...
Future Certificate Services
| Title | certbot for all certificate management |
|---|---|
| Description | Let's Encrypt and the certbot have made certificate management for 1 particular CA very easy and effective. With the addition of ACME v2 this will allow additional CAs to participate and allow the dev/test/production environments to automatically deal with certificates. Work should also investigate eduPKI and Let'sRADSEC use of this mechanism for certificate maintenance. TechEx 2016 ACAMP notes: https://docs.google.com/document/d/1o20NmuLjmNySp10QqfueO3of6jmoeTRfmgG4e_olZ_s/edit |
| Proposer | Brook (and a cast of thousands) |
| Resource requirements | People, Money, work to get standardisation of "realm validated certificates via RADIUS infrastructure" and maybe other paths. |
| +1's | Georgi Tsochev, BREN Rhys Smith, UKf: Certbot is going to take over the world, so we should start doing stuff with it. Reimer Karlsen-Masur, DFN-PKI |
| Title | cryptech.is |
|---|---|
| Description | |
| Proposer | |
| Resource requirements | |
| +1's |
| Title | CA CAB/Browser forum participation |
|---|---|
| Description | |
| Proposer | |
| Resource requirements | |
| +1's |
Attribute Authorities
| Title | Discovery for Attribute Authorities (AAs) |
|---|---|
| Description | Users can select their IdP via discovery, therefore the SP can potentially receive users from thousands of IdPs. There is no such facility for AA-s however, meaning that SP-s need to hard-configure which AAs they query. Also, query all the configured AAs for all users all the time. In GN4-1-JRA3-T1 it has been established that this is a serious bottleneck, as maximum 2-3 AAs can be queried without breaking the entire login session. A better approach is needed. The SPs need to query AAs selectively, based on either user input or some alternative means, like some VO lookup service. Otherwise all SPs will just stick with the biggest AAs like eduTEAMS basic membership service or hexaa.eduid.hu and not query alternative entities, making single-tenant AAs very unattractive. |
| Proposer | Mihály Héder |
| Resource requirements | This is a hard one. Currently there is no support for any elements of this whatsoever
|
| +1's | Constantin Sclifos, RENAM |
| -1's | Wolfgang Pempe, DFN: Such a dynamic approach would raise issues concerning trust and privacy. An attribute authority must be in control of the list of SPs that are entitled to perform attribute queries and (possibly) recieve PII. |
...