E-mail This Article | Print It

People might normally associate cryptography with dashing spies delivering encoded messages, code breakers working diligently to decipher their meanings, and clandestine meetings. It might surprise some to learn that the University of Maryland engages in cryptography every day—all through cyberspace. As a Certificate Authority (CA), it authenticates requestors and signs certificates used to protect networked services for the university community. In other words, it makes sure that Web sites secured with university signed certificates can be trusted as valid and authentic.

“The Internet is a medium where inventive and unscrupulous minds can have a field day,” said Gerry Sneeringer of the Office of Information Technology. “Through our power as Certificate Authority, we can help reduce the chances of users getting taken advantage of or being fooled by sites that look like university-approved sites but are not.”

Secured Web sites present the user with a certificate that has been signed by a CA. The Web site’s public key, contained in the certificate, is used to encrypt data from the user before it is sent to the server. For example, when you hit the Submit button on a Web form found on a secure Web site, the information you provided is encrypted with the public key before it is sent across the Internet to the server. The server uses the matching private key to decrypt the transmission. Only the matching private key can decrypt the data. A Certificate Authority—like the University of Maryland—verifies that a requestor is who they say they are and can either accept or reject the request for a university signed certificate based on their findings. The CA can authenticate multiple Web sites, making it simple and easy for people to access a trusted source and virtually eliminate the chance of encountering a forged university Web site.

“Frequent Web surfers have probably already noticed the many pop-up windows referencing the Certificate Authority when they visit a university site,” said Sneeringer. “However, there is a very simple procedure you can do entirely online to eliminate irritating pop-ups.”

Users wishing to avoid pop-up windows can go to www.cert.umd.edu, install the University of Maryland root certificate, and establish the university as a trusted Certificate Authority. To do this click on “install the University Root Certificate” and follow the instructions presented to you on the Web page and by your browser. Doing this indicates that you trust the University of Maryland to sign only certificates from valid requestors. This means that every time you visit a Web site secured with a university signed certificate you trust its authenticity, in other words, without pop-ups!

When installing the root certificate, be sure you read the documentation prior to following any of the provided links. Establishing the type of trust associated with a Certificate Authority is one way that users can help the university CA guard against misuse of the root certificate.

Open a New Window to Rate This Article