Hi Jonathan, UAH is using an offline CA we call the "Russ CA," named affectionately after our previous CISO. Here is how Russ created the Russ CA and signed our eduroam cert using this CA:
$ openssl genrsa -des3 -out rootCA.key 4096 $ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 7300 -out rootCA.crt $ openssl ca -create_serial -keyfile rootCA.key -cert rootCA.crt -in input.pem -out out.crt -config ./server.cnf Where: - rootCA.key becomes the Root CA private key - rootCA.crt becomes the Root CA cert - input.pem is the CSR from your RADIUS (ClearPass I guess) - out.crt becomes the signed cert for RADIUS You will be asked to provide a passphrase for the Root CA key. It is vitally important that this be kept secure and that you do not lose it. You will be asked for information about the Root CA when you make the cert. Give real information. It shows up on iPhones under some circumstances, at the very least. Do not lose the root CA key, cert, or passphrase between signings! If you lose it, you will have to restart from nothing, and reprovision all your users. We are using this method for the past couple of years with no trouble. If you have any other questions let me know. -- Hunter Fuller (they) Router Jockey VBH M-1A +1 256 824 5331 Office of Information Technology The University of Alabama in Huntsville Network Engineering On Tue, Aug 10, 2021 at 9:57 AM Jonathan Miller <jmill...@fandm.edu> wrote: > Thank you all for the informative replies. As is probably obvious, when > we initially rolled this out, we were completely unaware of the best > practices, and are currently working to correct that and get our > infrastructure where it should be. > > We do not have an in-house PKI expert, but we are not completely > unfamiliar with OpenSSL. We do not currently have any internal CA as we've > just used InCommon for all of our certificate needs. > > If we want to do this right, my understanding is that the process is to: > 1. Create a Root CA with a long-lived certificate > 2. Create a certificate for our ClearPass servers, signed by that Root > CA, making sure to include the attributes listed here: > https://wiki.geant.org/display/H2eduroam/EAP+Server+Certificate+considerations > 3. Apply the certificate to ClearPass and distribute our new Root CA via > CAT or other means > > Would we be crazy to try to accomplish this inside of the 2 weeks that we > have before students start to return to campus? Any advice is appreciated, > just trying to steer this boat away from the iceberg. > > Thanks, > > Jonathan Miller > Senior Network Analyst > Franklin and Marshall College > > > On Mon, Aug 9, 2021 at 12:12 PM Jeffrey D. Sessler < > j...@scrippscollege.edu> wrote: > >> CA’s have done nothing is fifteen plus years, so from a risk management >> perspective, the chance of them changing course now is rather low. As to >> future RFCs, even if that happened tomorrow, it could be a decade or more >> before there was broad support, and more importantly, we could think about >> enforcement. >> >> >> >> Jeff >> >> >> >> >> >> *From:* The EDUCAUSE Wireless Issues Community Group Listserv < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> *On Behalf Of *Tim Cappalli >> *Sent:* Monday, August 09, 2021 8:05 AM >> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU >> *Subject:* Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New >> Root >> >> >> >> CA policies really have nothing to do with implementations of other >> protocols. There have been many discussions about this on this list and >> others, and a future RFC will likely include further clarity. However, as >> I've said in the past, RFCs do not dictate CA/B policies. >> >> >> >> If we're going to continue this discussion, we should fork a new thread >> as it has nothing to do with the original question. >> >> >> >> tim >> ------------------------------ >> >> *From:* The EDUCAUSE Wireless Issues Community Group Listserv < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Jeffrey D. Sessler < >> j...@scrippscollege.edu> >> *Sent:* Monday, August 9, 2021 10:53 >> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> >> *Subject:* Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New >> Root >> >> >> >> Per the RFC, the certificate-using application _*MAY*_ require the EAP >> extended key usage extension to be present. It is not a must or shall, so >> I’m not exactly sure the problem here. Vendors have chosen against >> requirement. >> >> >> >> The certificate-using application appears to be satisfied by the server >> authentication EKU, which is appropriate, and I don’t see why the public CA >> would consider it a misuse and invalidate it. >> >> >> >> As others have indicated, this is the de facto, and right or wrong, it’s >> not going to change and not worth getting stirred up about. >> >> >> >> jeff >> >> >> >> *From: *The EDUCAUSE Wireless Issues Community Group Listserv < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Doug Wussler < >> 0000029e57f9967b-dmarc-requ...