Trusted Certificate Service (TCS)

As a participant of ACOnet we have the possibility to get certificates (server, code signing and email) for free.
The service is based on a contract between Sectigo Ltd. (Roseland, NJ, USA) and GÉANT (formerly TERENA), the association of European scientific networks (the so-called NRENs), which ACOnet (the operator of the Austrian scientific network and thus provider of Graz University of Technology) has also signed.
Existing certificates from DigiCert remain valid until expiration, but if you import new certificates, you must also import the corresponding certificate from Sectigo and the associated intermediate certificate from GÉANT!

The following applies:

  • For certificates issued in this way, there are no costs for the end user.
    For Graz University of Technology, as an ACOnet participant, this applies to all servers in the domain tugraz.at; furthermore, we manage certificates for servers in the VCG.
  • Further domains would be possible in principle, but only if we also administer the domain (which we generally do not do).
  • The certificates may not be used for commercial purposes (e. g. for a webshop or similar).
  • The certificates may be used for financial transactions (e.g. transmission of credit card data for conference registrations) - but please note that this data must be processed securely and stored in encrypted form afterwards, otherwise you may be liable for damages in case of a data leak!
    We therefore strongly advise against requesting and processing credit card data without professional processing software!
  • Contractual partner is always TU Graz, so institutes do not have to sign the ACOnet additional agreement!

With the exception of e-mail certificates, all certificates are issued only upon request by IT officers; for OV multidomain SSL certificates for institutes, a web interface is available for this purpose.

Note

Encryption (e. g. HTTPS) says nothing about the security of the data itself, nor about what, for example, the recipient will do with the data (store it unencrypted, publish it, sell it, …), but only something about how the data is transferred from the client (e. g. your browser) to the server (e. g. a bank website).

And even with HTTPS, there are different levels of security that you should take care.

However, this means that there are quite a few points of attack:

  • The lock symbol says nothing - the certificate may really be valid - check the domain (e. g. tugraz.al instead of tugraz.at or tugrÉ‘z.at instead of tugraz.at) and to whom the certificate is issued!
  • The data can be manipulated on your computer (e.g. in the browser or in the operating system) even before transmission if you have caught malware:
    If your browser or graphics card shows you a different account than is then actually transmitted, you can hardly check this.
  • The transfer may not be to the correct server at all:
    The name server you are using has been manipulated and you therefore do not connect to the correct server mybank.at at all, but this server itself also has an (apparently) valid certificate (because the CA has been compromised, for example).
  • The encryption used may already have been cracked: Check whether your client supports only secure or also insecure methods.
  • The data can be manipulated after transmission:
    The bank's server has been "hacked" and your data is manipulated or …

SSL or TLS Server Certificates

Code Signing Certificates

Email Certificates

SSL or TLS Server Certificates

SSL or TLS server certificates are required, among other things, for encrypting communication with web servers (https instead of http).
In addition to simple certificates for individual servers, there are also multi-domain certificates (one certificate for several virtual servers on a common hardware), but also wildcard certificates (of the type *.institut.tugraz.at).

Due to specifications by the CA/B Forum (an association of browser manufacturers) there are 3 types of server certificates:

  1. DV certificates
  2. OV certificates
  3. EV certificates

Since EV certificates no longer offer any advantage over OV certificates in the browser display, but require significantly more effort to register, we now only support OV certificates.

In the meantime, there are no more OU entries, i.e. only the organization (TU Graz), but no more institutes are listed in the certificate. Also the city (Graz) is dropped, the province (Steiermark/Styria) will still be possible.

Ordering

Ordering of certificates is done by IT officers via https://ssl.tugraz.at/, the link given there must not be passed on, as the applications are validated automatically.

Our new provider also supports the ACME protocol (known from Let's Encrypt), if you want to use this with Certbot, please contact the TCS administrators.

In Case of Problems

If browsers do not know the root certificate, you can download it from the GÉANT homepage and install it in the client - if the "certificate chain" (server and intermediate or root certificate) is correct on the server, the server certificate should then be accepted by the client (the browser or the email program, etc.).

Smartphones

If your smartphone does not trust the root certificate, you can install this certificate by also opening the GÉANT root certificate page from your cell phone and downloading the root certificate from there. Depending on the cell phone's operating system, you may then still need to install the certificate from the SD card (and assign it to a WLAN profile, for example).

top

Code Signing Certificates

Code signing certificates must be requested via the TCS administrators, you will then receive a link to order the certificate in self service.

top

Email Certificates

As a identified member of Graz University of Technology (persons with a service/legal relationship or students), you can apply for free personal email certificates via the TCS in order to be able to sign or also encrypt e-mails via S/MIME. However, these certificates are only available for identified persons of Graz University of Technology. Furthermore, we are only allowed to issue certificates (regulated by the contract) for e-mail addresses for which we can centrally guarantee the assignment of the e-mail address ⇆ person, this only applies to addresses on the two central e-mail servers of TU Graz.
If both a student and a staff address are stored in the system, then (currently) a certificate can only be requested for the staff address.

top