skip to primary navigationskip to content
 

TLS server certificates

How to get TLS certificates for use within the University of Cambridge

What is TLS?

Transport Layer Security (TLS) is a way of securing Internet communications. TLS requires that the server (typically a web server) end of any communication has access to a public/private key pair and a cryptographic certificate linking these keys to the server's identity and to that of its operators. Clients (typically web browsers) need to be configured to 'trust' the entity that signed this certificate.

If the server and clients are controlled by the same people then certificates can be created locally, but in general they need to be signed by an organisation that clients are pre-configured to trust. In practice this means dealing with one of several commercial 'Certification Authorities' (CAs).

How to get a TLS certificate

Free DV certificates from Let's Encrypt

The Information Services Committee advocates the use of zero-cost certificates from Let's Encrypt, unless enhanced features or network configurations do not allow this.

Let's Encrypt was established by the Internet Security Research Group (ISRG), and is supported by organisations and companies that want a more secure web. Let's Encrypt provides free automated Domain Validation (DV) and wildcard certificates. DV certificates don't provide the same level of validation as Organization Validation (OV) and Extended Validation (EV).

OV and EV certificates from Jisc

You can also purchase OV, EV and wildcard certificates from Jisc via our online ordering system. The costs incurred will be re-charged to your institution. You'll need to provide an institutional account code when you complete your order.

Jisc's prices are as follows:

  • Organization Validation (OV) certificate for 2 years: £20
  • Extended Validation (EV) certificate for 2 years: £20
  • Wildcard certificate for 3 years: £150

 

All Certificate Authorities were required to stop issuing 2-year TLS/SSL certificates from 1 September 2020. The industry-allowed maximum validity period is now 1 year (398 days). Existing 2-year certificates will be honoured to their end date.


Further information

 Certificates and website security

 About Let's Encrypt

 How Let's Encrypt domain validation works

UIS Service Status

Phone padded  Service status line: (01223) 463085
Website  Sign up for SMS/email status alerts
Website  Read major IT incident reports

UIS bITe-size bulletin


A regular newsletter aimed at the University's IT community, highlighting service and project news from UIS.

Sign up >  |  Back issues

RSS Feed Latest news

Panopto maintenance at midnight tonight (00:00 on Thursday 8 October)

Oct 07, 2020

The Panopto Lecture Capture Cloud service will be undergoing maintenance on Thursday 8 October 2020 from 00:00 (midnight tonight) and will be unavailable for up to 3 hours.

GBN network joins up to plant protection

Sep 30, 2020

The University's data network, the Granta Backbone Network (GBN), has joined up to the plant protection provider LinesearchBeforeUDig. This will add an extra level of protection to our essential core infrastructure at this critical time for the University.

View all news