@listserv.educause.edu> >> *Date: *Monday, August 9, 2021 at 7:33 AM >> *To: *WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> >> *Subject: *Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New >> Root >> >> Well, here is Microsoft's take on it... >> >> >> >> >> https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/certificate-requirements-eap-tls-peap >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Ftroubleshoot%2Fwindows-server%2Fnetworking%2Fcertificate-requirements-eap-tls-peap&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177714995%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=hx1WCuagh9lX9pNwIudcw%2F%2B1L9iNEOFO13obhaS%2FJJo%3D&reserved=0> >> >> >> >> [image: Image removed by sender.] >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Ftroubleshoot%2Fwindows-server%2Fnetworking%2Fcertificate-requirements-eap-tls-peap&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177724988%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=oulRbm%2B6JCUWoavQ13gPzzffQm4UhNVS5vUz5gl5VRQ%3D&reserved=0> >> >> Certificate requirements when you use EAP-TLS - Windows Server | >> Microsoft Docs >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Ftroubleshoot%2Fwindows-server%2Fnetworking%2Fcertificate-requirements-eap-tls-peap&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177734982%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=4J0h%2Fbn1bh16qdZY3wTIP5sZLEHjqlzWv7q79c0lMLw%3D&reserved=0> >> >> Certificate requirements when you use EAP-TLS or PEAP with EAP-TLS. >> 09/08/2020; 4 minutes to read; D; h; s; In this article. When you use >> Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) or >> Protected Extensible Authentication Protocol (PEAP) with EAP-TLS, your >> client and server certificates must meet certain requirements. >> >> docs.microsoft.com >> >> >> >> >> ------------------------------ >> >> *From:* The EDUCAUSE Wireless Issues Community Group Listserv < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Tim Cappalli < >> 00000194c9ecac40-dmarc-requ...@listserv.educause.edu> >> *Sent:* Monday, August 9, 2021 10:31 AM >> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> >> *Subject:* Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New >> Root >> >> >> >> I started working on something but decided it is not something I really >> have the cycles to maintain over time. (And I've found over the years that >> most people don't follow best practices anyway.) >> >> >> >> tim >> ------------------------------ >> >> *From:* The EDUCAUSE Wireless Issues Community Group Listserv < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Doug Wussler < >> 0000029e57f9967b-dmarc-requ...@listserv.educause.edu> >> *Sent:* Monday, August 9, 2021 10:30 >> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> >> *Subject:* Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New >> Root >> >> >> >> You don't often get email from >> 0000029e57f9967b-dmarc-requ...@listserv.educause.edu. Learn why this is >> important >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__http%3A%2F%2Faka.ms%2FLearnAboutSenderIdentification__%3B!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcaMgkk80%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177734982%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=0qrjgHx5iuZ0uGkvdhsVStDEwXGZJDOWk48IpDHSoYw%3D&reserved=0> >> >> Tim - >> >> >> >> Didn't you write up an explanation for all these issues? You were going >> to be able to point to that page since these issues resurface so often. >> >> >> >> Doug >> >> >> ------------------------------ >> >> *From:* The EDUCAUSE Wireless Issues Community Group Listserv < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Tim Cappalli < >> 00000194c9ecac40-dmarc-requ...@listserv.educause.edu> >> *Sent:* Monday, August 9, 2021 8:42 AM >> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> >> *Subject:* Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New >> Root >> >> >> >> A public CA issues certificates for web server authentication (amongst >> others like code signing and S/MIME). >> >> >> >> An EAP server is not a web server and has a designated usage assigned >> (which public CAs will not issue). EAP also does not follow traditional >> PKIX validation models due to the way the protocol operates. >> >> >> >> Any public CA web server certificate used for EAP could be revoked for >> misuse at any time. >> >> >> >> Tim >> >> >> >> >> ------------------------------ >> >> *From:* The EDUCAUSE Wireless Issues Community Group Listserv < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Elton, Norman N < >> wne...@wm.edu> >> *Sent:* Monday, August 9, 2021 8:36:08 AM >> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> >> *Subject:* Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New >> Root >> >> >> >> You don't often get email from wne...