Verizon/Cybertrust Data Centre Move May IESO IT System Status Update David Short / Malcolm Dellow 10 March 2009

Transcription

1 Verizon/Cybertrust Data Centre Move May 2009 IESO IT System Status Update David Short / Malcolm Dellow 10 March 2009

2 Overview Verizon Business (formerly Cybertrust) is moving its Certificate Authority Data Center in May Data center hosts IESO PKI digital certificate services PKI services accessed by all Market Participants using PKI digital certificates when logging into the Market Participant Interface (MPI), Application Programmer Interface (API) and Portal systems May 2009 data center move involves IP address changes for both the CA Manager server and the CA Directory Server 2

3 Timeline Note: * - Exact Date and time to be confirmed Participants to Implement new Firewall rules, new IDK and IESO queries certificate expiries IESO to test after Verizon change and Participants to implement new IP Address March 4 By March 31 May 8 * May 12 * By May 29 Release 21.0: Participant Technical Reference Manual IESO Developer's Toolkit (IDK) Implementation Manual Part 1.3: Identity Management Operations Guide Download Software: New Certificate Lifecycle System (CLS) New IDK IESO: Goes into offline operations mode Access to Portal services using PKI are blocked (TRA only) IESO: Returns to online operations mode Access to Portal services using PKI resumes (TRA only) New CLS can be used Participants: Must be operating with new IP address and new IDK Cleanup: Participants are advised to remove old Firewall rules 3

4 Document Changes The IESO has released updated documentation: Participant Technical Reference Manual IESO Developer's Toolkit (IDK) Implementation Manual Part 1.3: Identity Management Operations Guide 4

5 Software Changes The new CLS (two batch files) and MIM IDK must be installed and used by Market Participants before the data center move: The new MIM IDK (v3.2) is capable of being used with both the existing and new IP address The Start_CLS_Old_Data_Center e batch file can be installed and used before the IP address change The Start_CLS_New_Data_Center batch file can be installed and used after the IP address change Market Participants can install new CLS and IDK immediately and test: CLS with renamed batch file which uses existing CA IP addresses MIM IDK against MIM Sandbox with existing CA IP addresses 5

6 Preparation - Firewall Rules The IP Address changes requires that firewall rules be updated by all Market Participants who use the CLS, MPI GUI and/or MIM API before the May change Firewall rules will need to be checked and updated to ensure e- mail can be received from the Verizon Certification Authority's data center(s) IP address information is available in updated Participant Technical Reference Manual 6

7 Preparation Certificate Expiry IESO will query and monitor CA Authority system to see what PKI accounts will have certificates expiring weeks before and during the data center move IESO will communicate to those participants on impact of any expiring certificates and work on action plan to manage expiry 7

8 IP Changeover (Transition) IESO will configure Sandbox and Production market system to CA offline mode so Market Participants can continue to login via MPI and MIM API. Offline mode will be maintained until after data center move has been implemented successfully. The Portal PKI access (TRA user impact only) will be blocked until changeover is complete and tested by the IESO IESO will test CLS, MIM API and MPI access to new data center after Verizon has confirmed completion to ensure new data center systems with new IP addresses are active and are available All MPs using the MIM API must update their systems with the new IP address during this time to ensure successful login 8

9 Data Center Changeover Completed The Portal PKI access will be re-enabled and tested by the IESO once Verizon has confirmed completion of the data center move MPI and MIM API access will then be normally online against new Verizon data center IP address The Start_CLS_New_Data_Center batch file can now be used 9

10 Cleanup Participants are reminded to update their Firewall rules to exclude the old Verizon data center IP address 10

11 References: Notice in IESO Weekly Bulletin Table of Changes Questions? 11