Draft Agenda for DataGrid Testbed Certificates meeting
CERN 4/5 December, 2000

Day 1: 14:00 to 18:00  Room 600-R-017
Day 2: 09:00 to 13:00  Room 600-R-017


0. Aims of meeting. Agreement of agenda. Notes/minutes?

1. Roundtable status report. A brief description of your existing use, 
and any plans for the future use, of certificates for Globus.

2. Authentication vs Authorisation 
I see this to be a major architectural decision.
The users/experiments in WP8 want easy access to resources across the 
whole GRID. What should the certificate verify? Just the identity of 
the person or also something about membership of particular 
experiements? To what extent should the certificate be used in any 
scheme for authorisation to use resources?

	- news from Globus on these issues... CAS

3. How many CA's should be used in the DataGrid testbed? 
The alternatives seem to be: 
One, a group of national/institute CA's, experiment based CA's, or 
some mixture of the above.

4. Does a hierarchy add value? Should we, can we sign national 
certificates by a single HEP-root CA? Does Globus support this? 
Does it help the scaling problem of maintaining client/server 
lists of trusted CA's?

	- news from Globus on this issue.

5. What is the scope of the certificates? Should they be useable 
across the whole DataGrid? What about other GRIDs? Should they be 
used for other applications, e.g. mail?
Do we issue certificates for servers as well as for users?

6. Revoking certificates. How do we do this? What info needs to be 
distributed? Does Globus support automatic checking of CRL's?
Do we need to issue users with revocation certificates?

7. Naming. What constraints are there on the name fields? 
Do we need to co-ordinate? How does one re-issue a revoked 
certificate - does the DN have to change or use a unique identifier? 
Should the name include experiment membership (for people with more 
than one local username)?

8.What can we learn from other GRID projects or other PKI initiatives? 
Do we need to be consistent?

	- input to Terena PKI meeting (6th December)?

9. Procedures for running CA's and issuing certificates. We need to 
convince each other that our certificates can be "trusted". 
How do we do this?

10. Other issues
	Period of Validity (CA's, Servers, Users)
	Key lengths
	User education - to keep private key and pass-phrase secure
	Instructions for system managers - to configure list of 
		trusted CA's
	Limited functionality of gatekeeper proxy certs 
		- is this a problem?

11. Who is doing authorisation if we don't? WP2?

12. Storage of certificates? LDAP?