This document is a is a work in progress, intended to evolve over time. Experience and suggestions from the community are welcomed and desired.
See also also the following documents attached to this page:
- InCommon survey on Campus Use of 2-Factor Authentication
- InCommon Personal Certificate Provisioning and Application Setup Tool
...
Please direct comments/feedback to Steve Olshansky <steveo AT internet2.edu>
...
- Certificate Availibility
Work within InCommon and with Comodo to make certificates available. This process involves (a) depeloping the appropriate CPS and having it approved by InCommon and Comodo, (b) creating a certificate profile that works well with known campus PKI-enabled applications, and (c) working with Comodo to make these certificates available via their web site. - Certificate Enabled Applications
Document typical campus PKI-enabled applications and services including information on how on how these applications are typically enabled, configurations, and a summary of items to consider before deploying the application. This work will also highlight the issues associated with encryption and especially encrypted email. - Mobile Devices (e.g., iPhone and Android)
Provide information and guidance on the use of certificates on mobile devices such as iPhones and Android devices. This includes advice on how to enable security profiles that enforce device PINs to protect the certificate and its use. Mobile devices are lost more frequently than workstations and laptops. - Comodo Client Certificates API
Evaluate the suitability of the Comodo API (as opposed to web interface) for the rapid issuance of certificates to large numbers of users. Recommend changes if/as needed. - Certificate Installation Automation
Evaluate tools that automate the installation of certificates on user workstations and manage the setup of certificate enabled applications (e.g., wireless profiles, firewall for VPN, etc). These tools should also facilitate certificate management and renewal. - SCEP
A useful tool might be the Simple Certificate Enrollment Protocol (SCEP), an X.509 certificate enrollment protocol that simplifies the distribution of certificates. Determine what it can be used for. - Shibboleth-enabled Access
Work with Comodo to facilitate the creation of a Shibboleth-based interface for the issuance of end user certificates.
Some References
| Attachments |
|---|