skip to content

IT Help and Support

University Information Services
 

Create and manage a range of digital certificates for websites, code signing and other applications.

This service provides free digital certificates that you may wish to use in cases where a certificate from Let’s Encrypt wouldn’t be appropriate for your application. Other digital certificate providers are available. If you would like advice on which certificate would be best for your situation, please don’t hesitate to contact us.
 

Benefits

  • Certificates are free
  • Create your own certificates in minutes in your account at Sectigo Certificate Manager
  • Choose from a wide range of certificates including TLS/SSL, client and code signing
  • Automatic renewal and automatic renewal and installation via ACME where applicable

 

How to get an account with Sectigo Certificate Manager

To register your institution, complete the form on our self-service portal. You can also navigate to form by visiting the portal at https://uniofcam.saasiteu.com and browsing for 'Certificates: Add New Institution'.

You'll need to provide: 

  • the name of your institution
  • the top-level domains you wish to create certificates for
  • the CRSids of all IT staff who will need to create and manage certificates.

If you add a domain outside the main university domain (cam.ac.uk), you will need to prove that you control it. We'll provide you with a CNAME entry that you'll need to add to the DNS for the domain. The Certificate Manager will scan your DNS hourly looking for this entry and will approve the domain when it finds it. This process is called Domain Control Validation (DCV).

We will contact you when we have created your account.

How to manage your account

You can add new domains, and add and delete users, on your account by completing the appropriate form on the self-service portal:

You can also navigate to these forms by visiting the portal at https://uniofcam.saasiteu.com and browsing for them. Each one is prefixed with 'Certificates:'.

How to create and manage your certificates

Once we have created your account, go to Sectigo Certificate Manager, select 'Sign in with your institution' and use your Raven credentials to access your account.
 

Which certificate to use

For a website, we recommend a Jisc OV multi-domain SSL certificate. We don't recommend Jisc IGTF multi-domain SSL or Jisc EV anchor (validation only) certificates.

How to choose between EV or OV

EV stands for extended validation, while OV means organisation validation. Modern browsers make no practical distinction between these certificate types. We strongly recommend that you use OV rather than EV certificates. EV certificates will take longer to issue because someone from UIS will need to approve them.

If you still wish to use an EV certificate, we recommend a Jisc EV multi-domain SSL certificate for a subdomain of cam.ac.uk. If it's for another domain, that domain will need to go through the extended validation process if it hasn't already. The process will take several days. Contact servicedesk@uis.cam.ac.uk to arrange this, stating the domains you wish to add and why you cannot use an OV certificate for this application. To complete the process, you will need to provide additional information about the organisation for Sectigo to verify.

EV Anchor certificates

You won't need to create an EV Anchor certificate to create EV certificates if your certificate is a subdomain of cam.ac.uk. Contact servicedesk@uis.cam.ac.uk if you want to create EV certificates for domains outside the University's main domain.

Ensuring your certificate has all the SANs you need

Make sure you select a Jisc OV multi-domain SSL certificate or the corresponding EV version, if needed, when you make your request if you have multiple SANs. If you have selected another type of certificate, you'll find it won't have all the SANs you requested. If this happens, simply revoke the old certificate and request a new one.
 

How long it takes for a certificate to be issued

OV certificates should take just a few minutes. If you experience a delay, contact us and we'll investigate. EV certificates will take longer because they need to be manually approved (see How to choose between EV or OV).
 

The SSL root certificate

Sectigo will provide you with the root and intermediate (chain) certificates when your new certificate is issued. Note that this will be different than the SSL root certificate used in a previous iteration of this service.
 

Creating a Certificate Signing Request

To get your SSL/TLS certificate, you'll need to create a Certificate Signing Request (CSR). The easiest way to do this is using our camcsr.py script (hosted on Gitlab).

Here's an example:

python camcsr.py --ou="Institute for Example Studies" --nodes --force example.cam.ac.uk www.example.cam.ac.uk private.example.cam.ac.uk

The script will generate a key file and the CSR. Install the key file on your server and use the CSR to get your certificate.

You can check your CSR like this:

openssl req -text -noout -verify -in example_cam_ac_uk.csr
 

​​​​​​​Using certificates from the old certificate service

You'll still be able to download your existing certificates from the same place until they expire, and they'll continue to be valid until their expiry date. We'll contact you a month before each certificate is due to expire, so you'll have plenty of time to replace it.

 

 

UIS Service Desk

UIS Service Status

Phone padded  Service status line: (01223 7)67999
Website  Sign up for SMS/email status alerts
Website  Read major IT incident reports

UIS bITe-size bulletin

A regular newsletter aimed at the University's IT community, highlighting service and project news from UIS.

Sign up >

Latest news

University Wireless Service maintenance: Tuesday 21 September, 08:00–09:00

16 September 2021

The University Wireless Service will be undergoing essential maintenance between 08:00 and 09.00 on Tuesday 21 September while we apply a security software patch. This is a security update to ClearPass, which provides Wireless Service network access control. We're not expecting any disruption to service, but it should be...

Mailing list migrations from Mailman to Sympa

31 August 2021

We intend to migrate all remaining lists associated with colleges from Mailman to Sympa during the week commencing 13 September 2020. The current total is 1,567. How this will affect users of the mailing list management service Most mailing list subscribers shouldn't notice any difference. During the switchover, there will...

Managed Zone Service closedown and migration to Mythic Beasts

24 August 2021

The Managed Zone Service (MZS) is being shut down, and its data content migrated to a commercial provider, Mythic Beasts. There will be no interruption to the service, but MZS users in institutions will need to make arrangements to retain management access to their zones. What is changing? UIS set up the MZS many years ago...