@wm.edu. Learn why this is important >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2F*2Faka.ms*2FLearnAboutSenderIdentification__*3B!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawqpIJda0*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173292636*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DkeJRtmc2KlEldjrgNyJBHH8oGIG2PO0uhgQ*2BHdAcdkA*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjc40GByv4%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177744982%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=e%2FvofPoBQm%2F6L%2FQIw5SpNECxOoIWDuUiWYdCl5jv3qw%3D&reserved=0> >> >> >> Technically, you're not even supposed to use the certificates issued >> from a public CA for EAP as it's a violation of multiple policies. >> >> >> >> I’m curious what those are. I thought it was fairly standard practice to >> use publicly-signed certificates on the server side, with privately-signed >> certificates on the clients. >> >> >> >> Thanks! >> >> >> >> Norman >> >> >> >> *From: *The EDUCAUSE Wireless Issues Community Group Listserv < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Tim Cappalli < >> 00000194c9ecac40-dmarc-requ...@listserv.educause.edu> >> *Date: *Monday, August 9, 2021 at 8:31 AM >> *To: *WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> >> *Subject: *Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New >> Root >> >> EAP server certs from a PKI you (or a partner like SecureW2) control are >> the best practice. >> >> >> >> Technically, you're not even supposed to use the certificates issued from >> a public CA for EAP as it's a violation of multiple policies. >> >> >> >> Tim >> >> >> >> >> ------------------------------ >> >> *From:* The EDUCAUSE Wireless Issues Community Group Listserv < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Elton, Norman N < >> wne...@wm.edu> >> *Sent:* Monday, August 9, 2021 8:18:37 AM >> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> >> *Subject:* Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New >> Root >> >> >> >> You don't often get email from wne...@wm.edu. Learn why this is important >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2F*2Faka.ms*2FLearnAboutSenderIdentification__*3B!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawqpIJda0*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173302592*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DUWcLijHqgDvoe6dbXsP1hPINtL1jyIP*2BQupYw*2FPoVK8*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcy_FcLj8%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177754973%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=yI5oE6XBkMTnb4MTqeRmV%2BVm5k2qnuL%2FsNvuOdLduHg%3D&reserved=0> >> >> To piggyback on Jonathan’s question … he mentions moving the server-side >> certificates to a private CA. Is this common? We’re using SecureW2 to >> configure an EAP-TLS deployment, so it should be trivial to configure the >> client to trust our private CA. >> >> >> >> We currently configure clients to trust server certificates coming from >> InCommon. I’ve had a long-simmering concern that if, for whatever reason, >> we can’t use InCommon one day … that means we have to reconfigure all our >> cliients. One solution, of course, is to trust multiple root public CAs. I >> suppose an alternative is to move to a private CA on the server-side. >> >> >> >> Thanks! >> >> >> >> Norman >> >> >> >> >> >> *Norman Elton* >> >> Director >> >> W&M IT Infrastructure >> >> wne...@wm.edu / 757-221-7790 >> >> >> >> >> >> >> >> *From: *The EDUCAUSE Wireless Issues Community Group Listserv < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Tim Cappalli < >> 00000194c9ecac40-dmarc-requ...@listserv.educause.edu> >> *Date: *Monday, August 9, 2021 at 8:03 AM >> *To: *WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> >> *Subject: *Re: [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New >> Root >> >> You should never use different EAP server certificates across a RADIUS >> cluster. Use the same cert across all nodes (in this case take the other >> cert with the longest expiry and upload it to all the nodes in the CPPM >> cluster) >> >> >> >> >> ------------------------------ >> >> *From:* The EDUCAUSE Wireless Issues Community Group Listserv < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Jonathan Miller < >> jmill...@fandm.edu> >> *Sent:* Monday, August 9, 2021 7:32:19 AM >> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU < >> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> >> *Subject:* [WIRELESS-LAN] eduroam CAT Config/Cert Renewal with New Root >> >> >> >> You don't often get email from jmill...@fandm.edu. Learn why this is >> important >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2F*2Faka.ms*2FLearnAboutSenderIdentification__*3B!