Using InCommon Client Certs for eduroam Jeff Hagley and Ryan Martin October 3 rd, 2011 Internet2 Fall Member Meeting.

Slides:

Advertisements

Similar presentations

1 APNIC Resource Certification Service Project Routing SIG 7 Sep 2005 APNIC20, Hanoi, Vietnam George Michaelson.

Advertisements

Chapter 14 – Authentication Applications

Authentication Applications. will consider authentication functions will consider authentication functions developed to support application-level authentication.

Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.

1 ISA 562 Information Systems Theory and Practice 10. Digital Certificates.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

Cross Platform Single Sign On using client certificates Emmanuel Ormancey, Alberto Pace Internet Services group CERN, Information Technology department.

Philippe Hanset ANYROAM LLC

Eduroam – Roam In a Day Louis Twomey, HEAnet Limited HEAnet Conference th November, 2006.

PKI Activities at Virginia January 2004 CSG Meeting Jim Jokl.

DESIGNING A PUBLIC KEY INFRASTRUCTURE

16.1 © 2004 Pearson Education, Inc. Exam Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure.

Certificates, Browsers & You: What is all this certificate crud? Frank J. Nagy God of Kerberos And Associates...

Understanding Active Directory

CMSC 414 Computer and Network Security Lecture 21 Jonathan Katz.

Intel Confidential 1 Configure PKI Web Server Certificates for each Management Controller.

Chapter 11: Active Directory Certificate Services

Implementing Native Mode and Internet Based Client Management.

CN1276 Server Kemtis Kunanuraksapong MSIS with Distinction MCTS, MCDST, MCP, A+

UNCLASS DoD Public Key Infrastructure LCDR Tom Winnenberg DISA API1 Chief Engineer 25 April 2002.

1 Technology Readiness Maryland /2015 Admin Schedule 2 AssessmentOnline/CBT Testing Dates PARCC - PBAMarch 2 – May 8 MSA ScienceApril 13.

CSE331: Introduction to Networks and Security Lecture 31 Fall 2002.

Maintaining and Updating Windows Server 2008

Fermilab VPN Service What is a VPN ?.

TLS/SSL Review. Transport Layer Security A 30-second history Secure Sockets Layer was developed by Netscape in 1994 as a protocol which permitted persistent.

PKI Network Authentication Dartmouth Applications Robert Brentrup Educause/Dartmouth PKI Summit July 27, 2005.

Senior Technical Writer

Configuring Active Directory Certificate Services Lesson 13.

Windows 2003 and 802.1x Secure Wireless Deployments.

Module 10: Designing an AD RMS Infrastructure in Windows Server 2008.

OpenVPN OpenVPN: an open source, cross platform client/server, PKI based VPN.

Securing Data at the Application Layer Planning Authenticity and Integrity of Transmitted Data Planning Encryption of Transmitted Data.

Deploying PKI Inside Microsoft The experience of Microsoft in deploying its own corporate PKI Published: December 2003.

UNAMgrid CA Juan Carlos Guel UNAM, México. Alejandro Núñez UNAM, México. Israel Becerril UNAM, México. DGSCA UNAM 31/08/06.

Microsoft Active Directory(AD) A presentation by Robert, Jasmine, Val and Scott IMT546 December 11, 2004.

Configuring and Troubleshooting Identity and Access Solutions with Windows Server® 2008 Active Directory®

Computer Security: Principles and Practice First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Chapter 22 – Internet Authentication.

Configuring Directory Certificate Services Lesson 13.

SECURITY MANAGEMENT Key Management in the case of public-key cryptosystems, we assumed that a sender of a message had the public key of the receiver at.

XMPP Concrete Implementation Updates: 1. Why XMPP 2 »XMPP protocol provides capabilities that allows realization of the NHIN Direct. Simple – Built on.

Module 9: Fundamentals of Securing Network Communication.

Introduction to Public Key Infrastructure January 2004 CSG Meeting Jim Jokl.

