RADIUS over TLS is a new way of interconnecting federations (and later, if desired, eduroam IdPs and eduroam SPs). It uses TLS encryption instead of IP address and shared secret pairs to authenticate and authorise eduroam servers. When replacing such explicit configuration-based authorisation with a dynamic, automatic provisioning model, it is important to clearly define the rules for issuance of an eduroam server certificate, because the possession of the certificate will enable the holder to participate in eduroam.
In order to make use of this new feature, your FLR server must have acquired an eduroam server certificate. Depending on which federation or world region you are from, the procedures for getting a certificate will differ. The following subsection is a globally valid description of the eduroam Trust Model; the subsection after that defines rules per world region, as far as they are known at the time of writing, and the last subsections deals with the actual provisioning of certificates in Europe.
During the design of the X.509 trust model for eduroam, certain requirements had to be considered.
As a result of these requirements, the GEANT project's eduPKI task created a framework for the eduroam trust model:
This way, it can be assured that only authorised eduroam operators get eduroam certificates and can establish connections to other eduroam servers.
There is currently one accredited Certification Authority: the eduPKI CA, located at https://www.edupki.org/edupki-ca/ . Further CAs are welcome to apply for eduPKI PMA accreditation.
eduroam operators should request their certificate as defined in the following subsection.
No information.
No information.
No information.