Free SSL Certificates for schools!!

[matt40k]

Janet are providing free SSL certificates to schools - JANET Certificate Service

[jamesfed]

Have been trying to push this on others here for a while now

 

We have one in use at the moment and will be registering another when we get back.

[matt40k]

I just don't get why people don't use it. I mean when Nominet got paided to give every school a ".sch.uk", I don't get why every school didn't get one, now you can get a free SSL certificate. Let's face it, every schools going to have a VLE or something that needs to be secured in this day and age.

 

I think most people forget that ".sch.uk" and Janet certificates are limited to only schools (and other educational institutions) which is a great security benefit. OK, you still going to worry about being hacked, but at least your parents are going to guareetee that your website is actual yours and not the one I setup 5 mins ago with a news article saying the school is closed due to the boiler failure

[robk]

Can you actually apply for these direct now? I recall some time ago you had to work through your la/ rbc and most seemed to not want the admin work.

[matt40k]

My understanding, your LA registers it's self with Janet certificates and they do it for the whole LA. They get approved, they logon to a simple web interface, they self manage the LA certificates. Doesn't seem much admin work really, it's most liking going to be easier, after all they need the certificate to add to the reverse proxy.

[plexer]

The school owns the .sch.uk not the lea though.

 

Ben

[john]

Can you actually apply for these direct now? I recall some time ago you had to work through your la/ rbc and most seemed to not want the admin work.

 

I am fairly sure from reading the site its still a job for the LA, that being the LAs that are usually to busy to do many things for many and want an admin fee for doing a great number of tasks as well

 

JA.Net need to open it up to allow direct requests really, or make it so the LA has to register each school and can then delegate access to the SSL system to each school its approved perhaps.

[GrumbleDook]

The school owns the domain (actually, technically Nominet / UK Govt own it but that is just details) but JANET, as the certificate authority, have to provide verification on the domain, which has a cost. At the moment the LA/RBC has to agree to be the verifier and I happily sign off any EMBC connected school (done via Comodo, who are the CA for these certificates). Technically I cannot sign off an Academy on behalf of the LA, but I can as the person managing their connection to the RBC ... so if you are in Northants and want one get in there sooner rather than later.

 

As far as I am aware, JANET will only grant the certificate if you are on a JANET / NEN connection and it is only for .sch.uk domains. I have had one or two local schools grumble about this ... but this is a free service ... it will have restrictions / conditions. I have asked who would sign off an Academy which has *nothing* to do with the LA and the response I had was that the RBC could do it instead ... if they are not connected via the RBC then they don't get the certificate (schools connected in via links with local Universities and JANET are the exception here ... but JANET prefer you to use the RBC).

 

It is some admin work for the LAs ... and for the number of people who expressed an interest when I raised it locally it was not efficient to do it across the board, so it is done on an ad-hoc basis. In the same way as when a Firewall change is requested a certain amount of documentation is needed ... not for me, but so that the school documents it themselves ... but that is a rant for another day.

[matt40k]

JA.Net need to open it up to allow direct requests really, or make it so the LA has to register each school and can then delegate access to the SSL system to each school its approved perhaps.

 

I don't think they need to, otherwise they would create more work for themselves and thus cost more money, LA's have methods already in place to check that you actually work at a particular school. A school should only ask for 1 certificate anyway, if it needs more then one then they should ask for a wildcard certificate - there is a shortage of IPv4 addresses after all! Personally, it should make the process a whole lot easier.

 

@GrumbleDrook - I guess they would get it from the LA\RBC if they're on the network otherwise I guess it's like the census and they go direct (to DfE). How long till we see a National Authority for Academies to deal with the services LA dealt with for schools?

[GrumbleDook]

I don't think they need to, otherwise they would create more work for themselves and thus cost more money, LA's have methods already in place to check that you actually work at a particular school. A school should only ask for 1 certificate anyway, if it needs more then one then they should ask for a wildcard certificate - there is a shortage of IPv4 addresses after all! Personally, it should make the process a whole lot easier.

 

@GrumbleDook - I guess they would get it from the LA\RBC if they're on the network otherwise I guess it's like the census and they go direct (to DfE). How long till we see a National Authority for Academies to deal with the services LA dealt with for schools?

 

Talking with a number of other LAs ... some just don't have the people they used to have anymore ... and not all schools contribute towards what the LA does ... so the idea that schools should go direct is not that strange an idea. Someone has to pay for the admin at some point. Academies can go direct to their RBCs so there is already that system in place there.

[PiqueABoo]

Getting a free for edu cert from say IPSCA isn't much hassle i.e. if you can receive for (amongst others) postmaster@..sch.uk to authenticate the cert request then it just works. What does ja.net add?

[glennda]

It's a shame you have to use the .sch domain for most things to be free for edu. Ot was a decision to drop the .sch.UK in favour of a .org.uk address.

[GrumbleDook]

There are rules about what you use each TLD for ... I have previously disagreed with folk (including my former Head at my last place) about schools using .com or .co.uk ... foundation / trust / co-operative trust can get away with using .org.uk but not .org ... this is not to say that the other domains should not be registered to protect the school's brand ... but .sch.uk is what it should be by default and the other domains should just be redirections to it.

 

And yes ... I know there are folk who vehemently disagree and that schools should be free to choose ...

[SYNACK]

There are rules about what you use each TLD for ... I have previously disagreed with folk (including my former Head at my last place) about schools using .com or .co.uk ... foundation / trust / co-operative trust can get away with using .org.uk but not .org ... this is not to say that the other domains should not be registered to protect the school's brand ... but .sch.uk is what it should be by default and the other domains should just be redirections to it.

 

And yes ... I know there are folk who vehemently disagree and that schools should be free to choose ...

 

I fully agree with you, using .com is a misrepresentation unless you are a for profit entity (diluted from an international for profit entity). Using .com for everything is pandering to the uninformed and/or undereducated.

 

IPSCA works fine for here using the frankly retarded (given its epic length) .school.nz or my preffered .ac.nz (academic - which also fits a school).

[psydii]

Not two months before this change JANET told me no way no chance.

 

That is annoying. Mind you I'm not sure there is anyone in the LA left to sign off for us.

[pooley]

I'm fairly sure if I asked our LA about sch domain and JANET I'd get some very blank looks

[jonathon28]

I've just applied for one and got the following back.

 

"Individual schools cannot join the certificate service. Please ask your Local Authority to make the application on your behalf."

[john]

I've just applied for one and got the following back.

 

"Individual schools cannot join the certificate service. Please ask your Local Authority to make the application on your behalf."

 

Correct, only the RBC or your LA can apply for a certificate for you so you will need to talk to your LA or RBC. If you are an academy and thus not part of the LA but still using the RBC then they should be able to help you if you are not using either of them then you won't be able to take part in the free SSL is the way I see it.