This is for administrators at SUNET TCS members for the 2020- "Sectigo generation" of the SUNET TCS service.
If you are a user of SUNET TCS but not an administrator, please see SUNET TCS documentation at your organization.
The web interface changed on 2021-11-20. We have updated this document to reflect changes introduced by that, but we may have missed things. Please remind us if that is the case.
You can watch a video from Sectigo that presents what has changed:
Our SUNET instance of the Sectigo Certificate Manager is at https://cert-manager.com/customer/sunet
To access it, you need to have your organization and your admin user(s) set up. See below under "Getting access to the system".
First, check at https://sectigo.status.io/ if there are known issues with the service for the moment. You may also want to use the Subscribe function to get email (or notifications via webhook or RSS) about updates to that page.
Consider joining the TCS network at https://forum.sunet.se/s/tcs/ to get information and to be able to discuss the service with SUNET TCS and other users. Important news will also be shared, as before, using the SUNET-TCS-MEMBERS mailing list (where one function address per organization is present since your organization joined the service), but information about minor issues may be shared here, as well as tentative information before we know enough to raise it to the SUNET-TCS-MEMBERS level.
Email email@example.com after making sure that this document does not contain the answer to your question or a solution to your problem.
If instructed by SUNET TCS or this document, or if you are waiting for a certificate stuck in Applied, contact Sectigo Support using https://sectigo.com/support-ticket with your support question/problem.
Use case type "Validation Support" and case reason "Certificate Validation" for issued related to certificates (delays, problems with the contents, etc). Include the order number in the specific field for that. If the ticket is about more than one certificate, include one order number (the most important one?) in that field, and include all of the order numbers in the description.
Use case type "Technical Support" and case reason "Sectigo Certficate Manager (SCM)" for issued with SCM not related to certificates per se.
In the description, include a line at the top saying "We are a SUNET member of the GEANT TCS service, using the https://cert-manager.com/customer/sunet SCM instance."
Sectigo documentation can be found at https://support.sectigo.com/Com_KnowledgeProductPage?c=Sectigo_Certificate_Manager_SCM
Sectigo is the new vendor for TCS instead of DigiCert. We are using their Sectigo Certificate Manager (SCM) instead of DigiCert CertCentral. The rest of this section describes the most important changes you need to understand.
There is no concept of divisions in SCM as there was in DigiCert CertCentral.
In DigiCert CertCentral, there were two basic kind of users: "Administrators", who could order/approve certificates, change settings and do other admin level stuff, and "Users" who could only request certificates (but who were nevertheless authenticated by logging into CertCentral just like the Administrators).
In the SCM, there are basically only Administrator level users. In fact, the SCM does not talk about users, it talks about admins. That means that you cannot have users logging in to the SCM who can only request certificates. See below under "SSL certificates" for solutions to this.
The SCM lets you create Departments under Organizations.
Just like the Organization name is what goes into the O= of a certificate, the Department name is what goes into the OU= of a certificate. You can use Departments in two ways:
Since the summer of 2022, OU is no longer present in the certificates due to decisions within the CA/B forum.
There are three levels of admins in the SCM, all called something with RAO (Registration Authority Officer) in the name:
It is a bit more complicated than that: a RAO is connected to one or more organizations, and a DRAO to one or more departments, and there is also the possibility to only have the right for SSL certificates, client certificates and/or code signing certificates. Thus, an admin could be "RAO - SSL Certificates" and "RAO - client certificates" for Organization A, while also being "DRAO - SSL Certificates" for a department belonging to another organization.
The first admin you will get when joining with your organization will be RAO for all certificate types and for your organization.
To get access to the new system, email firstname.lastname@example.org with a subject line like "TCS2020: organization name" and tell us:
We know that Sectigo uses at least https://www.infobel.com/en/sweden and https://proff.se/ to check address and postal code, so please try to find a record there for your organization and use that address line and postal code if it is not obviously wrong (it's not likely that people will rely on the address information in your OV certificates to send you paper mail...). Also, they seem to prefer the visiting address (besöksadress) over the mailing adress (postadress) so please use the former.
