Tweaking the Certificate Lifecycle for the UK eScience CA
John M. Kewley, David Meredith, Jens Jensen · 2012
Obtaining and maintaining an X.509 certificate can be a significant barrier to non-technical users.Simple operations like renewing after expiry or changing an email address in a certificate are complicated, requiring additional meetings with RA Operators.The UK eScience CA is therefore modernising its software and policies to lower this barrier and reduce the support load on its helpdesk.To do this, we are developing a REST interface to the UK eScience CA with smarter client tools that simplify user and RA access.Improvements over the existing system include; a) renewals of recently expired certificates; b) a lightweight certificate re-application process that requires only a virtual meeting with an RA operator; c) a certificate change interface for amending selected attributes; and d) a service for bundling multiple host certificate requests into a single request.These changes will reduce the need for repeated face to face meetings with the user's RA and reduce tickets to the UK eScience CA helpdesk.