PKI

Below you will find instructions on how to request certificates with popular web browsers as well as instructions for the use of this certificates. The instructions for certification shall relate to e-mail (S / MIME) certificates. However, the requirement of other types of certificates is designed largely similar. If you have suggestions for further instructions or additional questions, you can send an e-mail to support@gwdg.de or use the GWDG support form.

In the future, you will receive new certificates via the GÉANT TCS. For information on specific application procedures, please contact your local participant service of your institution. For user certificates for signing and/or optional encryption of e-mails, the application method is the GÉANT TCS PKI in most cases the right way. In cooperation with your local participant service employee of your institution or RA, you create a user certificate. Further information can also be found in the information provided under “Detailed description of email encryption with X.509 certificates” GWDG news articles available to you.

To apply for an e-mail certificate from the GÉANT TCS PKI, which is anchored in the client of the DFN of the GÉANT TCS PKI, please click on the PDF instructions below.

If you have any questions, please send an e-mail to support@gwdg.de or use the GWDG support form.

For further steps and detailed instructions on how to install and use the certificate (the file with the file extension .p12 in the download directory of the web browser used) in different e-mail clients, please read the following documents.

To request ACME External Account Binding Information for server certificates from the GÉANT TCS PKI, which is anchored in the client of the DFN of the GÉANT TCS PKI, send an e-mail to support@gwdg.de or use the Support form of the GWDG.

Simple Bash script…

createcsr.sh

openssl req -newkey rsa:4096 -sha256 -keyout priv-key.pem -out certreq.pem

• Download createscr.sh script.
• Change flags with

  chmod 744 createcsr.sh

• Run script as follows

  ./createcsr.sh

  .

Simple PowerShell script…

createcsr.ps1

openssl req -newkey rsa:4096 -sha256 -keyout priv-key.pem -out certreq.pem

Simple Batch script…

createcsr.bat

openssl req -newkey rsa:4096 -sha256 -keyout priv-key.pem -out certreq.pem

After that, proceed with the Select a Registration Authority (RA) and upload the Certificate Signing Request (CSR) file in the offered web form of your institution, that you can reach by clicking on “upload for Servers”.

Simple Bash script…

createcsr.sh

openssl req -config example.cnf -newkey rsa:4096 -sha256 -nodes -keyout example.key -out example-csr.pem

• Download createscr.sh script.
• Change flags with

  chmod 744 createcsr.sh

• Run script as follows

  ./createcsr.sh

  .

Simple PowerShell script…

createcsr.ps1

openssl req -config example.cnf -newkey rsa:4096 -sha256 -nodes -keyout example.key -out example-csr.pem

Simple Batch script…

createcsr.bat

openssl req -config example.cnf -newkey rsa:4096 -sha256 -nodes -keyout example.key -out example-csr.pem

After that, proceed with the Select a Registration Authority (RA) and upload the Certificate Signing Request (CSR) file in the offered web form of your institution, that you can reach by clicking on “upload for Servers”.

Please replace the word example with the server name and the email address noreplay@{MPG | uni-goettingen | gwdg}.de with a valid.

example.cnf

HOME            = .
RANDFILE        = $ENV::HOME/.rnd
 
####################################################################
[ req ]
default_bits        = 4096
default_keyfile     = example.key
distinguished_name  = server_distinguished_name
req_extensions      = server_req_extensions
string_mask         = utf8only
 
####################################################################
[ server_distinguished_name ]
countryName         = Country Name (2 letter code)
countryName_default     = DE
 
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = Niedersachsen
 
localityName            = Locality Name (eg, city)
localityName_default        = Goettingen
 
organizationName            = Organization Name (eg, company)
organizationName_default    = Max-Planck-Gesellschaft
 
# The name of your CA subordinate RA can be found here 
# https://info.gwdg.de/docs/doku.php?id=de:services:it_security:pki:mpgras
# and thus, replace the value PKI
organizationalUnitName	= Organizational Unit Name (eg, your Max-Planck-Institute)
organizationalUnitName_default	= PKI
 
commonName          = Common Name (eg, server FQDN or YOUR name)
commonName_default      = example.mpg.de
 
emailAddress            = Email Address
emailAddress_default        = noreply@mpg.de
 
