The JANET Certificate Service - London South Bank University · 2009-12-11 · JANET Certificate...

SERJUG 25th November 2009Copyright JNT Association 2009 1

The JANET Certificate Service

Damien Shaw

JANET Technical Administration Group


JANET SCS

• Server Certificate Service

• January 2006 TERENA sign contract

• Under a GlobalSign Root Certificate

• JANET SCS began in December 2006

– ~440 user organisations

– Processed 11,387 requests

– Issued 9,066 certificates


JANET SCS

Pros

Cheap

Very good presence in browsers

No per-certificate fee

Solved the pop-up problem

Cons

Server Availability

SPF issues

Windows 2008

SANs


JANET SCS

• Lengthy signup process

• Manual process for requesters

– Sign by hand and fax / email back

• Manual process for JANET(UK)

– Causes some delay during busy periods

• Required strict input into forms

• Doesn’t Scale


TERENA Certificate Service

• TERENA procurement

• Committee of SCS staff from NRENS

Cesnet – Milan Sova

Cru – Dominique Launay

JANET(UK) – Damien Shaw

Red Iris – Daniel García

Uni-C Kurt Bøge

Uninett – Jan Meijer

TERENA –Karel Vietsch, Licia Florio & Kevin Meynell

• September 2008 – March 2009


Procurement

• 11 Proposals received

• 5 Invited for interview

• Contract awarded to Comodo CA Ltd

• No longer just a Server Certificate

Service!

• Email & Client Certificates?

• Code Signing Certificates?

• EV Certificates?


JANET Certificate Service

• Launched on 18th November 2009

• Simple Sign up process

• Online system for requests

• No signatures required

• Automated approval of requests

• Users can view, retrieve and revoke

certificates through their user account

• Certificates issued within minutes!


Certificate ChainAddTrust

External CA

Root

UTN-

UserFirst-

Hardware

TERENA

SSL CA

End Entity

SSL


JANET Certificate Service

• Root presence across most browsers

(99.3% browser compatibility) and

platforms – including the iPhone and

Wii!

• Supports multiple (maximum of 100)

domain names (SANs) with a single

certificate

• Wildcard certificates not supported

(JANET(UK) policy decision)


How it works

• Organisation completes an Authorised

Representative Form

• This confirms acceptance of Terms and

Conditions and provides us with a list

of authorised users

• JANET(UK) enable the organisation for

service and create user accounts

• JANET(UK) issues users with login

credentials

http://www.ja.net/documents/services/jcs/authorised-representative-form.pdf



http://www.ja.net/documents/services/jcs/terms-and-conditions-certificate-service.pdf

http://www.ja.net/documents/services/jcs/terms-and-conditions-certificate-service.pdf


CPS is King!

• TERENA Certificate Service Certificate

Practice Statement

• Outlines the legal, commercial and

technical principles and practices

employed in providing certificate

services.

• Defines the underlying certification

processes for subscribers and

describes TCS repository operations.

https://www.terena.org/activities/tcs/repository/TCS_CPS-1.2.pdf



CPS is King!


Practice StatementJANET Certificate Service Terms and Conditions:

5.1 – Organisations are required to

comply with the TERENA Certificate

Service Certificate Practice Statement.




CPS is King!


Practice Statement

CPS:

4.12 – TCS Certificates are not for

financial transactions

4.30 – Subscriber Obligations

4.31 – Representations by Subscriber

upon Acceptance




Live Demo

https://certificates.ja.net/jcs/

https://certificates.ja.net/jcs/


What happens next…

• End User Installs Issued Certificate

• End User Installs Intermediate

Certificate

• End User Tests installation of

certificate

openssl s_client -connect myserver.example.com:443 -showcerts


Stats so far...

• Organisations signed up: 50

• Certificates Issued: 97

– 3 Year: 86

– 2 Year: 1

– 1 Year: 10


Future Developments

• Additional features:

– User can see who requested a certificate

– User can list certificates by expiry date

– Username and password sent automatically

– User can paste the CSR into the request page

– Certificate to be emailed to an address chosen by

the user

– .zip renamed to something more useful

– Revocation features

– Expiry notifications


Future Developments

• Feature requests

– Based on your feedback

• Other certificate types

– Email and Client Certificates

– Code Signing Certificates

– Extended Validation Certificates


Advantages

• Much Simpler Process

• A single consistent interface - ‘federated’

• Faster certificate issuance times– Requester validated by login credentials

– CSRs validated against info held by JANET(UK)

• Fewer rejected requests

• Ability to view certificates all in one place

• Revoke certificates via the interface

• Greater control over expiry notifications

• Overall flexibility


Useful Links:

JANET (UK)

• http://www.ja.net/services/jcs/

• https://certificates.ja.net/

TERENA

• https://www.terena.org/activities/tcs/

• https://www.terena.org/activities/tcs/repository/

COMODO

• https://support.comodo.com/

http://www.ja.net/services/jcs/

https://certificates.ja.net/

https://www.terena.org/activities/tcs/

https://www.terena.org/activities/tcs/repository/

https://support.comodo.com/


Questions?

[email protected]

The JANET Certificate Service - London South Bank University · 2009-12-11 · JANET Certificate...

Documents

Transcript of The JANET Certificate Service - London South Bank University · 2009-12-11 · JANET Certificate...