If you try to use other address/postal code information you risk having your organization validation delayed. You are encouraged to include a direct link to the matching infobel/proff record in your email.
If you have not been a member of the 2015-2020 "DigiCert generation" of the service, you are still welcome to join. SUNET TCS is available to all SUNET customers without extra charge. Contact email@example.com about membership in the service. Do not send any paper documents before that.
Please note that during the spring of 2020 we are prioritizing bringing the current members over to the new service.
You must validate one or more domains before you can have certificates issued. You validate your "top domain", not internal subdomains or the name of individual servers (i.e. example.org, not www.example.org etc)
There are multiple steps in this process. This is how you add the domain example.org:
The domain validation (DCV) is valid for one year. Domains have to be revalidated to continue to issue certficates for them. To revalidate a domain, follow the same steps as above from item 5.
Note: if a domain has validation status Validated but does not show a Expires date, it needs to be validated again. Follow the same steps as above from item 5.
See below under Notifications about adding that for DCV Expiration.
If you need additional organization names (values for the O= part of a certificate), that will have to be added by a SUNET MRAO for you. Follow the same steps as for your first organization (see above under "Getting access to the system"), but instead of providing information about a "first admin", tell us the usernames for the administrators of your "main organization" that should also be RAOs for the new organization.
Note: you will not add an extra organization ("Smorgasboda Hogskola" in addition to "Smörgåsboda Högskola") for a name without non-ASCII characters for grid certificates, as that will be handled differently. We will update this document when Sectigo has provided the details.
To add a department:
You can now go on to create admins (see below) that are DRAOs connected to just this department instead of being RAOs for the whole organization.
If you add department admins (DRAOs) that can approve certificates for their department, you will most likely want to limit them to their own domain (department-example.com) or a subdomain of your main domain (department.example.org) if we imagine that your main domain is example.org.
In the first case with a completely new domain for the department, follow the normal domain validation procedure above to add department-example.com (and *.department-example.com if needed for wildcards) with delegation to the department and initiate DCV as you did for your main domain.
In the second case with a subdomain of your already validated main domain, you will still add department.example.org (and *.departement.example.org if needed for wildcards) with delegation to the department but you will not have to initiate DCV again, as the SCM is smart enough to know that example.org is already validated.
You create additional admins (RAOs for your whole organization or DRAOs for departments you have created) under the Settings → Admins tab with the button. You can also edit existing admins by clicking on the line to check them and then using the Edit button.
We strongly recommend that you create personal admin users (not shared ones), to be able to see who has done what in the system.
It has been reported that some privileges (management of peer admins, Allow DCV) cannot be assigned by one RAO to another. If that affects your organization email firstname.lastname@example.org to have it fixed manually. Tell us the usernames involved and what privileges you want to add. We'd like that email to come from an admin that already has "Allow creating/editing of peer admin users" instead of the admin who wants more privileges.
You can get locked if you fail to login a number of times. You will then get an "Incorrect login details, account is locked, password has expired or your source IP is blocked." message when you try to login, even if you use the correct password. It will be the case even if your password have been changed by another admin who can do that for you. This requires the lock to be reset and that can only be done by an MRAO, so you need to contact email@example.com.
Go to Certificates → SSL Certificates and press to request a certificate.
If your admin has the "Allow SSL auto approve" privilege selected, the certificate will be automatically approved (which makes sense, because why would you have entered all the information above if you did not want to approve the certificate?) and will show up as "Applied".
If your admin does not have that privilege selected, the certificate will show up as "Requested" and you will have to approve it by selecting it and using the Approve button.
When the certificate has been issued, its status will be shown as "Issued" and you will get an email about it.
If needed, you can also download the certificate by clicking on the line to check it and using the View button, then the download icon (arrow pointing down at a line).
Currently (2020-04-08), if you use the GÉANT OV SSL type and request a certificate for
mail.test.example.org, you will get that name put in a DNS Subject Alternative Name, but you will also get a DNS Subject Alternative Name for www.mail.test.example.org . We recommend that you use GÉANT OV Multi-Domain instead if you do not want this, as no extra www-prepended name is added for that type. This has been reported to GÉANT.
