The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Mikael Bak <address@concealed>]

Matthew, Tony,
Thank you both for your valuable input!

On 2019. 04. 23. 11:47, Matthew Slowe wrote:
> 
> 
> Current thinking is that a local, long-lived Root CA (which could be
> dedicated to RADIUS authentication) be used and published via CAT then
> service certificates be issued using that.
> 
> There’s a pretty good breakdown of the pros and cons (not specifically
> for LE) here:
> 
> https://wiki.geant.org/display/H2eduroam/EAP+Server+Certificate+considerations
>  
> 

I'm going to suggest to my collegues that we deploy a dedicated,
long-lived Root CA for eduroam in our organization.

I imagine we're going to give a validity time of 10 years to our Root
CA. But on the other hand, what stops us from give it, let's say 20 or
50 years? Any obvious drawbacks?

TIA,
Mikael Bak