TLS/SSL certificate management is the process of issuing, deploying, monitoring, renewing, and revoking digital certificates used to encrypt communications and verify the identity of websites, applications, servers, and devices. Effective certificate management helps maintain secure connections, prevent service outages caused by expired certificates, and ensure compliance with organizational security policies and industry standards.
Benefits & Features
TLS uses asymmetric cryptography for authentication of key exchange, symmetric encryption for confidentiality and message authentication codes for message integrity. Several versions of the protocols are in widespread use in applications such as web browsing, electronic mail, Internet faxing, instant messaging and voice-over-IP (VoIP).
University SSL/TLS certificates are issued through the InCommon Certificate Service, which uses CertiNext as the Certificate Authority.
- Cost Savings: Unlimited certificates for a fixed annual fee takes the guess work out of budgeting.
- Comprehensive: Includes all of your domains: .edu and non-edu alike, such as athletics and professional societies.
- Ease of Use: Through the CertiNext certificate management interface, certificates are easy to order and install.
- Automation: CertiNext offers the ability to create API credentials for certificate issuance and renewal using the Automatic Certificate Management Environment (ACME) protocol. This provides simplified certificate issuance and automatic renewal through the protocol's configuration.
Getting Started
To have an account created within CertiNext, please submit a ticket to RESP Security - Engineering - NU. Once an account has been created, you will be able to add relevant domains for validation and issue certificates for valid domains.
Frequently Asked Questions
- How do I generate a Certificate Signing Request (CSR)?
- What certificate profiles should we use?
- For certificates that do NOT use a Subject Alternative Name (SAN), the recommended option is InCommon DV SSL Certificate.
- For certificates that use a SAN, the recommended option is InCommon DV SSL Certificate UCC.
- How do I setup ACME for automatic certificate renewal?
Eligibility
All departments that manage web servers or web applications are eligible and encouraged to utilize this service.
Pricing
There is no charge for this service, which is considered a common-good service.
Requirements
Before a certificate can be issued for a web service, a domain validation record will need to be created. Domain validation records confirm the identity of the domain by checking for an existing DNS record in the environment.
Additional Information
Verification Tool
The following tool can help you manage your web sites SSL certificates.
Qualys SSL Labs
Qualys SSL Labs is a handy tool that quickly updates their web site scanner with the newest vulnerabilities.
Support
For the most efficient support experience, please submit a ticket using the request form on this page. Alternatively, contact your campus Help Center location via email, by phone, or in person.