Jonathan, As I mentioned in my first reply, just use the certificate that is still valid on all nodes in your CPPM cluster for EAP. This will allow existing clients to still authenticate.
When that cert expires, you'll need to look at re-onboarding clients and at that point and I'd recommend moving to a PKI you control (even just a basic offline root using openssl). I'd recommend at least spinning up the root now and including it in the CAT tool config so new clients that connect will be ready for that change. tim From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]> on behalf of Jonathan Miller <[email protected]> Date: Tuesday, August 10, 2021 at 10:59 To: [email protected] <[email protected]> Subject: Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root You don't often get email from [email protected]. Learn why this is important<http://aka.ms/LearnAboutSenderIdentification> Thank you all for the informative replies. As is probably obvious, when we initially rolled this out, we were completely unaware of the best practices, and are currently working to correct that and get our infrastructure where it should be. We do not have an in-house PKI expert, but we are not completely unfamiliar with OpenSSL. We do not currently have any internal CA as we've just used InCommon for all of our certificate needs. If we want to do this right, my understanding is that the process is to: 1. Create a Root CA with a long-lived certificate 2. Create a certificate for our ClearPass servers, signed by that Root CA, making sure to include the attributes listed here: https://wiki.geant.org/display/H2eduroam/EAP+Server+Certificate+considerations<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.geant.org%2Fdisplay%2FH2eduroam%2FEAP%2BServer%2BCertificate%2Bconsiderations&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443375888%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=jh%2FetlyWIgHaSPABgLA68kwjOHmQBuGeZd0fFXetj%2F8%3D&reserved=0> 3. Apply the certificate to ClearPass and distribute our new Root CA via CAT or other means Would we be crazy to try to accomplish this inside of the 2 weeks that we have before students start to return to campus? Any advice is appreciated, just trying to steer this boat away from the iceberg. Thanks, Jonathan Miller Senior Network Analyst Franklin and Marshall College On Mon, Aug 9, 2021 at 12:12 PM Jeffrey D. Sessler <[email protected]<mailto:[email protected]>> wrote: CA’s have done nothing is fifteen plus years, so from a risk management perspective, the chance of them changing course now is rather low. As to future RFCs, even if that happened tomorrow, it could be a decade or more before there was broad support, and more importantly, we could think about enforcement. Jeff From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]<mailto:[email protected]>> On Behalf Of Tim Cappalli Sent: Monday, August 09, 2021 8:05 AM To: [email protected]<mailto:[email protected]> Subject: Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root CA policies really have nothing to do with implementations of other protocols. There have been many discussions about this on this list and others, and a future RFC will likely include further clarity. However, as I've said in the past, RFCs do not dictate CA/B policies. If we're going to continue this discussion, we should fork a new thread as it has nothing to do with the original question. tim ________________________________ From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]<mailto:[email protected]>> on behalf of Jeffrey D. Sessler <[email protected]<mailto:[email protected]>> Sent: Monday, August 9, 2021 10:53 To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> Subject: Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root Per the RFC, the certificate-using application _MAY_ require the EAP extended key usage extension to be present. It is not a must or shall, so I’m not exactly sure the problem here. Vendors have chosen against requirement. The certificate-using application appears to be satisfied by the server authentication EKU, which is appropriate, and I don’t see why the public CA would consider it a misuse and invalidate it. As others have indicated, this is the de facto, and right or wrong, it’s not going to change and not worth getting stirred up about. jeff From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]<mailto:[email protected]>> on behalf of Doug Wussler <[email protected]<mailto:[email protected]>> Date: Monday, August 9, 2021 at 7:33 AM To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> Subject: Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root Well, here is Microsoft's take on it... https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/certificate-requirements-eap-tls-peap<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Ftroubleshoot%2Fwindows-server%2Fnetworking%2Fcertificate-requirements-eap-tls-peap&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443375888%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Q%2BzyH2hLePyVOcQktVvqtDHb93Ov1krvF%2B%2BFUnXpvSg%3D&reserved=0> Error! Filename not specified.<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Ftroubleshoot%2Fwindows-server%2Fnetworking%2Fcertificate-requirements-eap-tls-peap&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443385843%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=TymKaYBDXwz9ip%2BZR5GtPXxPcre8f%2ByIFOq8WBd47O8%3D&reserved=0> Certificate requirements when you use EAP-TLS - Windows Server | Microsoft Docs<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Ftroubleshoot%2Fwindows-server%2Fnetworking%2Fcertificate-requirements-eap-tls-peap&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443385843%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=TymKaYBDXwz9ip%2BZR5GtPXxPcre8f%2ByIFOq8WBd47O8%3D&reserved=0> Certificate requirements when you use EAP-TLS or PEAP with EAP-TLS. 09/08/2020; 4 minutes to read; D; h; s; In this article. When you use Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) or Protected Extensible Authentication Protocol (PEAP) with EAP-TLS, your client and server certificates must meet certain requirements. docs.microsoft.com<https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fdocs.microsoft.com%2F&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443395790%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=j1yXziLcvDH55%2FJqy23GjIDeqUwzA6uPj4a2TqLKoCg%3D&reserved=0> ________________________________ From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]<mailto:[email protected]>> on behalf of Tim Cappalli <[email protected]<mailto:[email protected]>> Sent: Monday, August 9, 2021 10:31 AM To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> Subject: Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root I started working on something but decided it is not something I really have the cycles to maintain over time. (And I've found over the years that most people don't follow best practices anyway.) tim ________________________________ From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]<mailto:[email protected]>> on behalf of Doug Wussler <[email protected]<mailto:[email protected]>> Sent: Monday, August 9, 2021 10:30 To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> Subject: Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root You don't often get email from [email protected]<mailto:[email protected]>. Learn why this is important<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__http%3A%2F%2Faka.ms%2FLearnAboutSenderIdentification__%3B!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcaMgkk80%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443395790%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=sxWo3rR5DaqjoTKu0bJM%2B4tIt5nGUZp2tN54oB63do4%3D&reserved=0> Tim - Didn't you write up an explanation for all these issues? You were going to be able to point to that page since these issues resurface so often. Doug ________________________________ From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]<mailto:[email protected]>> on behalf of Tim Cappalli <[email protected]<mailto:[email protected]>> Sent: Monday, August 9, 2021 8:42 AM To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> Subject: Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root A public CA issues certificates for web server authentication (amongst others like code signing and S/MIME). An EAP server is not a web server and has a designated usage assigned (which public CAs will not issue). EAP also does not follow traditional PKIX validation models due to the way the protocol operates. Any public CA web server certificate used for EAP could be revoked for misuse at any time. Tim ________________________________ From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]<mailto:[email protected]>> on behalf of Elton, Norman N <[email protected]<mailto:[email protected]>> Sent: Monday, August 9, 2021 8:36:08 AM To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> Subject: Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root You don't often get email from [email protected]<mailto:[email protected]>. Learn why this is important<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2F*2Faka.ms*2FLearnAboutSenderIdentification__*3B!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawqpIJda0*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173292636*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DkeJRtmc2KlEldjrgNyJBHH8oGIG2PO0uhgQ*2BHdAcdkA*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjc40GByv4%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443395790%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=ChC7xk%2BEYiwlmYwZPNYliImXJHfqUL6Q%2FBp8yRjC6fc%3D&reserved=0> >> Technically, you're not even supposed to use the certificates issued from a >> public CA for EAP as it's a violation of multiple policies. I’m curious what those are. I thought it was fairly standard practice to use publicly-signed certificates on the server side, with privately-signed certificates on the clients. Thanks! Norman From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]<mailto:[email protected]>> on behalf of Tim Cappalli <[email protected]<mailto:[email protected]>> Date: Monday, August 9, 2021 at 8:31 AM To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> Subject: Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root EAP server certs from a PKI you (or a partner like SecureW2) control are the best practice. Technically, you're not even supposed to use the certificates issued from a public CA for EAP as it's a violation of multiple policies. Tim ________________________________ From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]<mailto:[email protected]>> on behalf of Elton, Norman N <[email protected]<mailto:[email protected]>> Sent: Monday, August 9, 2021 8:18:37 AM To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> Subject: Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root You don't often get email from [email protected]<mailto:[email protected]>. Learn why this is important<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2F*2Faka.ms*2FLearnAboutSenderIdentification__*3B!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawqpIJda0*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173302592*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DUWcLijHqgDvoe6dbXsP1hPINtL1jyIP*2BQupYw*2FPoVK8*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcy_FcLj8%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443405751%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=kxEv0Ge5lnvqTCRw1pJVsLK0nUeS860zOWsc%2BNNw7wE%3D&reserved=0> To piggyback on Jonathan’s question … he mentions moving the server-side certificates to a private CA. Is this common? We’re using SecureW2 to configure an EAP-TLS deployment, so it should be trivial to configure the client to trust our private CA. We currently configure clients to trust server certificates coming from InCommon. I’ve had a long-simmering concern that if, for whatever reason, we can’t use InCommon one day … that means we have to reconfigure all our cliients. One solution, of course, is to trust multiple root public CAs. I suppose an alternative is to move to a private CA on the server-side. Thanks! Norman Norman Elton Director W&M IT Infrastructure [email protected]<mailto:[email protected]> / 757-221-7790 From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]<mailto:[email protected]>> on behalf of Tim Cappalli <[email protected]<mailto:[email protected]>> Date: Monday, August 9, 2021 at 8:03 AM To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> Subject: Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root You should never use different EAP server certificates across a RADIUS cluster. Use the same cert across all nodes (in this case take the other cert with the longest expiry and upload it to all the nodes in the CPPM cluster) ________________________________ From: The EDUCAUSE Wireless Issues Community Group Listserv <[email protected]<mailto:[email protected]>> on behalf of Jonathan Miller <[email protected]<mailto:[email protected]>> Sent: Monday, August 9, 2021 7:32:19 AM To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> Subject: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root You don't often get email from [email protected]<mailto:[email protected]>. Learn why this is important<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2F*2Faka.ms*2FLearnAboutSenderIdentification__*3B!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawqpIJda0*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173302592*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DUWcLijHqgDvoe6dbXsP1hPINtL1jyIP*2BQupYw*2FPoVK8*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcy_FcLj8%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443405751%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=kxEv0Ge5lnvqTCRw1pJVsLK0nUeS860zOWsc%2BNNw7wE%3D&reserved=0> We are currently using publicly signed certificates for our eduroam access on a cluster of 2 ClearPass servers. We are in a situation where one of our certs will be expiring in October of this year, while the other is good until June of next year. The certificate are issued through InCommon, and when I renewed our expiring certificate, I noticed that it is showing that is has a root of Sectigo, where it was previously Comodo. The certificate that is not expiring has a root CA of Comodo. This leads me to the following questions: 1. Is it advisable to run certificates with different Root CAs on different members of our ClearPass cluster? Would we expect to see client issues? 2. If it's not a problem to do this, can I simply add the Root CA for Sectigo to our eduroam CAT configuration, or is there only one Root CA allowed? Any other advice is appreciated. I understand that most institutions are moving to privately issued certificates in order to get control of these certificate chain issues, but we haven't quite gotten there yet. Our plan to properly onboard clients is to use an SSID with a captive portal to direct them to the eduroam CAT download. Thanks, Jonathan Miller Senior Network Analyst Franklin and Marshall College ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam06.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity*26data*3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C1e0bce8996aa4e032cca08d95b32469f*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641093800072434*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DdJN2I1oktf6NGwheI5JYuwbAb7LSnSLp4gPzFc3i41g*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawPNkrLZY*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173312538*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DFq02I3Ekw6WPC9hXVJhrx2VZEFHMHrrAYCIEcZ9xmqM*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUqKioqJSUqKioqKioqKioqKiolJSolJSUlJSUlJSUlJSUlJSUlJQ!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjc8vjMv2k%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443415707%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=3BE4uiVxQa4BUmBhTCFoZIrXgQMOi1NtaRaKwrcoO9Q%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam06.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity*26data*3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C1e0bce8996aa4e032cca08d95b32469f*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641093800072434*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DdJN2I1oktf6NGwheI5JYuwbAb7LSnSLp4gPzFc3i41g*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawPNkrLZY*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173312538*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DFq02I3Ekw6WPC9hXVJhrx2VZEFHMHrrAYCIEcZ9xmqM*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUqKioqJSUqKioqKioqKioqKiolJSolJSUlJSUlJSUlJSUlJSUlJQ!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjc8vjMv2k%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443415707%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=3BE4uiVxQa4BUmBhTCFoZIrXgQMOi1NtaRaKwrcoO9Q%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam06.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity*26data*3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C1e0bce8996aa4e032cca08d95b32469f*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641093800082386*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DIe1HpOOuJrAN0RZpBu2C6fgA42lh7v6yLNHU1S*2FhAv8*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUl!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawLD2VGDk*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173322500*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DvolsYqNpVgqCjxlegONc*2BwtNRqSNZuz*2B*2BNf4rezeQh4*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUqKioqJSUqKioqKioqKioqKiolJSoqJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcH5o0mD0%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443425667%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=UaKI08o1%2BQkpiZo3JTdjKHojE7iF4OYeKqFvp1C6Ows%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam06.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity*26data*3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C1e0bce8996aa4e032cca08d95b32469f*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641093800082386*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DIe1HpOOuJrAN0RZpBu2C6fgA42lh7v6yLNHU1S*2FhAv8*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUl!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawLD2VGDk*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173322500*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DvolsYqNpVgqCjxlegONc*2BwtNRqSNZuz*2B*2BNf4rezeQh4*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUqKioqJSUqKioqKioqKioqKiolJSoqJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcH5o0mD0%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443425667%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=UaKI08o1%2BQkpiZo3JTdjKHojE7iF4OYeKqFvp1C6Ows%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam06.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity*26data*3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C1e0bce8996aa4e032cca08d95b32469f*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641093800092340*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DogA0FK28zN3ihiSfLY46QKru1mC5Hjhn67*2B2ixzUj8s*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUl!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTaw117NPys*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173332457*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DV*2F9iOVb0yoAFISSIRoxaX8vrgCXHClocfE61O9uFZbY*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUqKioqJSUqKioqKioqKioqKiolJSoqJSUlJSUlJSUlJSUlJSUlJSUl!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcoTdqS3k%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443435627%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=RI%2Fv9fL24F4xG9CsKiToEZJCFUs8Rc9BwCbzTU50U3A%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fwww.educause.edu*2Fcommunity__*3B!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawStVr2X0*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173332457*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DYzPJmwJYSOAdn5Ue5wtxgN1o*2BOQWVbYLnZQJJuQCZW4*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcDprM9fg%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443445583%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=8NjkOTtm7735DgojZL5e3HEwm28XwcW8CAHhVHG4gVg%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173342415*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DPgxAeAWbMz*2FLYTO*2B3t9FrV9sMQkhIdMhvFHSKEicDhE*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUlJSUlJSUlJQ!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcqoCLns8%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443445583%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=lWxAIng3mVUpYrMy6DIIM0G3qisjyLcFOWwgVZweW70%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fwww.educause.edu%2Fcommunity__%3B!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcS9NuC7E%24&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443445583%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=M%2BRrjZtAM%2F71DWL6ajoXVw4cHXF2J22eF%2Bq1KGfEi6g%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443455534%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=l2cfyULSKgx8DzCRqa9%2Ft0XghTyR46VtTAthKkSLFl8%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443455534%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=l2cfyULSKgx8DzCRqa9%2Ft0XghTyR46VtTAthKkSLFl8%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443465493%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=PnhCQZEHCJaKq6sUx0%2FysZuOz4pqPltZflhXMjV1vx8%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443465493%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=PnhCQZEHCJaKq6sUx0%2FysZuOz4pqPltZflhXMjV1vx8%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7Cd945b2f5981e4a8d218a08d95c0f368c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642043443465493%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=PnhCQZEHCJaKq6sUx0%2FysZuOz4pqPltZflhXMjV1vx8%3D&reserved=0> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community
