Below you will find instructions on how to request certificates with popular web browsers as well as instructions for the use of this certificates. The instructions for certification shall relate to e-mail (S / MIME) certificates. However, the requirement of other types of certificates is designed largely similar. If you have suggestions for further instructions or additional questions, you can send an e-mail to support@gwdg.de or use the GWDG support form.
In the future, you will receive new certificates via the GÉANT TCS. For information on specific application procedures, please contact your local participant service of your institution. For user certificates for signing and/or optional encryption of e-mails, the application method is the GÉANT TCS PKI in most cases the right way. In cooperation with your local participant service employee of your institution or RA, you create a user certificate. Further information can also be found in the information provided under “Detailed description of email encryption with X.509 certificates” GWDG news articles available to you.
To apply for an email certificate from the GÉANT TCS PKI, which is anchored in the DFN's GÉANT TCS PKI tenant, please follow the information below.
Click on the URL for the HARICA Certificate Manager
Log in using SSO by clicking on the 'Academic Login' button and entering your work email address and the associated password from your home organization.
or
Register your work email address with a self-chosen password at this URL HARICA Certificate Manager Signup
After successful registration, the dashboard will be displayed. Please click the menu item Email on the left in the navigation.
Select the certificate type Email-only and go through the application steps. This certificate type is the current recommendation from DFN.
After the application has been submitted, a certificate file will be downloaded in the download folder of the web browser used.
Please refer to universally_applicable_to_x509_certificates for the further processing of this file with the file extension .p12.
If you have any questions, please send an e-mail to support@gwdg.de or use the GWDG support form.
For further steps and detailed instructions on how to install and use the certificate (the file with the file extension .p12 in the download directory of the web browser used) in different e-mail clients, please read the following documents.
(currently only in German)
To apply for a server certificate from the GÉANT TCS PKI, which is anchored in the DFN tenant of the GÉANT TCS PKI, please follow the information below.
Click on the URL for the HARICA Certificate Manager.
Log in using SSO by clicking the “Academic Login” button and providing your institutional email address and the associated password of your home organization.
or if there are difficulties…
Register your work email address with a self-chosen password at this URL HARICA Certificate Manager Signup.
After successful registration, the dashboard will be displayed. Please click on the menu item Server on the left in the navigation and go through the application steps.
For the server certificate type, you can choose between Domain-only (DV) or For enterprises or organizations (OV).
After returning to the dashboard, the certificate application that is still waiting for processing and approval can be seen under the Pending Certificates section. Please click on the three vertical dots and select Order details. Please highlight the complete Order details information and copy and paste it as the email text into the email that is opened by clicking on this link.
After the issuance, the certificate can be downloaded in the dashboard under the section Valid Certificates by clicking on the hard drive icon with the downward arrow. In the dialog, please click once on the buttons PEM and PEM bundle.
The certificate can either be assembled using OpenSSL commands from the downloaded components or under Windows using the utility pem2p12.exe, which can be downloaded from the following HARICA page.
For further processing of this file with the file extension .p12, please refer to this section.
If you have any questions, please send an email to support@gwdg.de or use the support form of GWDG.
Call OpenSSL with the following Parameters
Simple Bash script…
openssl req -newkey rsa:4096 -sha256 -keyout priv-key.pem -out certreq.pem
chmod 744 createcsr.sh
./createcsr.sh
.
Simple PowerShell script…
openssl req -newkey rsa:4096 -sha256 -keyout priv-key.pem -out certreq.pem
Simple Batch script…
openssl req -newkey rsa:4096 -sha256 -keyout priv-key.pem -out certreq.pem
After that, proceed with the Select a Registration Authority (RA) and upload the Certificate Signing Request (CSR) file in the offered web form of your institution, that you can reach by clicking on “upload for Servers”.
Call OpenSSL with the following Parameters
Simple Bash script…
openssl req -config example.cnf -newkey rsa:4096 -sha256 -nodes -keyout example.key -out example-csr.pem
chmod 744 createcsr.sh
./createcsr.sh
.
Simple PowerShell script…
openssl req -config example.cnf -newkey rsa:4096 -sha256 -nodes -keyout example.key -out example-csr.pem
Simple Batch script…
openssl req -config example.cnf -newkey rsa:4096 -sha256 -nodes -keyout example.key -out example-csr.pem
After that, proceed with the Select a Registration Authority (RA) and upload the Certificate Signing Request (CSR) file in the offered web form of your institution, that you can reach by clicking on “upload for Servers”.
