Q: Do you intend to escrow the private keys of encryption-only client certificates system-wide or leave it up to individual sites whether or not to escrow?Р”Р„: Well, Texas law is clear on that: to be useful for legal signatures, signing keys for personal certificates cannot be escrowed (but role certs can be). Not sure if they're doing much with EFS today (they have developed an in-house escrow system for almost everything, including keys, passwords, etc.). EFS under WinXP assumed the private key was always available, which isn't true with certificates on tokens, but this was something UT-Austin was pretty interested in at the time. Also, we included the Microsoft Encrypting FileSystem (EFS) OID in our VeriSign certs, but never really used it. It works fine (except for some things like basic auth to web pages, which breaks when you require a smartcard for a user account), but users are somewhat resistant to it because it's inconvenient. UT Austin and UT Dallas both also have pretty mature deployments, but IРІР‚в„ўm less familiar with their specific use cases.Р”Р„t System Administration, we experimented by using our VeriSign certificates on Aladdin tokens for smartcard login. (I hear a couple of other medical schools are planning to do the same.) I think UTH has the most mature deployment and use cases. UT Health (UTH) in Houston and the folks here at System Administration UT both intend to deploy separate signing and encryption certificates on Aladdin/Safenet USB tokens. And we're also starting to dip our toes into the waters of document signing (Acrobat is nice in that it combines a visual of your wet signature with a digital signature and I think the current version of MS-Office does this as well).

But there's also a fair amount of anticipated use for client authentication (at least at a few institutions). Do you intend to use them for S/MIME e-mail? Using Microsoft Exchange? Something else?Р”Р„: Yes, S/MIME is the primary use and most, if not all, are running Exchange. Q: I assume UT intends to use signing-only and encryption-only client certificates. These certificates are made available to the userРІР‚в„ўs Microsoft Exchange client, typically via their PCРІР‚в„ўs local store, but via USB token in some cases. Certain users are issued a certificate - either a combo/dual-use certificate or separate signing-only and encryption-only certificates. In Texas, the primary use for client certificates is for S/MIME-capable e-mail via Microsoft Exchange. So now the UT system can escrow encryption-only certificates but not signing-only certificates, thereby complying with the Texas statutes. In response, Comodo cast two additional key usage types for the purposes of signing only and encryption only. By Texas law, the UT system can not escrow signing keys, so the legality of dual-use client certificates was questioned. Until recently, the only client certificate usage scenario supported by Comodo was a dual-use client certificate (i.e., both signing and encryption capability in one certificate). This document describes various uses of the InCommon Certificate Service within the University of Texas (UT) system. Client Certificate Use Case: The UT System

Microsoft exchange client certificate