20080813: Testing Communication with CA Operators

On August 13, 2008, the IGTF RAT performed a test of the registered email addresses for all IGTF CAs.

Request To CA Operators

Subject: IGTF request -- please reply
Date: Wed, 13 Aug 2008 12:47:19 -0500

Certificate Authority Operators,

On behalf of the International Grid Trust Federation Risk Assessment
Team (IGTF RAT), I request your response to this message within one
business day.  Please reply as follows:

  The XXXX CA acknowledges the IGTF RAT request.
  CA hash(es): YYYYYYYY, ZZZZZZZZ

replacing "XXXX" with the name of your CA and replacing "YYYYYYYY,
ZZZZZZZZ" with a list of hash values identifying your CA(s), i.e., the
value(s) used for the YYYYYYYY.0 and YYYYYYYY.signing_policy files for
your CA.  Sites that operate multiple IGTF CAs should reply with the
hash value for each CA they operate; sites that operate only one IGTF
CA should reply with only one hash value.  The hash values will help
us to identify which CAs have replied.

For example:

  The NCSA CA acknowledges the IGTF RAT request.
  CA hash(es): 9b95bbf2, f2e89fe3

Please reply to both jbasney@ncsa.uiuc.edu and igtf-rat@eugridpma.org.
Thank you for your prompt response.

Additional background information:
The International Grid Trust Federation Risk Assessment Team (IGTF
RAT) was recently established with the responsibility for assessing
risk and setting time and deadlines for response and action for
concerns and vulnerabilities (such as the recent Debian OpenSSL key
generation issue identified as CVE-2008-0166).  To be effective, the
IGTF RAT must have the ability to communicate promptly with IGTF CA
operators.  The EUGridPMA has established one business day as the
expected response time for requests from the IGTF RAT.  This message
is intended to test the registered email addresses for the IGTF CAs.
More information about the IGTF RAT is available at:

  https://tagpma.es.net/wiki/bin/view/IGTF-RAT

Regards,
Jim Basney
On behalf of the IGTF RAT

Jim resent the request Mon, 18 Aug 2008 09:23:13 -0500 to the 12 CAs who had not yet responded.

Results

Overall results were as follows:

• 57 (75% of 76) CAs responded within one day.
• 60 (79% of 76) CAs responded within two days.
• 73 (96% of 76) CAs responded within one week.
• 76 (100%) CAs responded within one month.
• 8 (10.5% of 76) CAs responded within one hour.
• Two CAs (Grid-Ireland and INFN) sent automated trouble ticket acknowledgements.
• BCCing the CA addresses caused 4 CAs to hold the message for list moderator approval because "Message has implicit destination". It also caused the message to be held by DFN's spam filter. We should avoid using BCC in the future and instead just use Reply-To.
• Updates to contact addresses for some CAs will appear in the next IGTF release.

Per CA results are recorded in the following table: