InCommon Technical Discussions

[Rhys Smith <>]

On 8 Nov 2017, at 22:05, Cantor, Scott 
<>
 wrote:
> 
>> - Achieve a grade of A on the Qualys SSL scanner [1]

The problem with that is that it’s a moving target; the SSLLabs requirements 
to get a particular grade change over time. It’s not a constant.


> I guess in my mind it's more interesting to tag systems with the grade we 
> find then get into rules about what the grade should be unless they're 
> actual rules. If I care, I should be able to filter on those grades, but 
> just knowing "we'd like it to be an A but it's not a requirement" doesn't 
> really get me anything useful that I can think of.

+1 on it being more interesting if it’s either a tag that indicates current 
score, or one of the requirements for a “good citizen” tag.


> I guess the point is "SHOULDs" never help much. Same as with profiles.
> 
> If we don't require something, I'd rather have a tag with the actual answer 
> either so I can report on it to my security people, or to limit who I allow 
> to use my system. Is it a huge value-add for InCommon to do SSL probes? I 
> dunno. I know it's something I probably wouldn't do myself.

Just so happens I’ve been doing this in bulk on all endpoint hosts in UKf & 
edugain MD for about 6 months or so now (with Qualys approval).

So, for anyone interested, the current state of InCommon entities that are 
exposed through edugain:

A+ | 90
A | 422
A- | 113
B | 178
C | 119
F | 53
T | 8
Certificate not valid for domain name | 36
IP_ADDRESS_BLACKLISTED | 2
No secure protocols supported | 1
Unable to connect to the server | 44
Unable to resolve domain name | 39
Unexpected failure | 1

Rhys.
--
Dr Rhys Smith
Chief Technical Architect, Trust & Identity
Jisc

T: +44 (0) 1235 822145
M: +44 (0) 7968 087821
Skype: rhys-smith
GPG: 0x4638C985
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG

jisc.ac.uk

Jisc is a registered charity (number 1149740) and a company limited by 
guarantee which is registered in England under Company No. 5747339, VAT No. 
GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, 
Bristol, BS2 0JA. T 0203 697 5800.