Motivation for change: several Grid Services are being moved onto OpenShift and require Grid Certificates for integration with the Infrastructure. The current CP/CPS only supports issuing certificates to machines and services, and has a tight dependency on CERN’s network database (LANDB). These changes are to allow us to issue certificates to resources such as application.web.cern.ch in a trustworthy manner.
Summary of changes:
- Specifying that the CERN Grid CA issues Resource Certificates to CERN Resources, defined as: “CERN resources: computers, containers and services registered in CERN’s central resource databases.” This is to allow us to issue certificates to web services such as wlcg-iam.web.cern.ch that run on centrally managed web infrastructure
- Replacing references to CERN’s Network Database (LANDB) with CERN’s Resource Databases (there are several)
- Replacing him/his/he with them/their/they
- Updating CA contacts