Maintaining Network Health. Active Directory Certificate Services Public Key Infrastructure (PKI) Provides assurance that you are communicating with the.

Module 9: Designing Public Key Infrastructure in Windows Server 2008.

Configuring and Troubleshooting Identity and Access Solutions with Windows Server® 2008 Active Directory®

1. 2 Overview In Exchange security is managed by assigning permissions in Active Directory Exchange objects are secured with DACL and ACEs Permissions.

Module 12 Upgrading from Exchange Server 2003 or Exchange Server 2007 to Exchange Server 2010.

Module 7 Planning and Deploying Messaging Compliance.

Who’s watching your network The Certificate Authority In a Public Key Infrastructure, the CA component is responsible for issuing certificates. A certificate.

How to Deploy and Get the Most Out of Tokens Paul Caskey PKI Deployment Forum 2008.

Unlimited SSL and personal certificates at one annual fixed fee.

PKI: News from the Front and views from the Back Ken Klingenstein, Project Director, Internet2 Middleware Initiative Chief Technologist, University of.

Grid Canada Certificate Authority Darcy Quesnel

Pkiuniversity.com. Alice Bob Honest Abe’s CA Simple PKI hierarchy.

1 APNIC Trial of Certification of IP Addresses and ASes RIPE October 2005 Geoff Huston.

NECTEC-GOC CA The 3 rd APGrid PMA face-to-face meeting. June, Suriya U-ruekolan National Electronics and Computer Technology Center, Thailand.

Microsoft Virtual Academy Preparing for the Windows 8.1 MCSA Module 5: Managing Devices & Resource Access.

Using InCommon Client Certs for eduroam Jeff Hagley and Ryan Martin October 3 rd, 2011 Internet2 Fall Member Meeting.

Site Authorization Service Local Resource Authorization Service (VOX Project) Vijay Sekhri Tanya Levshina Fermilab.

Apple Configurator 2 What’s new in 2.0.

Revocation in WebPKI Phill Hallam-Baker Comodo. Standards intersection PKIX OTHER.

X509 Web Authentication From the perspective of security or An Introduction to Certificates.

Prof. Reuven Aviv, Nov 2013 Public Key Infrastructure1 Prof. Reuven Aviv Tel Hai Academic College Department of Computer Science Public Key Infrastructure.

How to Setup and Utilize Functionality

Cryptography and Network Security

Roadmap Q217 APIs Provide APIs for Code Signing on Demand service.

Update on EDG Security (VOMS)

Public-Key Certificates

APNIC Trial of Certification of IP Addresses and ASes

Presentation transcript:

Using InCommon Client Certs for eduroam Jeff Hagley and Ryan Martin October 3 rd, 2011 Internet2 Fall Member Meeting

Why we Chose to use InCommon Certs Provide implementation details and lessons learned for the R&E community Cost Infrastructure Future Plans

RADIUS Setup FreeRADIUS CRL Checking BASH script to update this Common CA Cert Chain across InCommon All InCommon Members have same signing Intermediate Cert Only allowing Internet2 authentication Proxy controls this Cert Fragmentation Size

Cert Deployment Hierarchy

Client Setup Used “+” sign in address to issue multiple certs Comodo added this after a bug report from us Using “+” sign to get one user in more than one department A hack we are hoping goes away in the future Keeps client from automatically using the cert for signing and encryption

OSs deployed on iOS doesn’t work, previous versions do Mac OS 10.6 and 10.7 works Windows 7 works (limited experience, we are Mac people)

Documentation and Policies Master Key Escrow Policy Certificate Revocation Policy FreeRADIUS setup information Installation on Clients Ryan for copies of any of them to use as a template

Issues iOS issue We would love to have others test this and report it to Apple Bug ID OSCP and FreeRADIUS vulnerability CVE Users can only be assigned to one department (Comodo is aware of this issue)

Future Plans OSCP implementation, after vulnerability is fixed

Contact Info Jeff Hagley – Ryan Martin –