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawqpIJda0*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173302592*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DUWcLijHqgDvoe6dbXsP1hPINtL1jyIP*2BQupYw*2FPoVK8*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcy_FcLj8%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177764969%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=NAivdIlMDBVjCK9KKdF0YzaLS1Idl8VuOGYq8CgBMJA%3D&reserved=0> >> >> We are currently using publicly signed certificates for our eduroam >> access on a cluster of 2 ClearPass servers. >> >> >> >> We are in a situation where one of our certs will be expiring in October >> of this year, while the other is good until June of next year. >> >> >> >> The certificate are issued through InCommon, and when I renewed our >> expiring certificate, I noticed that it is showing that is has a root of >> Sectigo, where it was previously Comodo. The certificate that is not >> expiring has a root CA of Comodo. >> >> >> >> This leads me to the following questions: >> >> 1. Is it advisable to run certificates with different Root CAs on >> different members of our ClearPass cluster? Would we expect to see client >> issues? >> >> 2. If it's not a problem to do this, can I simply add the Root CA for >> Sectigo to our eduroam CAT configuration, or is there only one Root CA >> allowed? >> >> >> >> Any other advice is appreciated. I understand that most institutions are >> moving to privately issued certificates in order to get control of these >> certificate chain issues, but we haven't quite gotten there yet. Our plan >> to properly onboard clients is to use an SSID with a captive portal to >> direct them to the eduroam CAT download. >> >> >> >> Thanks, >> >> >> Jonathan Miller >> >> Senior Network Analyst >> >> Franklin and Marshall College >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam06.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity*26data*3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C1e0bce8996aa4e032cca08d95b32469f*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641093800072434*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DdJN2I1oktf6NGwheI5JYuwbAb7LSnSLp4gPzFc3i41g*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawPNkrLZY*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173312538*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DFq02I3Ekw6WPC9hXVJhrx2VZEFHMHrrAYCIEcZ9xmqM*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUqKioqJSUqKioqKioqKioqKiolJSolJSUlJSUlJSUlJSUlJSUlJQ!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjc8vjMv2k%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177774962%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=C4xLZ4n4QJxiXX2rlFgqGXak2PAYo1CsQk40Ab%2BIa4U%3D&reserved=0> >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam06.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity*26data*3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C1e0bce8996aa4e032cca08d95b32469f*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641093800072434*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DdJN2I1oktf6NGwheI5JYuwbAb7LSnSLp4gPzFc3i41g*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawPNkrLZY*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173312538*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DFq02I3Ekw6WPC9hXVJhrx2VZEFHMHrrAYCIEcZ9xmqM*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUqKioqJSUqKioqKioqKioqKiolJSolJSUlJSUlJSUlJSUlJSUlJQ!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjc8vjMv2k%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177784954%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=GlBBllKBznhRlUtT%2Bu4q%2F7T%2FiW5zBSlq3hQVlQYi7i4%3D&reserved=0> >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam06.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity*26data*3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C1e0bce8996aa4e032cca08d95b32469f*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641093800082386*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DIe1HpOOuJrAN0RZpBu2C6fgA42lh7v6yLNHU1S*2FhAv8*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUl!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawLD2VGDk*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173322500*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DvolsYqNpVgqCjxlegONc*2BwtNRqSNZuz*2B*2BNf4rezeQh4*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUqKioqJSUqKioqKioqKioqKiolJSoqJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcH5o0mD0%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177794948%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9ooujMSO6eSpHKUxVp8IPdD5Qj9OB1LsoLWT0Mi%2FOY4%3D&reserved=0> >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam06.