How Can I Request a Code-Signing Certificate?

1. Send your request to idmgmt@cornell.edu. Specify the contact email address you would like to appear in your certificate.
2. The cost of the code signing certificate is $300 each. We’ll provide the payment details and instructions via email.

 3. After installing your code signing certificate, you may need to export the certificate for use on a different computer, for signing code, etc.

• Windows: export it with certmgr. Run certmgr.msc, Go to: Personal → Certificates. Find your code-signing certificate, right-click the certificate → All Tasks → Export. Select: Yes, export the private key. Select: PKCS #12 (.PFX). Enable: Include all certificates in the certification path. Set a strong password to protect the PFX file. Save the .pfx file.
• MacOS: Different versions of Firefox behave differently. Use Google to search for the instructions for exporting the certificate in Firefox for your browser version. When exporting a certificate in Firefox, you may see a list of formats to choose. Select pkcs#7 format, to export the certificate with a private key. 

Can I Get a Certificate for a Host in a Non-Cornell Domain?

Yes - as long as Cornell owns the domain. Send your request to idmgmt@cornell.edu.
To ensure the university’s compliance with the InCommon agreement, requests for certificates outside of cornell.edu domains are subject to extra vetting and approval, by both the university and InCommon.

To begin your request, send an email to idmgmt@cornell.edu requesting the domain to be added, and IDM SSL admin will initiate the process of validating your domain with InCommon. After the domain is validated, you can then request a certificate for a host in that domain through the normal channel.

What is a Multi-Domain SSL Certificate?

A multi-domain certificate allows you to secure a primary domain, and up to 99 additional fully qualified domains, in a single certificate. It is best for organizations that have multiple unique domains hosted on a single server.

• The domains included in multi-domain certificate do not have to have unique IPs.
• It must be reissued each time you want to add a new host/domain name to the certificate.

When generating a CSR for multiple domain certificate, enter the primary domain name in common name field. In SSL request form’s Subject Alternative Names field, enter the rest of the domain names that you want included in the certificate.

What is a Wildcard Certificate?

Wildcard Certificates are a security risk.

Use of wildcard certificates is strongly discouraged for most use cases. If possible, try to make use of other certificate types such as multi-domain certificates. When you deploy a wildcard certificate and private key across multiple websites and servers, a single site compromise will result in the compromise of the entire sub domain. Also note that not all applications are compatible with wildcard certificates. In particular, many mobile applications will not work with wildcards.

Wildcard Certificates secure multiple subdomains with a single SSL Certificate. For example, if you want to secure www.entrust.com, secure.entrust.com, and support.entrust.com, you can use a wildcard certificate to secure all 3 sub domains under *.entrust.com.

There is a limitation on the way wildcard certificates work. This goes across the board for all Certificate Authorities. Wildcard certificates only support one level up in the fully qualified domain name.

For example, if we create a certificate for the common name of *.test.entrust.com,

• https://www.test.entrust.com/ will work
• https://www.shop.test.entrust.com/ will not work
• https://test.entrust.com will not work either.

When generating a Certificate Signing Request (CSR) for a Wildcard certificate, add an asterisk (*) to the left of the Common Name where you want to specify the wildcard.