Requesting a grid certificate using the Sectigo SSO Portal

From SNIC Documentation

Jump to: navigation, search

Contents

Preparations

Two requirements needs to be fulfilled in order to be able to request a grid (aka eScience) certificate:

Requesting a certificate

You request a certificate at https://cert-manager.com/customer/sunet/idp/clientgeant where you will be required to login with your local credentials at your organization.

If you login and you organization is set up correctly, you will get to a page with the heading Digital Certificate Enrollment.

A common error for first-time users is your identity not fullfilling the requirements for requesting personal certificates, see #Preparations above.

To proceed, you will need to choose if the key for your certificate should be generated by you on your computer, or at the server side. The different methods are described in the two following sections.

Requesting a certificate with server-side generation of key

Use this method:

To use this method, login to https://cert-manager.com/customer/sunet/idp/clientgeant and

After a short pause, you will be offered to download your certificate and key in a PKCS#12 file called certs.p12.

Requesting a certificate using a locally generated key and CSR

Use this method:

To use this method, first generate a key and a CSR (certificate signing request) on your computer. If you are not required to use another program, use OpenSSL:

openssl req -new -newkey rsa:4096 -out usercert_request.pem -keyout userkey.pem -subj '/CN=Mitt Namn'
chmod go= userkey.pem

Then, after logging in to https://cert-manager.com/customer/sunet/idp/clientgeant

After a short pause, you will be offered to download your certificate in a PEM-format file called certs.pem.

Hitting the maximum number of valid certs

If you get the error message "Sectigo Certificate Manager enrollment request failed. Please contact your security administrator." when you have clicked the SUBMIT button and accepted the click-through license, it may be because you have hit the limit of two valid certificates per identity and certificate profile. Ask your local certificate administrators at your organization to revoke one of your existing certificates. If you cannot reach them and it is urgent, contact tcs@sunet.se and provide the details of the certificate you want revoked.

2020-04-27 This behaviour will also be reported as a bug to Sectigo to ask them to handle this in a smoother way.

Using the certificate

Using the certificate in the web browser

If you had the key generated server-side and got a certs.p12 file back, you are ready to import it into your web browser. If you uploaded a CSR and got cert.pem back, you first need to create a PKCS#12 file yourself by doing:

openssl pkcs12 -export -inkey userkey.pem -in certs.pem -out certs.p12

To import the certs.p12 file into your web browser:

Using the certificate with grid tools

If you had the key generated server-side and got a certs.p12 file back, you can follow the instructions at Preparing a client certificate.

If you uploaded a CSR and got certs.pem back, you can do it in one of two ways. The first one:

The other more direct alternative:

FIXME: This section needs testing, feedback and updates from people using grid tools and/or staff directly supporting those users

Revoking a certificate

Currrently, you cannot revoke your certificate from the portal. If you need you certificate revoked, please talk to your local certificate administrators at your organization. If you cannot reach them and it is urgent, contact tcs@sunet.se and provide the details of the certificate you want revoked.

Appendix

Organization Support

The TCS service has changed backend provider from DigiCert to Sectigo.

This section documents organizations known to have done all the setup required to enable this for their users:

Failed verification

Instructions aimed at your local organization's TCS and IdP administrators are found at here and they are welcome to contact tcs@sunet.se to get help with the setup.

Personal tools
Namespaces
Variants
Actions
People
For Staff
Toolbox