As of the autumn of 2021, SUNET TCS recommends that you do not use EV certificates. The benefits are limited and the procedure for requesting them is more complicated and prone to complications than for OV certificates.
Please do not order EV certificates or EV anchor certificates without talking to firstname.lastname@example.org first, as the procedure will not be to just to request an individual EV certificate, and you may be locked out of ordering normal OV certificates while EV validation takes place.
If you are not currently using IGTF (grid) certificates, talk to email@example.com first before starting to request them.
This has changed. Contact us if you need this functionality.
You can allow persons who are not admins in the SCM to request certificates ("enroll" in Sectigo-speak). To do that, go to Organizations and select your organization and select Edit. (Or, if this should apply only to a departement, after selecting the organization, use the Departments button, select the department, and use Edit on that instead).
Certificates issued on 2021-06-07 and later: You should be able to revoke them in SCM under Certificates → SSL Certificates, using the Revoke button with the certificate selected.
Certificates issued before 2021-06-07: You cannot revoke them in SCM. If there is a security-related reason for revoking (for example, you suspect the private key has been leaked), use the revocation portal linked below. Otherwise, we suggest that you do not revoke the certificate. You can stop notifications for a certificate in the Details dialog box, using the Suspend Notifications checkbox at the bottom.
You can use the Sectigo Certificate Revocation Portal to revoke certificates outside of the SCM, using other methods to authenticate the request.
The self-service portal is located at https://cert-manager.com/customer/sunet/idp/clientgeant
For it to work for your users, you need to
For it to work for your users who need IGTF/grid certificates, you also need to:
For the "normal" client certificates, you should not need to configure anything.
For the grid/IGTF certificates, make sure that your servers have an up-to-date IGTF Trust Anchor Distribution that includes trust for "
/C=NL/O=GEANT Vereniging/CN=GEANT eScience Personal CA 4" (for example found in the
ca_GEANTeSciencePersonalCA4-1.105-1.noarch.rpm or newer RPM package)
The instructions here are geared towards certificate-aware RAOs. You may need to expand on this when providing instructions for your end users, for example by showing them where to import certificates in your supported web browsers, etc.
This is how you get a certificate:
openssl req -new -newkey rsa:2048 -out usercert_request.pem -keyout userkey.pem -subj '/CN=Mitt Namn' chmod go= userkey.pem cat usercert_request.pem
openssl pkcs12 -export -inkey userkey.pem -in certs.pem -out certs.p12
End users cannot revoke certificates themselves in the self-service portal. Instruct them to contact you if revocation is needed. You as RAOs can revoke certificates by going to Certificates → Client Certificates, selecting the right certificate and clicking Revoke.
Note: this is a backup solution. The main way to issue client certificates is via the self-service portal discussed above. With that understood, this is how you can issue personal certificates using the SCM.
This has changed. Contact us if you need to use this.
Things worth noting:
We will update this section when a SUNET TCS member has shared the experience of using the new interface to order a Code Signing certificate.
Under Settings → Email Notifications you can add and edit what notifications the system will send you when certain conditions are met. Use the Add button to have a look at the various Notification Types that are available.
If you have a need to change the text in the emails sent from the system, you can do that under Settings → Email Templates. If you do, please report your experience with that feature (good or bad) to firstname.lastname@example.org.
SAML login is activated for the SUNET instance of SCM but you need configure the attribute manually in your Identity Provider due to that the SCM entity in metadata has no defined entity category. The reason behind this is that Sectigo has registered their Service Provider in inCommon and they can't issue the European only entity category .GÉANT Data Protection Code of Conduct.
The following single valued attributes should be released to the entityId https://cert-manager.com/shibboleth:
eduPersonEntitlement (urn:oid:220.127.116.11.4.1.5918.104.22.168.7) with the value urn:mace:terena.org:tcs:personal-user
Please note that this entitlement value must only be released for those users that fulfils the requirements for requesting personal certificates, within Sweden the requirement is SWAMID Assurance Level 2 Profile (SWAMID AL2), or higher.
