PKI Digital Certificate Expiry IESO IT System Status Update David Short / Malcolm Dellow 9 March 2010

Transcription

1 2010 IESO IT System Status Update David Short / Malcolm Dellow 9 March 2010

2 Overview In January 2010, Verizon (formerly Cybertrust) notified the IESO that their Root Certificate Authority (CA) expires on May 13, 2010 (end of 5-year life) The impact is the IESO to issue new digital certificates before May 13, once Verizon establishes the new CA which will operate in parallel with the existing system This will impact all Market Participants using PKI digital certificates when logging into the Market Participant Interface (MPI), Application Programmer Interface (API) and Portal systems 2

3 Timeline Note: * - Exact Date and time to be confirmed As soon as possible, Participants to Implement new Firewall rules but keep old rules 18 Feb March March 2010 * 13 May 2010 Release 23.1: (Prelim) Participant Technical Reference Manual IESO Developer's Toolkit (IDK) Implementation Manual Market Manual 1: Market Entry, Maintenance & Exit Part 1.3: Identity Management Operations Guide New Java Policy file New Certification Lifecycle System (CLS) Download Software: New Certificate Lifecycle System (CLS) Download and install new java policy file IESO: IESO begins contacting select participants to issue new digital certificates Cleanup: All active digital certificates have been re-issued with old certificates expiring Participants are advised to remove old Firewall rules 3

4 Document Changes The IESO has released updated documentation: Participant Technical Reference Manual IESO Developer's Toolkit (IDK) Implementation Manual Part 1.3: Identity Management Operations Guide 4

5 Software Changes The IESO has released updated software: New CLS can be installed now to maintain existing certificates and used by Market Participants once they have been issued new digital certificates as it will work with the new CA IP addresses No software changes are required for MIM IDK however, Market Participants must change to the new CA Manager and Directory server IP addresses once a new API certificate has been created Market Participants using the MPI can download and install the Java Policy file as soon as the IESO posts it on the website prior to creation and use of new digital certificates. This is currently being tested. No changes are required for MIM IDK (API) 5

6 New Firewall Rules Since the new Verizon CA will be operating from a new system, new IP Addresses are required All Market Participant firewall rules must be altered for those who use the CLS, MPI GUI and/or MIM API before the IESO can issue you new digital certificates Firewall rules will must be checked and updated to ensure e- mail can be received from the new Verizon Certification Authority system The new IP address information is available in updated Participant Technical Reference Manual IMPORTANT: Keep the current IP address until the new digital certificates are provided an all participant users/systems have switched to the certificates 6

7 IESO Activities We have formed a team that is undertaking the following: Working with Verizon to test the new CA production system Update IESO firewall rules Update documentation Update CLS and Java Policy files Migrate all active accounts that have active certificates, any accounts that have been used at all within the past year and any recent new accounts Issue new certificate activation codes for all migrated accounts 7

8 Verizon Data Center Move Cleanup Participants are reminded to update their Firewall rules to exclude the old Verizon data center IP address 8

9 Verizon Data Center Move References: Web page: Next Steps: Through a combined ITSC and SE initiative, the IESO will present alternatives to PKI this year with a target of replacement by mid-2011 Preference is an adaptive authentication system that uses UserID/password and other confidential questions/and answers, patterns of behaviour etc. Questions? 9