Fermilab PKI Transition

The Energy Sciences Network (ESnet) is transitioning away from supporting the DOEGrids certificate authority (CA), and the DOE Grids public-key infrastructure (PKI) has ceased issuing new certificates. Certificates already issued will continue to work until they expire (one year from the date of issue Fermilab virtual organizations and web hosts and services that rely on DOEGrids certificates are transitioning to use a new CA.

News from OSG on DOE Grids service transition from Open Science Grid (OSG)
See OSG transition page - contains more information about the DOE Grids service transition and OSG
Fermilab PKI Transition Frequently Asked Questions

Documentation

• Overview of using certificates at Fermilab
• Do I need a certificate? If so, KCA or OSG?
• Types of certificates: personal, host and service certificates
• How to GET a personal OSG certificate*
• How to RENEW a personal OSG certificate
• How to use certificates to access restricted websites
• Trusting certificates and how to download a CA certificate (KCA and OSG)
• How to import and export personal and CA certificates into and from applications
• Fermilab PKI-mediated access control policy
• How to get your website to run SSL and optionally user certificate authentication
• Configuring an IIS Web Server to use SSL (prerequisite to configuring user certificate authentication for IIS)
• Configuring user certificate authentication for IIS
• How to get an OSG PKI Certificate for Fermilab Hosts or Services (Grid and Web)
• How to set your email client to digitally sign and/or encrypt your outgoing messages

* If you are using a personal DOEGrids certificate to access non-grid resources such as DocDB and you have a Fermilab Kerberos account, the use of Fermilab KCA certificates is strongly recommended.

Any new certificates used must conform to the Fermilab security policy.

For questions or issues, contact the Fermilab Service Desk.

Important News and Dates

Frequently Asked Questions posted.

March 23, 2013: DOEGrids CA stopped issuing new certificates

Wednesday, March 27 & Wednesday, April 3: Certificate Doctor-is-in Booth
Wilson Hall atrium, 11:30 a.m. - 1:30 p.m. Members of the Computing Sector will be on hand to answer your certificate questions.