Participant Technical Reference Manual - IESO

Participant Technical Reference Manual
2. Participant Workstation, Network & Security
information). Figure 2-19 illustrates the conceptual architecture for the PKI / digital
certificate solution.
127 For Internet Explorer browser users, during the SSL handshake, and after the user has
manually or automatically presented an IESO issued and valid browser based
certificate, the MOSMIM Web Server identifies itself and requests that certain access
permissions are granted by the user to enable downloading of the MIM MPI Applet
and the running of that software. This means that the MOSWEB server requires that
the user present his or her certificate previously imported into the Internet Explorer
browser certificate database. The server will verify that the client certificate within
Internet Explorer is a valid certificate issued by the IESO‟s Certification Authority
through comparison with the CA certificate installed on the IESO‟s web server. In fact
this happens to a large extent automatically and the user can only present IESO issued
client certificates to the MOSWEB server. The client certificate information within the
Internet Explorer browser presented for logon must also correspond in version,
validity dates, and content with the EPF file to be used in the next step or logon will
not be permitted.
128 After establishment of an SSL session, the MIM MPI Applet is downloaded to user‟s
workstation and the market participant user is taken to a main Web site where he/she
is required to enter the name and path of an EPF file and the Passphrase (a string of
words and characters that one types in to authenticate) for the EPF. The user at EPF
creation with the IESO CLS application chose this passphrase. This gives the
individual, rights to the necessary areas of the Web site. The process works like this;
an End Entity at the market participant presents their digital certificate (encapsulated
in an EPF) to the Certification Authority system via the MPI applet. The MPI applet
completes some checks. A critical check is the validity check of the client‟s IESO
digital certificate. To perform this check the MPI applet PKI code downloaded from
the MOSMIM Web Server checks a current CRL (Certificate Revocation List) that
resides on a X.500 directory at the Certification Authority under normal online mode
operation. If the digital certificate passes the checks, a USERID value is parsed from
the certificate and is used to allow access to predefined web sites. If the user‟s
certificates require updating due to reaching the rollover point of the encryption or
signing keys the EPF and P12 files shall be updated by the MPI applet PKI code and
the keys and certificates will be renewed automatically upon login.
129 The IESO may choose to operate the MPI in certificate offline mode if the need arises
due to service outages at the Certificate Authority. The probability of this occurring is
likely to be minimal and of short duration. The IESO maintains total control over the
mode of operation, online or offline. Under such circumstance the Market Participant
users will still be able to login to the Market systems and conduct business. No
configuration changes are required on the part of Market Participants for the mode of
MPI operation and it will be completely transparent. Under such circumstances the
IESO issued certificates will not undergo CRL checks during login but will go through
all other backend security checks as they do now. This does not impact the technical
requirements for normal communications to the CA systems.
130 The layout of the USERID is the REGISTRATION User Login Name, concatenated
with an @ symbol, and finished with the REGISTRATION market participant
Constant Shortname. See the Technical Interfaces Page of IESO‟s Web site for details
on how the REGISTRATION User Login Name and REGISTRATION market
participant Constant Shortname are created. Below is an example of the syntax of the
UserID:
Issue 21.1 – March 15, 2010 - estimated Public 43