RADIUS/TLS: Obtaining and managing certificates
RADIUS over TLS is a new way of interconnecting federations (and later, if desired, eduroam IdPs and eduroam SPs). It uses TLS encryption instead of IP address and shared secret pairs to authenticate and authorise eduroam servers. When replacing such explicit configuration-based authorisation with a dynamic, automatic provisioning model, it is important to clearly define the rules for issuance of an eduroam server certificate, because the possession of the certificate will enable the holder to participate in eduroam.
In order to make use of this new feature, your FLR server must have acquired an eduroam server certificate. Depending on which federation or world region you are from, the procedures for getting a certificate will differ. The following subsection is a globally valid description of the eduroam Trust Model; the subsection after that defines rules per world region, as far as they are known at the time of writing, and the last subsections deals with the actual provisioning of certificates in Europe.
The eduroam server certificate trust model: eduPKI PMA and the eduroam Trust Profile
During the design of the X.509 trust model for eduroam, certain requirements had to be considered.
- It became clear that no single one Certificate Authority (CA) can or should issue all eduroam certificates world-wide. Instead, rules were defined under which multiple CAs can issue eduroam certificates.
- These CAs could possibly be general-purpose CAs that also manage certificates for other services besides eduroam. Consequently, the eduroam trust model had to allow to differentiate eduroam server certificates from other certificates from the same CA in a standardised manner.
- A CA would need to conform to certain quality assurance criteria, which need to be assessed by an oversight committee.
As a result of these requirements, the GEANT project's eduPKI task created a framework for the eduroam trust model:
- an oversight body, the "eduPKI Policy Management Authority" (eduPKI-PMA) was created and produced a document with defined Quality Assurance criteria for CAs which would like to become part of the eduroam trust model. It is open for applicant CAs world-wide. The rules are set forth in section "CA Accrediation Process" at https://www.edupki.org/edupki-pma/pma-governing-documents/
- a X.509 trust profile for the eduroam service was created, which designates two so-called "policy OID" fields to eduroam IdP and SP servers. The trust profile can be found on this page: https://www.edupki.org/edupki-pma/edupki-trust-profiles/
- this trust profile requires that CAs which use this policy OID will check the authorisation of a certificate applicant whether or not he is actually an eduroam IdP and/or SP server operator.
This way, it can be assured that only authorised eduroam operators get eduroam certificates and can establish connections to other eduroam servers.
eduroam Certificates in the world regions
Europe
There is currently one accredited Certification Authority: the eduPKI CA, located at https://www.edupki.org/edupki-ca/ . Further CAs are welcome to apply for eduPKI PMA accreditation.
eduroam operators should request their certificate as defined in the following subsection.
Americas
No information.
Asia-Pacific
No information.
Africa
No information.