SSL/TLS and certificate generation/handling in debian-edu (bug 571)

["Herman Robak" <herman@skolelinux.no>]

In the next developer gathering in Oslo, I will focus on finding
good solutions to sertificate generation and handling in Debian-edu
installations.

Problems: Automatic generation of local certificates, and distributing
	the "root" certificate to the clients automatically during
	installation.

Pregenerated certificates are a big no-no.  The private key has to
be unique, with restricted access, on each installation.

Manual signing is too cumbersome.  Getting the server certificate
signed by Thawte or Verisign is expensive.  It is also overkill,
unless the SSL server is to be accessible over the Internet.

I would like to discuss secure, yet convenient ways to automate
the process of generating a "local CA", and distributing the
"root" certificate of that local CA to the clients.

--
Herman Robak