PKI

Below you will find instructions on how to request certificates with popular web browsers as well as instructions for the use of this certificates. The instructions for certification shall relate to e-mail (S / MIME) certificates. However, the requirement of other types of certificates is designed largely similar. If you have suggestions for further instructions or additional questions, you can send an e-mail to support@gwdg.de or use the GWDG support form.

Request your personal email certificate using a Web browser.

The home page of the browser memory is displayed. Please click on the link “Certificates”

If a Browser Soeicher has not yet been created for this web browser, a password must be entered to protect the browser's memory. Clicking on the “Submit” button displays the existing Broweser memory.

Once the browser memory has been created, the browser memory is displayed after entering the previously assigned password and clicking on the “Submit” button.

In the browser store, issued certificates can be managed or new ones can be applied for.

With the link “Show certificate application” a new user certificate is requested and submitted with the click on the “Submit” button.

By clicking on “View Certificate Request” open the PDF file in a PDF program, print it out and sign it by hand.

With the application you signed, please go to the responsible RA operator in your institute.

For personal identification, please have your valid ID.

After personal identification and verification of the certificate application, the responsible RA operator will issue your certificate application.

You will receive an e-mail with your certificate attached after your personal e-mail certificate has been issued.

Three steps to the application:

1.

2.

3.

At the end of the application, please download the generated PDF file.

Please the printed certificate request under slices by hand.

With the application signed by you please go to the relevant RA operator in your institution.

Hold your valid identity card for personal identification.

After the carried out personal identification and verification of the certificate request the competent RA operator will issue your certificate request.

You will receive an email to your personal email certificate with your certificate in the annex.

Call OpenSSL with the following Parameters

Simple Bash script…

createcsr.sh

openssl req -newkey rsa:2048 -sha256 -keyout priv-key.pem -out certreq.pem

• Download createscr.sh script.
• Change flags with

  chmod 744 createcsr.sh

• Run script as follows

  ./createcsr.sh

  .

Simple PowerShell script…

createcsr.ps1

openssl req -newkey rsa:2048 -sha256 -keyout priv-key.pem -out certreq.pem

Simple Batch script…

createcsr.bat

openssl req -newkey rsa:2048 -sha256 -keyout priv-key.pem -out certreq.pem

After that, proceed with the Select a Registration Authority (RA) and upload the Certificate Signing Request (CSR) file in the offered web form of your institution, that you can reach by clicking on “upload for Servers”.

Call OpenSSL with the following Parameters

Simple Bash script…

createcsr.sh

openssl req -config example.cnf -newkey rsa:2048 -sha256 -nodes -keyout example.key -out example-csr.pem

• Download createscr.sh script.
• Change flags with

  chmod 744 createcsr.sh

• Run script as follows

  ./createcsr.sh

  .

Simple PowerShell script…

createcsr.ps1

openssl req -config example.cnf -newkey rsa:2048 -sha256 -nodes -keyout example.key -out example-csr.pem

Simple Batch script…

createcsr.bat

openssl req -config example.cnf -newkey rsa:2048 -sha256 -nodes -keyout example.key -out example-csr.pem

After that, proceed with the Select a Registration Authority (RA) and upload the Certificate Signing Request (CSR) file in the offered web form of your institution, that you can reach by clicking on “upload for Servers”.

Please replace the word example with the server name and the email address noreplay@{MPG | uni-giettingen | gwdg}.de with a valid.

example.cnf

HOME            = .
RANDFILE        = $ENV::HOME/.rnd
 
####################################################################
[ req ]
default_bits        = 2048
default_keyfile     = example.key
distinguished_name  = server_distinguished_name
req_extensions      = server_req_extensions
string_mask         = utf8only
 
####################################################################
[ server_distinguished_name ]
countryName         = Country Name (2 letter code)
countryName_default     = DE
 
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = Niedersachsen
 
localityName            = Locality Name (eg, city)
localityName_default        = Goettingen
 
organizationName            = Organization Name (eg, company)
organizationName_default    = Max-Planck-Gesellschaft
 
organizationalUnitName	= Organizational Unit Name (eg, your Max-Planck-Institute)
organizationalUnitName_default	= PKI
 
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = example.mpg.de
 
emailAddress            = Email Address
emailAddress_default        = noreply@mpg.de
 
####################################################################
[ server_req_extensions ]
 
subjectKeyIdentifier        = hash
basicConstraints        = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment
subjectAltName          = @alternate_names
nsComment           = "OpenSSL Generated Certificate"
 
####################################################################
[ alternate_names ]
 
DNS.1       = example-san-1.mpg.de
DNS.2       = example-san-2.mpg.de

Please replace the word example with the server name and the email address noreplay@{MPG | uni-giettingen | gwdg}.de with a valid.

example.cnf

HOME            = .
RANDFILE        = $ENV::HOME/.rnd
 
####################################################################
[ req ]
default_bits        = 2048
default_keyfile     = example.key
distinguished_name  = server_distinguished_name
req_extensions      = server_req_extensions
string_mask         = utf8only
 
####################################################################
[ server_distinguished_name ]
countryName         = Country Name (2 letter code)
countryName_default     = DE
 
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = Niedersachsen
 
localityName            = Locality Name (eg, city)
localityName_default        = Goettingen
 
organizationName            = Organization Name (eg, company)
organizationName_default    = Georg-August-Universitaet Goettingen
 
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = example.uni-goettingen.de
 
emailAddress            = Email Address
emailAddress_default        = noreply@uni-goettingen.de
 
####################################################################
[ server_req_extensions ]
 
subjectKeyIdentifier        = hash
basicConstraints        = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment
subjectAltName          = @alternate_names
nsComment           = "OpenSSL Generated Certificate"
 
####################################################################
[ alternate_names ]
 
DNS.1       = example-san-1.uni-goettingen.de
DNS.2       = example-san-2.uni-goettingen.de

Please replace the word example with the server name and the email address noreplay@{MPG | uni-giettingen | gwdg}.de with a valid.

example.cnf

HOME            = .
RANDFILE        = $ENV::HOME/.rnd
 
####################################################################
[ req ]
default_bits        = 2048
default_keyfile     = example.key
distinguished_name  = server_distinguished_name
req_extensions      = server_req_extensions
string_mask         = utf8only
 
####################################################################
[ server_distinguished_name ]
countryName         = Country Name (2 letter code)
countryName_default     = DE
 
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = NIEDERSACHSEN
 
localityName            = Locality Name (eg, city)
localityName_default        = GOETTINGEN
 
organizationName            = Organization Name (eg, company)
organizationName_default    = Gesellschaft fuer wissenschaftliche Datenverarbeitung
 
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_default      = example.gwdg.de
 
emailAddress            = Email Address
emailAddress_default        = noreply@gwdg.de
 
####################################################################
[ server_req_extensions ]
 
subjectKeyIdentifier        = hash
basicConstraints        = CA:FALSE
keyUsage            = digitalSignature, keyEncipherment
subjectAltName          = @alternate_names
nsComment           = "OpenSSL Generated Certificate"
 
####################################################################
[ alternate_names ]
 
DNS.1       = example-san-1.gwdg.de
DNS.2       = example-san-2.gwdg.de

A collection of important OpenSSL commands for server certificates

openssl rsa -in example.key -out example.np.key

openssl pkcs12 -export -out example.pfx -inkey example.key -in example.pem