cash processes Innovation Business Business Consulting Initialisation Realisation Preparation for operation IT Development Operations IT Operations Quality management Project implementation Application management 5

6 The PKI-Study Starting point History: IBM Tivoli PKI Afterwards: "Self made" PKI based on OpenSSL intended to be used for a transitional period needed: standard software consulting project started 6

7 The PKI-Study Requirements analysis current architecture and technologies expected future developments weighted requirements matrix 7

8 The PKI-Study Market study Open Source and commercial products Contacted all major players First round: filtering out with requirements matrix MS Windows Server 2008 Entrust Authority Novell OpenXPKI 8

9 The PKI-Study Duel EJBCA Red Hat Certificate Server Prototyping Marketing vs. reality 9

10 Duelling Results Usability Both have separate UIs for admins and users Script support Red Hat lacks of Inconsistent usability: admin console History not usable 10

11 Duelling Results Documentation EJBCA quite lean, but handles all major points Red Hat Very detailed, not very deep Both Additional support needed 11

12 Duelling Results Architecture EJBCA JEE Technology Tidy, well structured Using standard libs Red Hat: Technology mix: Java, C, Perl Untidy and outdated Many netscape relics 12

13 Duelling Results Outview EJBCA Evolution instead of revolution Future-safe architecture Web Services Red Hat Version 8 should fix many architectural issues Integration into RHEL5 FreeIPA 13

14 Duelling Results Why did EJBCA win? EJBCA lively open source project good architecture support directly from the core devolopers Red Hat Certificate Server FreeIPA: good vision, but not ready yet 14

15 Infrastructure Linux Clients LDAP Reverse Proxy Backends Backends Backends Backends 15

16 A new PKI We needed a new solution due to requirements of our networking team: "We want to test VPN devices that get their certificates via SCEP Benefit of open source: If you find a working solution, just download and install 16

17 A new PKI First contact with EJBCA 1. Edit some config files, 2. Deploy into JBoss, 3. There is no step 3! You have a running PKI to play around with 17

18 EJBCA After the official decision Individual training direct from the developers: You get a basic understanding of how everything works you have a good feeling 18

19 EJBCA Transition from old to new Existing setup works with webservices and LDAP EJBCA works with webservices and LDAP (and everything is open) Solution: Write some wrappers and we're done. No need to touch clients, allows simple drop-in replacement 19

20 EJBCA Architecture Based on Enterprise Java Beans, EJBCA supports a wide range of platforms We are using Linux on x86 (RHEL) and DB/2...but DB/2 on z/os 20

21 EJBCA Support Official support partner is S&N (German contract) Technical support from PrimeKey Direct contact to developers, no arguing with 1st-level support DB/2 on z/os support was working after 2 days 21

22 Thank you! 22