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity*26data*3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C1e0bce8996aa4e032cca08d95b32469f*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641093800082386*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DIe1HpOOuJrAN0RZpBu2C6fgA42lh7v6yLNHU1S*2FhAv8*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUl!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawLD2VGDk*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173322500*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DvolsYqNpVgqCjxlegONc*2BwtNRqSNZuz*2B*2BNf4rezeQh4*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUqKioqJSUqKioqKioqKioqKiolJSoqJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcH5o0mD0%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177804942%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=A7A6p7YPSI1DEqmX8MRIcoOA08Hz2QpbNIJgQ0Xp3Qc%3D&reserved=0> >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fnam06.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity*26data*3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C1e0bce8996aa4e032cca08d95b32469f*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641093800092340*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DogA0FK28zN3ihiSfLY46QKru1mC5Hjhn67*2B2ixzUj8s*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUl!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTaw117NPys*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173332457*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DV*2F9iOVb0yoAFISSIRoxaX8vrgCXHClocfE61O9uFZbY*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUqKioqJSUqKioqKioqKioqKiolJSoqJSUlJSUlJSUlJSUlJSUlJSUl!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcoTdqS3k%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177824935%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=O33uBiAyVjMOrQEpDbB5sU4MPzM5oCu5ZBF5d2ME1qw%3D&reserved=0> >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fwww.educause.edu*2Fcommunity__*3B!!PhOWcWs!noHRJ9yNg6gY_CYUmBa634tRxygv7eC6u8UIfKWwEztfKUZ8TF_IMixoYTawStVr2X0*24%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173332457*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DYzPJmwJYSOAdn5Ue5wtxgN1o*2BOQWVbYLnZQJJuQCZW4*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcDprM9fg%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177834926%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AaThlC2ZOBum8LTiHi93qK8%2BznaiDFiKw6JhJEPWpAo%3D&reserved=0> >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Fwww.educause.edu*2Fcommunity%26data%3D04*7C01*7Ctim.cappalli*40MICROSOFT.COM*7C468fff2bcd664807999208d95b4232fb*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C637641162173342415*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000%26sdata%3DPgxAeAWbMz*2FLYTO*2B3t9FrV9sMQkhIdMhvFHSKEicDhE*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSUlJSUlJSUlJQ!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcqoCLns8%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177844924%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=NpyOGgWWrfmx9Hs7OaMY257b1T57E8aloBdDJ%2B5wMLE%3D&reserved=0> >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fwww.educause.edu%2Fcommunity__%3B!!PhOWcWs!m_2CNd9NWCog0ZndhN4d4DBE2qugsIALRsIsBuLXHNQRxmnbzP9IM1KCwNjcS9NuC7E%24&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177844924%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=GdI3gW%2F4uRlD1UNdHvwEVShEOvs30iDRQkJH%2BbOkZzo%3D&reserved=0> >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177854915%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=lgKTFcTf5nZuhxpZ6oL%2BfMM5Gms6%2BjSP5ft7HBiWpcY%3D&reserved=0> >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177864909%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=eMTN%2BKuSLdfnoaWUMi1SrBFa7Huv2OSnxf5NKU51ck0%3D&reserved=0> >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> <https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=04%7C01%7CJeff%40scrippscollege.edu%7Cc8f0083e79e44aa4d7e608d95b4716a9%7C47274664281d4e3282489661a922b78c%7C0%7C0%7C637641183177864909%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=eMTN%2BKuSLdfnoaWUMi1SrBFa7Huv2OSnxf5NKU51ck0%3D&reserved=0> >> >> ********** >> Replies to EDUCAUSE Community Group emails are sent to the entire >> community list. If you want to reply only to the person who sent the >> message, copy and paste their email address and forward the email reply. >> Additional participation and subscription information can be found at >> https://www.educause.edu/community >> > ********** > Replies to EDUCAUSE Community Group emails are sent to the entire > community list. If you want to reply only to the person who sent the > message, copy and paste their email address and forward the email reply. > Additional participation and subscription information can be found at > https://www.educause.edu/community > ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community
