The Incommon Federation wiki has moved.

Please visit the new InCommon Federation Library wiki for updated content. Remember to update your bookmarks.

Click in the link above if you are not automatically redirected in 15 seconds.



You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

Introduction

InCommon accepts X.509 server certificates from the following certificate providers:

  1. Self-Signed
  2. InCommon CA

  3. Any third-party CA [Scott had some things to say about why using commercial certs should be highly discouraged.]

InCommon accepts this broad array of certificates b/c... (grey lightbulb) (fill in)

Requirements

InCommon sets the following security and trust parameters around certificates that are included in federation metadata.

  1. Minimum key size of 2048 bit
  2. No expired certs accepted (although expired certs may be retained in the metadata at the discretion of the IdP/SP).
  3. CN= equivalent to SP or IdP shib domain?
  4. Critical extensions?
  5. CA bit must be off?
  6. Encryption and signing allowed?

Policy

  1. Domains in cert will be approved by InCommon?? If the TAC as a group thinks, no, john will then take it to Steering and legal to discuss the liability implications of publishing domains that have not been approved.
#trackbackRdf ($trackbackUtils.getContentIdentifier($page) $page.title $trackbackUtils.getPingUrl($page))
  • No labels