Requirements / preparation

• Hohenheim user account (for login via our IDP)
• Assignment of the Hohenheim user account to a facility. This only needs to be done once. Please contact us by e-mail at kim-pki@uni-hohenheim.de and tell us not only your user ID but also the subdomain that your institution uses.
• The FQDN for the server is fixed (e.g., servername.[subdomain.]uni-hohenheim.de) and registered in the DNS.
  [If not already done, please request an IP address and DNS name at kim-dns@uni-hohenheim.de.]
• The CSR of the server is requested in the form. Please prepare this.
  
  For the simple creation of a certificate request, we provide a script to guide you through the process. You can use it by logging into your Hohenheim user account on login.uni-hohenheim.de with ssh and starting the script there:
  
  user@login1:~> certificateapplication.sh

What to do

• If you meet the above requirements and have made all preparations, call up the following URL in your browser and select "University of Hohenheim - uni-hohenheim.de" under "Your Institution":
  https://cert-manager.com/customer/DFN/ssl/hoh-servercertificate
• Authenticate yourself with your Hohenheim username and the corresponding password.
• Now select in the lower area under "Select Enrollment Account" the entry "Universität Hohenheim - [institution name] (Server Certificate)" which is provided with the appropriate institution for you.
  If you are not directly in this enrollment view, but in the "Certificate List" view, please select the green button "Enroll Certificate" in the upper right corner.
• Now fill in all the required fields.
• Certificate Profile & Certificate Term should not be changed!
• You can paste the CSR under the button "Upload CSR" or via Copy & Paste in the field below.
• If you did not specify a "Subject Alternative Name" when you created the CSR and now want to, you can enter it here.
• Under "External Requesters" you can specify additional email addresses that should be informed about the creation, renewal, revocation, or deletion of the certificate. Please separate multiple entries with a comma.
• Under "Comments" please enter the type of server (e.g., web server).
• If the Auto Renew button is enabled, you can specify how many days before the certificate expires you want to request a new certificate. This option does not extend the previous certificate! As soon as we receive and approve the new application, you will receive another email in which you can download the new certificate.
• Once you submit the request via "Submit", we will review the request and respond to you.

Certificate formats

Once you have received the email from the Certificate Service Manager, you can download the certificate using the links in various formats in the email. Below you will find a brief summary of the different formats:

• as Certificate only, PEM encoded:
  Contains only the server certificate in PEM format.
• as Certificate (w/ issuer after), PEM encoded:
  Recommended for Apache/nginx
  First the server certificate, then the issuing CA certificate and then other CA certificates in the CA chain, but do not include the root CA certificate in PEM format.
• as Certificate (w/ chain), PEM encoded:
  Contains the root CA certificate, as well as the intermediate CA certificates and finally the server certificate in PEM format.
• as PKCS#7:
  Recommended for MS Windows Server with IIS
  Contains a binary PKCS#7 structure consisting of first the server certificate, then the issuing CA certificate, then other CA certificates in the CA chain, and finally the root CA certificate.
• as PKCS#7, PEM encoded:
  Contains a binary PKCS#7 structure in PEM format consisting of first the server certificate, then the issuing CA certificate, then other CA certificates in the CA chain, and finally the root CA certificate.
• as Root/Intermediate(s) only, PEM encoded:
  Contains the CA certificate chain (without the server certificate) from the root CA (first) to the issuing CA of the server certificate in PEM format.
• as Intermediate(s)/Root only, PEM encoded:
  Contains the CA certificate chain (without the server certificate) from the issuing CA of the server certificate (first) to the root CA certificate in PEM format.