Sorry...hit send too soon.  The link <a href="http://boblord.livejournal.com/18402.html">http://boblord.livejournal.com/18402.html</a> shows how to get rid of the message. To give the xs the identity of the client you send a certificate request to the server.  This is in truth the public key of the client, which the server signs and sends back.  Thus the client now has a client certificate signed by the server's CA. There is a nice Firefox addon that manages this process for the issuer if one wishes there to be some manual oversight as to who is allowed to register (presumably some functionary at the school who oversees registration on the first day). There is an underlying set of security utilities that belong to Mozilla (NSS libraries and tools) that can perform the cert request building, and would allow scripting to do the cert requesting under the covers. As an alternative to a strictly manual approval process for the cert requests, the XO process for submitting the cr could put the serial number in a field of the cert request to be checked automatically against a list of serial numbers on the server, such that the cert is returned automatically. (Eagerly awaiting an eruption from Ivan). <div class="gmail_quote">On Tue, Feb 10, 2009 at 2:11 PM, Carol Farlow Lerche <<a href="mailto:cafl@msbit.com">cafl@msbit.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><a href="http://boblord.livejournal.com/18402.html" target="_blank">http://boblord.livejournal.com/18402.html</a>  <div><div></div><div class="Wj3C7c"> <div class="gmail_quote">On Tue, Feb 10, 2009 at 1:20 PM, Martin Langhoff <<a href="mailto:martin.langhoff@gmail.com" target="_blank">martin.langhoff@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">On Wed, Feb 11, 2009 at 4:57 AM, Simon Schampijer <<a href="mailto:simon@schampijer.de" target="_blank">simon@schampijer.de</a>> wrote: >> Thoughts? Opinions? Code? >> >> cheers, > > I wonder if it would not be best to generate a cert per user when we > authenticate the first time with the XS and add this then to the cert8.db in > the profile. This works fine - rainbow wise - as we do this already for the > OLPC - Root CA. How do we  - get the cert of the XS ahead of time and mark it as trusted to avoid the "self-signed cert bad!" screen?  - give the XS our cert so it knows who we are? see the 'Plan A'  (in my opening post) for further notes. m --  <a href="mailto:martin.langhoff@gmail.com" target="_blank">martin.langhoff@gmail.com</a>  <a href="mailto:martin@laptop.org" target="_blank">martin@laptop.org</a> -- School Server Architect  - ask interesting questions  - don't get distracted with shiny stuff  - working code first  - <a href="http://wiki.laptop.org/go/User:Martinlanghoff" target="_blank">http://wiki.laptop.org/go/User:Martinlanghoff</a> _______________________________________________ Sugar-devel mailing list <a href="mailto:Sugar-devel@lists.sugarlabs.org" target="_blank">Sugar-devel@lists.sugarlabs.org</a> <a href="http://lists.sugarlabs.org/listinfo/sugar-devel" target="_blank">http://lists.sugarlabs.org/listinfo/sugar-devel</a> </blockquote></div> </div></div>-- "It is difficult to get a man to understand something, when his salary depends upon his not understanding it." -- Upton Sinclair </blockquote></div> -- "It is difficult to get a man to understand something, when his salary depends upon his not understanding it." -- Upton Sinclair