IT Services provides free SSL (X.509) digital certificates via the InCommon Certificate Service.

SSL Certificates

IT Services offers SSL certificates for any host in the uchicago.edu domain (e.g., its.uchicago.edu), its subdomains (e.g., its.example.uchicago.edu), or, by prior arrangement, any domain outside uchicago.edu that is affiliated with and controlled by the University. Certificates are signed and issued by Sectigo, a leading Certificate Authority recognized by all prominent web browsers and email applications.

What is an SSL certificate?

Secure Sockets Layer (SSL) is a protocol that provides secure communication on the internet for web browsing, email, and other data transfers. E-commerce transactions and CNetID authentication are two examples of data transactions that require SSL encryption per University policy.

X.509 is a standard for identification and secured data exchange using modern digital cryptography. An X.509 certificate can identify any person, object, or information. An SSL certificate is a specialized type of X.509 certificate used for identifying servers and securing data using SSL. An SSL certificate is issued for a specific Internet hostname such as www.uchicago.edu.

An SSL certificate that is signed by a valid certificate authority:

• verifies the identity of the server to the client (i.e., the client is connecting to the real domain, for example, uchicago.edu),
• is used to encrypt data in both directions between the client and the server, and
• can be used to verify the identity of the client, though this is uncommon.

What types of SSL certificates are available?

• Single Domain SSL
• Mutiple Domain SSL: Known as Subject Alternative Name or SAN certificates. Allows up to 100 hostnames on a single certificate.
• Wildcard SSL: Requestor must meet additional requirements beyond that of a Single Domain SSL certification.
• Single Domain Domain IGTF: Inter-operable Global Trust Federation (IGTF) certification is single purposed use for grid computing.
• Multiple Domain IGTF: Inter-operable Global Trust Federation (IGTF) certification is single purposed use for grid computing. Allows up to 100 hostnames on a single certificate.

What domain names are eligible for use with InCommon SSL certificates?

Any domain name (including non-.edu domains) that is administered by the University of Chicago is eligible. Please see the related article Validate a Domain Name for Use with InCommon Certificate Service for details.

What are the supported browsers, devices, and application suites?

Please see the InCommon documentation on supported browsers, devices, and application suites.

How to Request and Use an SSL Certificate

Request an SSL Certificate

Please see the relevant Knowledge Base (KB) articles for the type of certificate you want to request:

• Request a Single or Multi-Domain Server SSL Certificate
• Request a Wildcard Server SSL Certificate

Install the Signed SSL Certificate and the CA Chain

Please see the KB article Install and Use a Server SSL Certificate.

Delegation of SSL Certificate Authority

IT Services can optionally delegate certificate-signing authority to interested departments or other organizational units that want to manage their own SSL certificates. Delegated certificate authority uses the existing InCommon infrastructure so it is simple to use and free. To learn more about this option please see Become a Department Authority for Approving SSL Certificates.

Support

If you have questions that are not answered on this page please email certs@uchicago.edu.