Getting SSL/TLS - Revision history

Milanmeu at 11:04, 28 September 2025

2025-09-28T11:04:20Z

← Older revision		Revision as of 13:04, 28 September 2025
Line 1:		Line 1:
	ULYSSIS does not sell or offer any other SSL certificates than our self-signed certificate. We will however ~~guide requests and install a certificate from the KU Leuven if you are eligible for one, and~~ we will ~~also~~ install certificates you have bought or obtained elsewhere.		ULYSSIS does not sell or offer any other SSL certificates than our self-signed certificate. We will however we will install certificates you have bought or obtained elsewhere.

	~~==Requesting SSL from the KU Leuven==~~

	The KU Leuven partners with other universities through TERENA/Géant to arrange certificates for its services, organisations and academic structures. We have permission to request free SSL/TLS certificates for student unions (kringen) recognized by LOKO or faculty consultative bodies (facultaire overlegorganen) recognized by Studentenraad KU Leuven as well as organisations (vrije verenigingen) recognized by LOKO or KU Leuven. We are not eligible to request SSL/TLS certificates for individuals with a personal account, nor research groups or staff associations. We suggest those latter groups request certificates from KU Leuven ICTS directly or consider Let's Encrypt or another third party service.

	~~Before sending us a request, the following steps have to be performed:~~
	* Set up the site that needs SSL if that's not already the case
	* Make sure our nameservers are being used for the involved domain(s), as explained on [[Adding domain names]]
	* Consider all subdomains (whether separate websites or not) you wish to have certificates for
	* Make a list of all relevant arguments for your use of SSL/TLS certificates. It's important to consider aspects of your website where important or personal information is exchanged: registration, login pages, newsletter signup, etc. These arguments have to apply to your current site. Future plans are not considered valid arguments.

	When '''all''' steps are done, the account holder of the ULYSSIS account can send an email to ulyssis@ulyssis.org containing their name, the name of the organisation, the relevant arguments what you will use SSL for and the domain and if needed a list of subdomains that should be covered by the certificate.

	Based on our previous experience and our arrangements with ICTS we will consider whether you are eligible for certificates and whether your request is well-founded. We will then generate the required cryptographic key and request and submit them on the certificate platform supplied by ICTS and its partners. Depending on the situation, the verification and delivery of the certificate can take some time. As soon as the certificate has been issued, we will install it and notify you.

	For procedures to request certificates, we follow instructions from ICTS. These instructions have changed several times in the past, so it's possible for a new request or for a renewal, you may have to follow a different procedure or make changes.

	~~{{notice\|Limitations\|ICTS does not allow SSL requests for historic *.student.kuleuven.be domains. We judge requests for username.ulyssis.be and username.studentenweb.org on an individual basis.}}~~

	~~==External certificates==~~
	To install external certificates we require the certificate itself, the private key, and possibly the chain. We prefer you also send us (a link to) the documentation of your supplier. As certificate files, especially private keys, are a delicate matter we suggest you just email us the path in your homedirectory you've put them and we will move them over to the webserver safely. For more information concerning this procedure you can always contact us on ulyssis@ulyssis.org		To install external certificates we require the certificate itself, the private key, and possibly the chain. We prefer you also send us (a link to) the documentation of your supplier. As certificate files, especially private keys, are a delicate matter we suggest you just email us the path in your homedirectory you've put them and we will move them over to the webserver safely. For more information concerning this procedure you can always contact us on ulyssis@ulyssis.org

	===Let's Encrypt===		==Let's Encrypt==
	We currently do not have an automated system for renewing and deploying certificates such as those supplied by Let's Encrypt. We are however looking into automating this process in the future. Since more of our users are starting to use Let's Encrypt, and all of their certificates need to be renewed frequently, we have a specific procedure now.		We currently do not have an automated system for renewing and deploying certificates such as those supplied by Let's Encrypt. We are however looking into automating this process in the future. Since more of our users are starting to use Let's Encrypt, and all of their certificates need to be renewed frequently, we have a specific procedure now.

Line 42:		Line 23:
	Otherwise, you can generate or renew your certificates using acme.sh. This is explained in the next section.		Otherwise, you can generate or renew your certificates using acme.sh. This is explained in the next section.

	==== Generating certificates ====		=== Generating certificates ===
	{{notice\|If you use a <code>.htaccess</code> file in the webroot of the domain name, make sure to add the following lines at the top of the file:\|<pre><IfModule mod_rewrite.c>		{{notice\|If you use a <code>.htaccess</code> file in the webroot of the domain name, make sure to add the following lines at the top of the file:\|<pre><IfModule mod_rewrite.c>
	RewriteRule "^.well-known/acme-challenge" - [L]		RewriteRule "^.well-known/acme-challenge" - [L]
Line 91:		Line 72:
	'''After renewing the certificate, you have to email us to install your certificate.''' More information in the next section.		'''After renewing the certificate, you have to email us to install your certificate.''' More information in the next section.