Please replace the word example with the server name and the email address noreplay@{MPG | uni-goettingen | gwdg}.de with a valid.
HOME = . RANDFILE = $ENV::HOME/.rnd #################################################################### [ req ] default_bits = 4096 default_keyfile = example.key distinguished_name = server_distinguished_name req_extensions = server_req_extensions string_mask = utf8only #################################################################### [ server_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = DE stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Niedersachsen localityName = Locality Name (eg, city) localityName_default = Goettingen organizationName = Organization Name (eg, company) organizationName_default = Max-Planck-Gesellschaft # The name of your CA subordinate RA can be found here # https://info.gwdg.de/docs/doku.php?id=de:services:it_security:pki:mpgras # and thus, replace the value PKI organizationalUnitName = Organizational Unit Name (eg, your Max-Planck-Institute) organizationalUnitName_default = PKI commonName = Common Name (eg, server FQDN or YOUR name) commonName_default = example.mpg.de emailAddress = Email Address emailAddress_default = noreply@mpg.de #################################################################### [ server_req_extensions ] subjectKeyIdentifier = hash basicConstraints = CA:FALSE keyUsage = digitalSignature, keyEncipherment subjectAltName = @alternate_names nsComment = "OpenSSL Generated Certificate" #################################################################### [ alternate_names ] DNS.1 = example-san-1.mpg.de DNS.2 = example-san-2.mpg.de
Please replace the word example with the server name and the email address noreplay@{MPG | uni-goettingen | gwdg}.de with a valid.
HOME = . RANDFILE = $ENV::HOME/.rnd #################################################################### [ req ] default_bits = 4096 default_keyfile = example.key distinguished_name = server_distinguished_name req_extensions = server_req_extensions string_mask = utf8only #################################################################### [ server_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = DE stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Niedersachsen localityName = Locality Name (eg, city) localityName_default = Goettingen organizationName = Organization Name (eg, company) organizationName_default = Georg-August-Universitaet Goettingen # Please remove the comment character for the next two lines. The name of the CA child RA # You can see https://info.gwdg.de/docs/doku.php?id=de:services:it_security:pki:uniras here and thus replace the value PKI. #organizationalUnitName = Organizational Unit Name (eg, your Institute name in the Uni-Goettingen-CA) #organizationalUnitName_default = PKI commonName = Common Name (e.g. server FQDN or YOUR name) commonName_default = example.uni-goettingen.de emailAddress = Email Address emailAddress_default = noreply@uni-goettingen.de #################################################################### [ server_req_extensions ] subjectKeyIdentifier = hash basicConstraints = CA:FALSE keyUsage = digitalSignature, keyEncipherment subjectAltName = @alternate_names nsComment = "OpenSSL Generated Certificate" #################################################################### [ alternate_names ] DNS.1 = example-san-1.uni-goettingen.de DNS.2 = example-san-2.uni-goettingen.de
Please replace the word example with the server name and the email address noreplay@{MPG | uni-goettingen | gwdg}.de with a valid.
HOME = . RANDFILE = $ENV::HOME/.rnd #################################################################### [ req ] default_bits = 4096 default_keyfile = example.key distinguished_name = server_distinguished_name req_extensions = server_req_extensions string_mask = utf8only #################################################################### [ server_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = DE stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = NIEDERSACHSEN localityName = Locality Name (eg, city) localityName_default = GOETTINGEN organizationName = Organization Name (eg, company) organizationName_default = Gesellschaft fuer wissenschaftliche Datenverarbeitung # Please remove the comment character for the next two lines. The name of the CA child RA # You can https://info.gwdg.de/docs/doku.php?id=de:services:it_security:pki:gwdgras here and replace the value PKI. #organizationalUnitName = Organizational Unit Name (eg, your Institute name in the Uni-Goettingen-CA) #organizationalUnitName_default = PKI commonName = Common Name (e.g. server FQDN or YOUR name) commonName_default = example.gwdg.de emailAddress = Email Address emailAddress_default = noreply@gwdg.de #################################################################### [ server_req_extensions ] subjectKeyIdentifier = hash basicConstraints = CA:FALSE keyUsage = digitalSignature, keyEncipherment subjectAltName = @alternate_names nsComment = "OpenSSL Generated Certificate" #################################################################### [ alternate_names ] DNS.1 = example-san-1.gwdg.de DNS.2 = example-san-2.gwdg.de
A collection of important OpenSSL commands for server certificates
openssl rsa -in example.key -out example.np.key
openssl pkcs12 -export -out example.pfx -inkey example.key -in example.pem
(currently only in German)