Speaker
Description
Grid digital certificates form the foundation of identity in distributed high-energy physics computing. Chinese users of the LHC experiments (ATLAS, CMS, LHCb), as well as grid computing for JUNO and Belle II, rely on certificates issued by the IHEP Grid Certification Authority (IHEP CA), a regional CA within the IGTF trust framework.
The legacy IHEP CA, built on OpenCA, has been in service for many years. Its 1024-bit root key, offline issuance procedure, and manual CRL publishing no longer meet modern requirements for security strength and automation.
A new CA has therefore been built at the IHEP Computing Center based on OpenXPKI, providing workflow-driven certificate lifecycle management: users request certificates online via the WebUI with IHEP single sign-on, requests are reviewed and approved online by the RA, and certificates are issued automatically with server-side RSA 4096 key generation. Host certificates support automated renewal via EST; CRLs are generated and published automatically, with e-mail notifications throughout the lifecycle. The new CA has been submitted for IGTF/APGridPMA accreditation; legacy certificates can be migrated through an online entry, and the old system will be decommissioned at the end of 2026.
The upgraded CA significantly strengthens the security and automation of the grid trust infrastructure for Chinese HEP computing, and lays the PKI foundation for future experiments such as CEPC.