SWAMID has added instruction for both Shibboleth IdP and ADFS at the page Konfigur SAML-konfiguration Sunet TCS.
After your Identity Provider administrators has configured the attribute release you should test it at https://cert-manager.com/customer/sunet/ssocheck. In this test only eduPersonPrincipalName and mail is required but for the upcoming personal certificates givenName, sn, displayName, schacHomeOrganization and eduPersonEntitlement (not displayed in the test right now) will be required. To further dig down and test you can look at https://cert-manager.com/Shibboleth.sso/Session after a login to see what attributes was released from your Identity Provider and recognised by Sectigo.
When you have verified that your IdP is correctly configured, you can go on to configure use of SAML authentication:
Sectigo REST API documentation can be found at https://support.sectigo.com/Com_KnowledgeProductPage?c=Sectigo_Certificate_Manager_SCM in the "SCM - Sectigo Certificate Manager REST API" document.
Authentication is via login name and password for a RAO or DRAO admin. The
customerUri is "sunet".
We recommend that your create separate RAO or DRAO admins to use with the API instead of reusing the same admins as for web UI work. To create an API-only admin:
More gotchas we have discovered, so you do not have to discover them too:
"serverType": -1in their certificate enroll example refers to the "other" Server Software type, so if you have removed that when cleaning up useless Server Software types, that example will not work.
As inspiration for API use, Fredrik Domeij at UmU has provided bash scripts to request and retrieve certificates. You find them as umu-example-api-bash.tar.
There is support for ACME and some of the test members have started to try that. We will update this section as we get feedback.
Some of you may have noticed that the chain certificates we got from Sectigo until the beginning of May 2020 contains a certificate at the top with
CN = AddTrust External CA Root and an expiration on 2020-05-30. For an explanation of why this should not cause problems for you, please see "Sectigo AddTrust External CA Root Expiring May 30, 2020" on the Sectigo site.
You may also notice that the next level down in the chain is
CN = USERTrust RSA Certification Authority which also expires on 2020-05-30, and that is the certificate that has signed the
CN = GEANT OV RSA CA 4 certificate that in turn has signed the SSL certificate for your server. That also seems bad, doesn't it? It turns out that certificate is there to support the CN = AddTrust External CA Root "feature" and that there is another version of
CN = USERTrust RSA Certification Authority present in the root store of the browsers (using the same key) which is valid until 2038-01-18, and that is the one that matters and makes the browser trust the GEANT-branded CA certificate and therefore your server certificate.
The conclusion is that things will work after 2020-05-30 too.
2020-06-02: There are reports from other NRENs that some TLS-inspecting software/boxes take exception to the expired certificates present in this chain. There is also reports of non-browser clients not working. To get an idea of what may break, you can have a look at documentation from Carnegie Mellon University on what has been affected (as they use Sectigo via InCommon).
If this affects you, update the chain to only include the GEANT CA certificate as described below.
Starting at the beginning of May 2020, the chain we get from Sectigo instead contains the root certificate with
CN = AAA Certificate Services expiring at the end of 2028, and the next level is
CN = USERTrust RSA Certification Authority with the same expiry date.
This is their new workaround for legacy environments. It should not cause problems for modern browsers/operating systems, but we have got reports where including this caused problems for some users. If you do not need the compatibility with old legacy systems provided by this chain, send only the GEANT-branded sub-CA certificate (see below).
No. You should be fine with only the GEANT-branded sub-CA certificate (CN = GEANT OV RSA CA 4 or similar) configured as chain certificate in your server. That CA certificate is signed by a version of
CN= USERTrust RSA Certification Authority that is present in modern browser/OS trust stores and similar.
We recommend Qualys SSL Server Test which tests this and and a lot of other useful things (most of them related to you server configuration, not the certificates as such). For the chain specifically, look at the "Chain issues" heading where you want to see "None" (if you have trimmed the unnecessary certificates from the chain) or "Contains anchor" (if you have kept the full set).
You can check at https://sectigo.status.io/ and there is also a Subscribe button there that you can use to get updates via email, webhook or RSS.