That wasn’t too bad to get security for your print data. However, there is a problem. Notice that we used the IP address in the URL. After the big section on name checking, we should know that there is not a way to verify our Jetdirect’s certificate with an IP address in the URL. IPPS should have flagged a certificate error but it did not.

This behavior brings up an important point. Just because SSL/TLS is being used doesn’t mean the proper checks are being done. When you have a new application protocol using SSL/TLS, there are only three words for you: Test! Test! Test!

HP Jetdirect Certificate Guidelines

We’ve covered several client and server scenarios regarding HP Jetdirect and SSL/TLS. Here are some guidelines for issuing digital certificates to an HP Jetdirect:

•There is only one Identity certificate on HP Jetdirect, so supporting multiple certificates and things of that nature when Jetdirect is an SSL/TLS server are not an issue at the present time.

•Because there is only one certificate, be sure to issue a certificate that can do Client Authentication and Server Authentication unless you are absolutely sure that Jetdirect will only act as one or the other.

•Do not use the self-signed certificate that Jetdirect generates by default except for a temporary session in order to replace it with a better one.

•Each Jetdirect should have a unique certificate.

•Each Jetdirect should have host records in DNS and those DNS names should match the Jetdirect certificate.

•Use the Web Server (as described previously) to generate a Certificate Request so that the private key for Jetdirect always remains private. Be sure that the Common Name matches the FQDN of Jetdirect to avoid certificate errors.

•Do not store the same Identity Certificate on multiple Jetdirect cards (e.g., wildcard certificates for printing).

•When Jetdirect is acting as an SSL/TLS client and is being presented with a server certificate that has a wildcard character, follow the guidelines in RFC4513 for *all* protocols, not only LDAP. Otherwise, the wildcard certificate may not be accepted.

•When Jetdirect is acting as a client, be sure to have the CA certificate installed. The CA certificate has to be the top-level CA certificate.

•When Jetdirect is acting as a client, be sure to have the server send back the certificate chain. Jetdirect has minimal amount of storage available for certificates so it requires that functionality.

Following these guidelines will keep you looking younger.

Embedded Devices and Digital Certificates

One of the more common uses of digital certificates is for Virtual Private Network (VPN) access. In some environments, remote users are issued a USB key and the USB key is programmed with a digital certificate assigned to the user. The private key of the certificate is protected via a PIN number that provides encryption. When a user brings up the VPN, the PIN number must be used so that the private key can be accessed to establish the VPN connection. This behaves like two factor authentication: What do I know (the PIN #)? What do I have (the digital certificate on the USB key)?

With Embedded Devices, there is no password that can be entered. This means that the certificate private key is likely stored “in the clear”. Even if a password was required, it is going to be used by the firmware of the Embedded Device rather than a user (an Embedded Device may not even have a

94