What do I do if my certificate is compromised?

Are There Any Fees and/or Billing for SSL?

There is no cost to Cornell departments for SSL Server Certificates.

Where can I download the certificate CA?

To trust the certificate when your client connects to the server, some clients, such as LDAP, appSMPT clients, may require you to import the certificate chain into the client’s certificate store. You can find the certificate chains on the InCommon website:

https://spaces.at.internet2.edu/spaces/CERTSVC/pages/394592634/InCommon+Intermediate+CAs

The certificate chain varies depending on the key type and certificate type. We recommend importing the chains for the following four combinations:

• Org-Validated with RSA key
• Org-Validated with ECC key
• Domain-Validated with RSA key
• Domain-Validated with ECC key

If you cannot import all four certificate chains, please contact the service owner to determine which chain was used to issue the server certificate.

Can I see a list of the certificates issues to me?

For a list of certificates issued to you, contact the IT Service Desk.

We can send the list for any date range you specify, so be sure to include that information. Please allow 2-3 business days to receive this report.

What are my responsibilities?

• When you create the Certificate Signing Request (CSR), a private key and pass phrase are generated. Make a backup of this private key and choose a pass phrase you will remember.
• You must contact the IT Service Desk to revoke a certificate if:
  • The server is compromised
  • The private key is compromised or lost
  • Your pass phrase is compromised or lost
• Certificates are issued for 199 days. You are responsible for taking action upon receipt of a renewal notification.

How do I verify the SSL installation?

Use the SSL Analyzer tool. Fill in Server Hostname partway down the page, then click Check SSL.

How do I install my certificate on Apache with mod_ssl?

1. Follow the link in the email to download the certificate file. The downloaded file is a ZIP archive. After unzipping it, you will find the certificate with full chain, the server certificate, the intermediate certificates, and the root certificate.
2. In your Apache configuration, set SSLCertificateFile to point to the certificate file containing the full certificate chain.