The InCommon Certificate Service

Transcription

1 The InCommon Certificate Service January 2011 Joint Techs Randall Frank Internet2

2 The Basic Program Internet2 through its InCommon Trust Services division now offer unlimited SSL certs (including EVcerts, SAN and wildcard) and personal (and code) signing and encryption certs for a fixed annual fee Program (at the moment) limited to US higher ed institutions and US based R&E network orgs (for their internal use only, not their members) Fee is based on institutional Carnegie classification with a 25% discount for Internet2 members (range $20K to $2K, $15K to $1.5K for Internet2 members) Optional (for an add l fee) add-on for a hosted private campus Certificate Authority (private labeled CA) 3 year initial campus commitment required SSL certs will have (up to) a 3 year expiration Signing certs will have (up to) a 5 year expiration

3 Why did we do this? Financial (and security) win for many campuses in terms of SSL certs Innovative win for community in terms of personal certs Previous attempts at community PKI Signed and encrypted Second factor authentication Ubiquitous deployment of personal certs at a fixed annual cost

4 For answers to questions in more detail (including full pricing chart)

5 Who qualifies to participate? Any United States based (primary campus in US) higher ed institution qualifying for a.edu domain or US based R&E network organization (for their own internal use; does not allow re-sale or re-distribution to their members) Participation on a campus or campus system basis with significant add l discount for system participation Must join InCommon if not a member already Utilizes existing InCommon RA services Linkage to InCommon Level of Assurance programs (e.g., bronze, silver) Encourages InCommon membership Legally structured as an addendum to the InCommon participation agreement/relies of T&Cs in Participation Agreement

6 Potential Program Extensions Extension to K-12 institutions currently under investigation Ability to quote extension of program to federal research organizations

7 Comodo as the CA Partner We have a 3 year (renewable) agreement with Comodo as the CA partner Comodo is a leading commercial certificate authority with broad cert recognition InCommon will act as the Registration Authority, with campuses having direct access to the Comodo CA for certificate issuance via either a GUI (the Comodo Certificate Manager/CSM) or API 7

8 Schedule for Availability SSL certs (including SAN and wildcard) and CSM GUI available at launch (August 2010) Private CA available January 2011 API available January 2011 EV certs available February 2011 Signing certs still have some technical issues to resolve (expected March 2011) Initially issued at basic LoA equivalent to current InCommon federated authentication Architecture designed to allow for cert issuance conforming to higher LoAs (bronze, silver, gold) as campuses stand up certified higher LoA identity management environments

9 Types of certs and domains Wild card certs are available at campus option (less demand since no cost savings) Campus domain and sub-domains Other domains that campus administers Campus orgs that use their own domain name Prof societies that are managed by a campus Must be able to prove that campus is manager of record for domain Even.com if campus can prove ownership of domain

10 Interfaces to Comodo An extensive GUI: Comodo Services Manager (CSM) (see FAQ for Manual) Highly configurable to campus policies Types of certs (e.g., wildcard) and domain control Centralized or distributed distribution Excellent reporting and monitoring services Full service API for campuses that want to integrate into existing cert distribution system

11 Comodo browers/device coverage Extended Validation Browsers: Microsoft Internet Explorer 7 +, Opera 9.5+, Firefox 3+, Apple Safari 3.2+, Google Chrome 1+ Web Browsers: Microsoft Internet Explorer , Mozilla Firefox 1.0+, Opera 8.0+, Apple Safari 1.2 +, Google Chrome AOL 5 +, Netscape Communicator Camino 1.0+, Konqueror (KDE) Mozilla Clients (S/MIME): Microsoft Outlook 99+, Microsoft Entourage (OS/X), Mozilla Thunderbird 1.0+ Microsoft Outlook Express 5+, Qualcomm Eudora 6.2+, Lotus Notes (6+) Mail.app (Mac OS X), Microsoft / Windows Mail 1.0+ (Vista), The Bat 1+ Micro Browsers /PDAs Apple iphone, ipod Safari 1.0+, Microsoft Windows Mobile 5* / 6 +, ACCESS NetFront Browser v3.4 +, RIM Blackberry v , KDDI Openwave v , Opera Mini v3+, Opera Mobile 6+, Sony Playstation Portable Sony Playstation 3, Netscape Communicator 4.77+, Nintendo Wii NTT / DoCoMo Application Suites: Microsoft Authenticode Visual Basic for Applications (VBA), Adobe AIR Sun Java SE Mozilla Suite 1.0+, Sea Monkey Document Security Platforms: Microsoft Office (Word, Excel,Powerpoint, Access, InfoPath) Server Platforms All SSL-Capable Server Platforms

12 For answers to questions in more detail (including full pricing chart)