####################################################################
[ server_req_extensions ]
 
subjectKeyIdentifier        = hash
basicConstraints        = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment
subjectAltName          = @alternate_names
nsComment           = "OpenSSL Generated Certificate"
 
####################################################################
[ alternate_names ]
 
DNS.1       = example-san-1.mpg.de
DNS.2       = example-san-2.mpg.de

Please replace the word example with the server name and the email address noreplay@{MPG | uni-goettingen | gwdg}.de with a valid.

example.cnf

HOME            = .
RANDFILE        = $ENV::HOME/.rnd
 
####################################################################
[ req ]
default_bits        = 4096
default_keyfile     = example.key
distinguished_name  = server_distinguished_name
req_extensions      = server_req_extensions
string_mask         = utf8only
 
####################################################################
[ server_distinguished_name ]
countryName         = Country Name (2 letter code)
countryName_default     = DE
 
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = Niedersachsen
 
localityName            = Locality Name (eg, city)
localityName_default        = Goettingen
 
organizationName            = Organization Name (eg, company)
organizationName_default    = Georg-August-Universitaet Goettingen
 
# Please remove the comment character for the next two lines. The name of the CA child RA 
# You can see https://info.gwdg.de/docs/doku.php?id=de:services:it_security:pki:uniras here and thus replace the value PKI.
#organizationalUnitName = Organizational Unit Name (eg, your Institute name in the Uni-Goettingen-CA)
#organizationalUnitName_default = PKI
 
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = example.uni-goettingen.de
 
emailAddress            = Email Address
emailAddress_default        = noreply@uni-goettingen.de
 
####################################################################
[ server_req_extensions ]
 
subjectKeyIdentifier        = hash
basicConstraints        = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment
subjectAltName          = @alternate_names
nsComment           = "OpenSSL Generated Certificate"
 
####################################################################
[ alternate_names ]
 
DNS.1       = example-san-1.uni-goettingen.de
DNS.2       = example-san-2.uni-goettingen.de

Please replace the word example with the server name and the email address noreplay@{MPG | uni-goettingen | gwdg}.de with a valid.

example.cnf

HOME            = .
RANDFILE        = $ENV::HOME/.rnd
 
####################################################################
[ req ]
default_bits        = 4096
default_keyfile     = example.key
distinguished_name  = server_distinguished_name
req_extensions      = server_req_extensions
string_mask         = utf8only
 
####################################################################
[ server_distinguished_name ]
countryName         = Country Name (2 letter code)
countryName_default     = DE
 
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = NIEDERSACHSEN
 
localityName            = Locality Name (eg, city)
localityName_default        = GOETTINGEN
 
organizationName            = Organization Name (eg, company)
organizationName_default    = Gesellschaft fuer wissenschaftliche Datenverarbeitung
 
# Please remove the comment character for the next two lines. The name of the CA child RA 
# You can https://info.gwdg.de/docs/doku.php?id=de:services:it_security:pki:gwdgras here and replace the value PKI.
#organizationalUnitName = Organizational Unit Name (eg, your Institute name in the Uni-Goettingen-CA)
#organizationalUnitName_default = PKI
 
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = example.gwdg.de
 
emailAddress            = Email Address
emailAddress_default        = noreply@gwdg.de
 
####################################################################
[ server_req_extensions ]
 
subjectKeyIdentifier        = hash
basicConstraints        = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment
subjectAltName          = @alternate_names
nsComment           = "OpenSSL Generated Certificate"
 
####################################################################
[ alternate_names ]
 
DNS.1       = example-san-1.gwdg.de
DNS.2       = example-san-2.gwdg.de

A collection of important OpenSSL commands for server certificates

openssl rsa -in example.key -out example.np.key

openssl pkcs12 -export -out example.pfx -inkey example.key -in example.pem