Here is the October installment of the new monthly communication from the InCommon Certificate Service. Each month we will highlight a frequently asked question from the list along with its corresponding responses as well as added notes from our team when needed. Please let us know if there is a question that you would like to see addressed in a future installment of The Latest from the List. In the meantime, keep the great dialogue going on the list!
—Paul Caskey, Program Manager, InCommon Certificate Service

Q: What is the proper way for RAOs to use the S/MIME client enrollment form?   

A: Each organization (university) can customize their own endpoint and create accounts for each endpoint, or they can stay with the default and just create an account.

Example: The Client certificate self-enrollment form—connects to the shared self-enrollment form for enrolling client certificates.
 
Once the endpoint, and the account are created, user(s) can request the client certificate using the enrollment form URL or through an invitation notification.
1. Enrollment form URL is provided by the organization admin (RAO), and the user will be prompted to verify their email address and provide an access code as necessary.
2. The client certificate through an invitation process is as follows:
a. 	Edit the person that needs a client certificate (under the Persons menu).
b. 	Click on the "Enrollment invitation.
c.  	The account that was created in the enrollment form should be selected automatically.
d. 	Click send.
e. 	The user should receive an email like the one below.

f.  	The user should confirm their identity.
g. 	They will be redirected to the enrollment form to request the certificate.

InCommon Users (RAOs) might see other enrollment endpoints, and accounts for other universities, that is normal behavior because all universities are under one Account (InCommon).
*** Note: Do not delete or modify any endpoint(s) or account(s) of any other university. ***
The same behavior is there for other enrollment forms: (Client, SSL, device, SAML). If it is not yours, please don’t touch it.
Any endpoint that is created should have the name of the university it is for. If it is not your university, please don’t touch it.
We are working on a solution for the next release.

—Moe Ghamlouch, Service Account Manager, Sectigo