As a participant of ACOnet we have the possibility to get certificates (server, code signing and email) for free.
SSL or TLS server certificates are required, among other things, for encrypting communication with web servers (https instead of http).
In addition to simple certificates for individual servers, there are also multi-domain certificates (one certificate for several virtual servers on a common hardware), but also wildcard certificates (of the type *.institut.tugraz.at).
Due to specifications by the CA/B Forum (an association of browser manufacturers) there are 3 types of server certificates:
Since EV certificates no longer offer any advantage over OV certificates in the browser display, but require significantly more effort to register, we now only support OV certificates.
Since 2022 there are no more OU entries, i.e. only the organization (Graz University of Technology), but no more institutes are listed in the certificate. Also the city (Graz) is dropped, the province (Styria) is still possible.
Since certificate validity periods will be gradually shortened over the next few months, we strongly recommend using the ACME protocol; you can find more information at https://ssl.tugraz.at/.
If this is not yet possible, you can continue to request certificates manually.
If browsers do not know the root certificate, you can download it from the GÉANT homepage and install it in the client - if the "certificate chain" (server and intermediate or root certificate) is correct on the server, the server certificate should then be accepted by the client (the browser or the email program, etc.).
Code signing certificates are only available for HSM and we only issue OV certificates.
As a identified member of Graz University of Technology (persons with a service/legal relationship or students), you can apply for free personal email certificates via the TCS in order to be able to sign or also encrypt emails via S/MIME. However, these certificates are only available for identified persons of Graz University of Technology.
Furthermore, we are only allowed to issue certificates (regulated by the contract) for email addresses for which we can centrally guarantee the assignment of the email address ⇆ person, this only applies to addresses on the two central email servers of TU Graz.
If both a student and a staff address are stored in the system, then (currently) a certificate can only be requested for the staff address.
