Types of Certificates Offered

SSL Certificate

A SSL Certificate is a single-domain webserver certificate needed to enable SSL operation on a server. 

Multi-Domain SSL Certificate (SAN Certificate)

A SAN (Subject Alternative Name) certificate has a field that specifies alternate FQDN’s that can use the certificate on the same domain. These certificates will secure up to 100 different FQDN’s on a single certificate.

Comodo EV SGC SSL Certificate

Extended Validation certificates provide the highest levels of encryption, security and trust and immediately reassure web site visitors that it is safe to conduct online transactions by turning the address bar green on next generation browsers.

Client (personal) or S/MIME Certificate

Also known as personal certificates or digital signatures, these certificates are associated with a person using their UC e-mail address for the following purposes:

• Signed Email - A campus certificate infrastructure like Microsoft Exchange Global Address List (GAL) makes it possible to promote S/MIME-based digital signing of electronic mail messages. Many modern email clients support signed email messages as do some webmail applications (e.g., Outlook Web Access). Highlight: official announcements, mailing list issues, client interoperability, webmail, client configuration, etc.
• Encrypted Email - Many email clients support the ability to use digital certificates to encrypt messages. While this facility can be useful for the short term transport of sensitive data, the use of encryption is easily achieved using the Microsoft Exchange Global Address List (GAL) in conjunction with the Microsoft Outlook client.
• Digital Signatures - Signing other documents, such as in the Microsoft Office Suite and Adobe products. This could include protocols for being able to verify signatures after the signing certificate expires. Another use case might be signed Web pages to ensure readers that the content was produced by the supposed source. Browsers that can accommodate "extensions" (Firefox, Safari) could make use of this capability.
• Web Authentication - Most Web servers and browsers make certificate-based authentication easy to implement and use. A typical campus implementation might prefer the use of certificates over passwords for authentication to the central campus Web SSO system. Application owners should always consider if part of their user community (e.g., guests) may not have certificates. The use of certificates eliminates the risk associated with phishing attacks. While Web authentication to local campus systems can work seamlessly because the Subject DN or other content can be understood, Web authentication to external systems is more problematic. 

For instructions on installation of personal certificates, use this tutorial.

Wildcard Certificates

In many industries there are time and cost considerations when purchasing digital certificates, thus making wildcard certificates more appealing as they cover an unlimited number of sub-domains. Since UC is a member of the InCommon Federation, the individual cost per certificate is not a concern. 

There is also a security consideration when using a wildcard certificate: if the private key associated with that wildcard certificate is compromised, then all servers using that wildcard certificate are vulnerable. Due to these concerns, UC has implemented the following restrictions on wildcard certificates:

• Cannot be used for one of UC’s top-level domains (e.g., *.uc.edu)
• Must be limited to a period of 1 year
• Are not permitted on sub-domains that handle, transmit, or store Export Controlled/Restricted/Controlled data
• Are not permitted on sub-domains with production data
• Are not permitted on sub-domains that handle, transmit, or store production credentials
• Must be recreated with new keypairs, not renewed
• May only be used when more than 100 FQDNs are involved. (If fewer than 100 FQDNs are needed, request a Multi-Domain SSL certificate instead).

Exceptions to Restrictions on Wildcard Certificates

It is recommended that a multi-domain certificate be used rather than a wildcard certificate. In the event that a multi-domain certificate is not appropriate, an exception may be granted. However, exceptions to these restrictions require approval by the Office of Information Security who will require a documented and approved RAF.

Renewing, Replacing, and Revoking Certificates

Certificates must be renewed or replaced before expiration.

• See the Digital Certificates Standard for specific renewal requirements

Certificates must be revoked if any of the following occur:

• Private key has been compromised
• The service is being retired or decommissioned
• When the private key is no longer in use
• An employee with access to the certificate/private key leaves the university

Turnaround Time

Standard turnaround time for certificate requests submitted via the webapp form is four (4) business days.

OIS Certificate Service

All University-related certificates must be issued by the Office of Information Security. Additional approval is required for certificates issued outside of this service.

Questions

Contact the IT@UC Office of Information Security.

To view PDF files, you will need Adobe Acrobat Reader, a free download.