The JANET Certificate Service

Transcription

1 The JANET Certificate Service Damien Shaw JANET Technical Administration Group 1

2 JANET SCS Server Certificate Service January 2006 TERENA sign contract Under a GlobalSign Root Certificate JANET SCS began in December 2006 ~440 user organisations Processed 11,387 requests Issued 9,066 certificates 2

3 Pros JANET SCS Cheap Very good presence in browsers No per-certificate fee Solved the pop-up problem Cons Server Availability SPF issues Windows 2008 SANs 3

4 JANET SCS Lengthy signup process Manual process for requesters Sign by hand and fax / back Manual process for JANET(UK) Causes some delay during busy periods Required strict input into forms Doesn t Scale 4

5 TERENA Certificate Service TERENA procurement Committee of SCS staff from NRENS Cesnet Milan Sova Cru Dominique Launay JANET(UK) Damien Shaw Red Iris Daniel García Uni-C Kurt Bøge Uninett Jan Meijer TERENA Karel Vietsch, Licia Florio & Kevin Meynell September 2008 March

6 Procurement 11 Proposals received 5 Invited for interview Contract awarded to Comodo CA Ltd No longer just a Server Certificate Service! & Client Certificates? Code Signing Certificates? EV Certificates? 6

7 JANET Certificate Service Launched on 18 th November 2009 Simple Sign up process Online system for requests No signatures required Automated approval of requests Users can view, retrieve and revoke certificates through their user account Certificates issued within minutes! 7

8 Certificate Chain AddTrust External CA Root UTN- UserFirst- Hardware TERENA SSL CA End Entity SSL 8

9 JANET Certificate Service Root presence across most browsers (99.3% browser compatibility) and platforms including the iphone and Wii! Supports multiple (maximum of 100) domain names (SANs) with a single certificate Wildcard certificates not supported (JANET(UK) policy decision) 9

10 How it works Organisation completes an Authorised Representative Form This confirms acceptance of Terms and Conditions and provides us with a list of authorised users JANET(UK) enable the organisation for service and create user accounts JANET(UK) issues users with login credentials 10

11 CPS is King! TERENA Certificate Service Certificate Practice Statement Outlines the legal, commercial and technical principles and practices employed in providing certificate services. Defines the underlying certification processes for subscribers and describes TCS repository operations. 11

12 CPS is King! TERENA Certificate Service Certificate Practice Statement JANET Certificate Service Terms and Conditions: 5.1 Organisations are required to comply with the TERENA Certificate Service Certificate Practice Statement. 12

13 CPS is King! TERENA Certificate Service Certificate Practice Statement CPS: 4.12 TCS Certificates are not for financial transactions 4.30 Subscriber Obligations 4.31 Representations by Subscriber upon Acceptance 13

14 Live Demo 14

15 What happens next End User Installs Issued Certificate End User Installs Intermediate Certificate End User Tests installation of certificate openssl s_client -connect myserver.example.com:443 -showcerts 15

16 Stats so far... Organisations signed up: 50 Certificates Issued: 97 3 Year: 86 2 Year: 1 1 Year: 10 16

17 Future Developments Additional features: User can see who requested a certificate User can list certificates by expiry date Username and password sent automatically User can paste the CSR into the request page Certificate to be ed to an address chosen by the user.zip renamed to something more useful Revocation features Expiry notifications 17

18 Future Developments Feature requests Based on your feedback Other certificate types and Client Certificates Code Signing Certificates Extended Validation Certificates 18

19 Advantages Much Simpler Process A single consistent interface - federated Faster certificate issuance times Requester validated by login credentials CSRs validated against info held by JANET(UK) Fewer rejected requests Ability to view certificates all in one place Revoke certificates via the interface Greater control over expiry notifications Overall flexibility 19

20 Useful Links: JANET (UK) TERENA COMODO 20

21 Questions? 21