Trusted Certificate Service (TCS)

As a participant of ACOnet we have the possibility to get certificates (server, code signing and email) for free.
The service is based on a contract between the respective provider (CA) and GÉANT (formerly TERENA), the association of European scientific networks (the so-called NRENs), which ACOnet (the operator of the Austrian scientific network and thus provider of Graz University of Technology) has also signed.
If the provider changes, existing certificates remain valid until they expire, but if you import new certificates, you must also import the corresponding certificate from the new provider and the corresponding intermediate certificate from GÉANT!

The following applies:

  • For certificates issued in this way, there are no costs for the end user.
    For Graz University of Technology, as an ACOnet participant, this applies to all servers in the domain tugraz.at; furthermore, we manage certificates for servers in the VCG.
  • Further domains would be possible in principle, but only if we also administer the domain (which we generally do not do).
  • The certificates may not be used for commercial purposes (e. g. for a webshop or similar).
  • The certificates may be used for financial transactions (e.g. transmission of credit card data for conference registrations) - but please note that this data must be processed securely and stored in encrypted form afterwards, otherwise you may be liable for damages in case of a data leak!
    We therefore strongly advise against requesting and processing credit card data without professional processing software!
  • Contractual partner is always TU Graz, so institutes do not have to sign the ACOnet additional agreement!

Note

Encryption (e. g. HTTPS) says nothing about the security of the data itself, nor about what, for example, the recipient will do with the data (store it unencrypted, publish it, sell it, …), but only something about how the data is transferred from the client (e. g. your browser) to the server (e. g. a bank website).

And even with HTTPS, there are different levels of security that you should take care.

However, this means that there are quite a few points of attack:

  • The lock symbol says nothing - the certificate may really be valid - check the domain (e. g. tugraz.al instead of tugraz.at or tugrÉ‘z.at instead of tugraz.at) and to whom the certificate is issued!
  • The data can be manipulated on your computer (e.g. in the browser or in the operating system) even before transmission if you have caught malware:
    If your browser or graphics card shows you a different account than is then actually transmitted, you can hardly check this.
  • The transfer may not be to the correct server at all:
    The name server you are using has been manipulated and you therefore do not connect to the correct server mybank.at at all, but this server itself also has an (apparently) valid certificate (because the CA has been compromised, for example).
  • The encryption used may already have been cracked: Check whether your client supports only secure or also insecure methods.
  • The data can be manipulated after transmission:
    The bank's server has been "hacked" and your data is manipulated or …