...
The ability to mint digital certificates for your users is really just one small component of the overall work involved in a successful campus-wide PKI deployment. Many campus PKI projects have been less than successful by not focusing enough on the whole product and the usability of the applications they support with certificates. If deployed properly, digital certificates can build a more secure environment while also being more convenient for users than traditional password-based systems. Some examples of campus-based certificate-enabled applications include:
- Web Authentication
Most web servers and browsers make certificate-based authentication easy to implement and use. A typical campus implementation might prefer the use of certificates over passwords for authentication to the central campus Web SSO system. Application owners should always consider if part of their user community (e.g., guests) may not have certificates. The use of certificates eliminates the risk associated with phishing attacks. - VPN Authentication
Like web authentication, once a user has a certificate installed on their workstation, it can typically be leveraged easily by most IPsec and SSL VPN systems. The use of certificates for VPN authentication eliminates the need for users to type their password and often removes the need to maintain an additional password database. Simply clicking on the connect button provides a secure VPN path. - Wireless Authentication
The use of certificates and EAP-TLS and certificates for authentication to the campus wireless networks improves security and is a significant ease of use enhancement for end users. From a user's perspective, when their device is within range of a campus Access Point, it securely connects in the background. No captive portal, entering passwords, or other such inconvenient mechanisms. Certificate-based wireless authentication also removes significant risk from rogue access points being used to capture user passwords. Migrating to EAP-TLS for wireless authentication also prepares a campus for simple configuration into eduRoam. You may also wish to pursue the use of certificates to authenticate users to the campus wired network. - Web Authentication
Most web servers and browsers make certificate-based authentication easy to implement and use. A typical campus implementation might prefer the use of certificates over passwords for authentication to the central campus Web SSO system. Application owners should always consider if part of their user community (e.g., guests) may not have certificates. The use of certificates eliminates the risk associated with phishing attacks. - Signed Electronic Mail
A campus certificate infrastructure makes it possible to promote S/MIME-based digital signing of electronic mail messages. Many modern email clients support signed email messages as do some webmail applications (e.g., Outlook Web Access and Stalker). Highlight: official announcements, mailing list issues, client interoperability, webmail, client configuration, etc. - Digital Signatures
Signing other documents, such as in the Microsoft Office Suite and Adobe products - Encrypted Electronic Mail
Focus on where it is good and where the danger lurks. Discuss key usage options. - Globus and Grid Computing
These Comodo certificates are designed to work well with Globus but are not issued at an IGTF level of assurance that meets the needs of grids such as Teragid and Open Science Grid.
...