Client Certificate Deployment Roadmap

 This is still very much an incomplete work in progress.

Introduction

The ability to mint digital certificates for your users is really just one small component of the overall work involved in a successful campus-wide PKI deployment.  Many campus PKI projects have been less than successful by not focusing enough on the whole product and the usability of the applications they support with certificates.  If deployed properly, digital certificates can build a more secure environment while also being more convenient for users than traditional password-based systems.  Some examples of campus-based certificate-enabled applications, listed below in a reasonable campus deployment order, include:

• VPN Authentication
  Like web authentication, once a user has a certificate installed on their workstation, it can typically be leveraged easily by most IPsec and SSL VPN systems.  The use of certificates for VPN authentication eliminates the need for users to type their password and often removes the need to maintain an additional password database.  Simply clicking on the connect button provides a secure VPN path.
• Wireless Authentication
  The use of certificates and EAP-TLS and certificates for authentication to the campus wireless networks improves security and is a significant ease of use enhancement for end users.  From a user's perspective, when their device is within range of a campus Access Point, it securely connects in the background.  No captive portal, entering passwords, or other such inconvenient mechanisms.  Certificate-based wireless authentication also removes significant risk from rogue access points being used to capture user passwords.  Migrating to EAP-TLS for wireless authentication also prepares a campus for simple configuration into eduRoam.  You may also wish to pursue the use of certificates to authenticate users to the campus wired network.
• Web Authentication
  Most web servers and browsers make certificate-based authentication easy to implement and use.  A typical campus implementation might prefer the use of certificates over passwords for authentication to the central campus Web SSO system.  Application owners should always consider if part of their user community (e.g., guests) may not have certificates.  The use of certificates eliminates the risk associated with phishing attacks. 
• Signed Electronic Mail
  A campus certificate infrastructure makes it possible to promote S/MIME-based digital signing of electronic mail messages.  Many modern email clients support signed email messages as do some webmail applications (e.g., Outlook Web Access and Stalker).  Highlight: official announcements, mailing list issues, client interoperability, webmail, client configuration, etc.
• Digital Signatures
  Signing other documents, such as in the Microsoft Office Suite and Adobe products
• Encrypted Electronic Mail
  Focus on where it is good and where the danger lurks.  Discuss key usage options.
• Globus and Grid Computing
  These Comodo certificates are designed to work well with Globus but are not issued at an IGTF level of assurance that meets the needs of grids such as Teragid and Open Science Grid.

All certificate-based applications depend on the user's certificates and their associated private keys being pre-installed in appropriate location(s) such that they are accessible to applications as needed but still under the control of the user. Some PKI-enabled applications require setup on the user's workstation and others, such as VPN clients, often require workstation firewall tuning for successful operation. The level of user acceptance, and thus the success of the overall project, often depends on how easy it is for users to have their certificates installed in all of the needed locations, have their workstation applications preconfigured for certificate use, and how well users are warned when expiring certificates need to be replaced.

The Simple Certificate Enrollment Protocol (SCEP) is an X.509 certificate enrollment protocol that simplifies the distribution of certificates. Some VPN servers (Cisco, Juniper, etc.) support SCEP natively.

Service Considerations

The first consideration for making certificate-enabled services function transparently for users is a friendly mechanism to have their certificate and private key installed in all of the needed location(s) on their workstation. This mechanism would typically be done with the certificates installed in a non-exportable way. Basic workstation security settings such as a password protected screen savers can also be verified as part of the installation process. Certificate store requirements for the common applications listed above are summarized in the table below:

Also important to the success of a campus PKI deployment are tools that effectively warn the user when their certificate is about to expire.  This is best done directly on the workstation with the expiring certificate as opposed to some email-based mechanism that requires a user to keep track of which certificate is installed on a particular system.

InCommon PKI Subcommittee Standard Assurance Certificate Project Roadmap

1. Certificate Availibility
   Work within InCommon and with Comodo to make certificates available.  This process involves (a) depeloping the appropriate CPS and having it approved by InCommon and Comodo, (b)  creating a certificate profile that works well with known campus PKI-enabled applications, and (c) working with Comodo to make these certificates available via their web site.
2. Document typical campus PKI-enabled applications and services including information on how these applications are typically enabled, configurations, and a summary of items to consider before deploying the application.
3. Provide information and guidance on the use of certificates on mobile devices.
4. Evaluate the suitability of the Comodo API (as opposed to web interface) for the rapid issuance of certificates to large numbers of users.  Recommend changes if/as needed.
5. Evaluate tools that automate the installation of certificates on user workstations and manage the setup of certificate enabled applications (e.g., wireless profiles, firewall for VPN, etc).  These tools should also facilitate certificate management and renewal.
6. Work with Comodo to facilitate the creation of a Shibboleth-based interface for the issuance of end user certificates.
    

Parking Lot, for now?

Mobility, higher assurance certificates, 2-factor authentication, SSH, preferred certification ldap publication,