Participant Technical Reference Manual - IESO

2. Participant Workstation, Network & Security IMO_MAN_0024
Access is transparently handled via https through IESO portal servers as all certificate
management communication (except for creation and recovery) is proxied through the
IESO to Verizon / Cybertrust. The IESO administers all IP address configuration for the
Certification Authority systems used with the Portal. Therefore no changes are required
on the part of the Market Participant for portal PKI capability to handle the Verizon
Cybertrust data center move. Only the IESO needs to make the required changes on its
servers.
Portal Sandbox/ Production Environments for Replacement Verizon CA Servers –
Starting early March 2010
Cybertrust Production System CA Manager Domain - version 7.2
Domain name = ccica2.idm.cybertrust.com
Access is transparently handled via https through IESO portal servers as all certificate
management communication (except for creation and recovery) is proxied through the
IESO to Verizon / Cybertrust. The IESO administers all IP address configuration for the
Certification Authority systems used with the Portal. Therefore no changes are required
on the part of the Market Participant for portal PKI capability to handle the Verizon
Cybertrust data center move. Only the IESO needs to make the required changes on its
servers.
Ports
174 Port 443 must be open to allow access over SSL (Secure Socket Layer). Market
participants with firewalls must have this port open for communication with the IESO
systems and its Certification Authority.
175 Port 389 must be open to allow access to the IESO's Certification Authority's LDAP
Servers (Directory Server Domain) for the MPI. For the IESO Portal‟s TruePass
component all CA directory communications are routed through the IESO systems via
port 443 (https/SSL). LDAP Servers contain the following and more:
Certificate Revocation Lists (CRL‟s)
The CA's credentials
The policy certificates
The attribute certificates (if applicable)
User Certificates
Market participants with firewalls must have this port open for communication with the IESO
Certification Authority.
176 Port 829 must be open to allow access to the identified Certification Authority Manager
(CA Manager Domain) systems. Market participants with firewalls must have this port
open for the specific IP addresses/domains for communication with the IESO CA for
the Certificate Management Protocol. This provides for automatic or manual updating
of certificate files upon imminent expiry of certificate keys. Automatic certificate
updates will be processed by the MPI (Market Participant Graphical User Interface) or
MIM API and manual updates can be accomplished with the CLS. For the IESO
Portal‟s TruePass component all CA management communications are routed through
52 Public Issue 21.1 – March 15, 2010 - estimated