	==== Getting your certificates installed ====		=== Getting your certificates installed ===
	Check whether everything is stored correctly by executing the following command:		Check whether everything is stored correctly by executing the following command:
	ulyssis-certificate check mydomain.be		ulyssis-certificate check mydomain.be

Bert: /* Requesting SSL from the KU Leuven */

2023-09-17T14:55:44Z

Requesting SSL from the KU Leuven

← Older revision		Revision as of 16:55, 17 September 2023
Line 9:		Line 9:
	* Make sure our nameservers are being used for the involved domain(s), as explained on [[Adding domain names]]		* Make sure our nameservers are being used for the involved domain(s), as explained on [[Adding domain names]]
	* Consider all subdomains (whether separate websites or not) you wish to have certificates for		* Consider all subdomains (whether separate websites or not) you wish to have certificates for
	* Make a list of all relevant arguments for your use of SSL/TLS certificates. It's important to consider aspects of your website where important or personal information is exchanged: registration, login pages, newsletter signup, etc.		* Make a list of all relevant arguments for your use of SSL/TLS certificates. It's important to consider aspects of your website where important or personal information is exchanged: registration, login pages, newsletter signup, etc. These arguments have to apply to your current site. Future plans are not considered valid arguments.

	When '''all''' steps are done, the account holder of the ULYSSIS account can send an email to ulyssis@ulyssis.org containing their name, the name of the organisation, the relevant arguments what you will use SSL for and the domain and if needed a list of subdomains that should be covered by the certificate.		When '''all''' steps are done, the account holder of the ULYSSIS account can send an email to ulyssis@ulyssis.org containing their name, the name of the organisation, the relevant arguments what you will use SSL for and the domain and if needed a list of subdomains that should be covered by the certificate.

Wtas: Typo fix in intro

2022-04-30T07:25:23Z

Typo fix in intro

← Older revision		Revision as of 09:25, 30 April 2022
Line 1:		Line 1:
	ULYSSIS does not sell or offer any other SSL certificates than our self-signed certificate. We will however guide requests and install a certificate from the KU Leuven is you are eligible for one, and we will also install certificates you have bought or obtained elsewhere.		ULYSSIS does not sell or offer any other SSL certificates than our self-signed certificate. We will however guide requests and install a certificate from the KU Leuven if you are eligible for one, and we will also install certificates you have bought or obtained elsewhere.

	==Requesting SSL from the KU Leuven==		==Requesting SSL from the KU Leuven==

Arnodb: /* Generating certificates */

2022-04-09T21:43:50Z

Generating certificates

← Older revision		Revision as of 23:43, 9 April 2022
Line 57:		Line 57:
	The following example command will generate a certificate for <code>mydomain.be</code> and <code>www.mydomain.be</code> which points to the <code>www</code> folder in the home directory. '''Change the parameters''' as explained below before executing this command!		The following example command will generate a certificate for <code>mydomain.be</code> and <code>www.mydomain.be</code> which points to the <code>www</code> folder in the home directory. '''Change the parameters''' as explained below before executing this command!

	~/acme.sh --issue --cert-file ~/letsencrypt/mydomain.be/mydomain.be.crt --key-file ~/letsencrypt/mydomain.be/mydomain.be.key --ca-file ~/letsencrypt/mydomain.be/mydomain.be.chain -m "email@mydomain.be" -w ~/www -d mydomain.be -d www.mydomain.be		~/acme.sh --issue --cert-file ~/letsencrypt/mydomain.be/mydomain.be.crt --key-file ~/letsencrypt/mydomain.be/mydomain.be.key --ca-file ~/letsencrypt/mydomain.be/mydomain.be.chain -m "email@mydomain.be" -w ~/www -d mydomain.be -d www.mydomain.be --server letsencrypt

	The explanation of these many parameters is as follows:		The explanation of these many parameters is as follows:
Line 67:		Line 67:
	* <code>-w ~/www</code> tells acme.sh where the domains in this certificate point to. Make sure to change the <code>www</code> part if the domains point to a different folder in your home directory.		* <code>-w ~/www</code> tells acme.sh where the domains in this certificate point to. Make sure to change the <code>www</code> part if the domains point to a different folder in your home directory.
	* <code>-d mydomain.be</code> and <code>-d www.mydomain.be</code> tell acme.sh that the certificate should protect <code>mydomain.be</code> and <code>www.mydomain.be</code>. The first domain name will be the "main domain", which is important for renewing. You should '''add all domain names''' pointing to the <code>-w</code> folder.		* <code>-d mydomain.be</code> and <code>-d www.mydomain.be</code> tell acme.sh that the certificate should protect <code>mydomain.be</code> and <code>www.mydomain.be</code>. The first domain name will be the "main domain", which is important for renewing. You should '''add all domain names''' pointing to the <code>-w</code> folder.
			* <code>--server letsencrypt</code> tells acme.sh to use https://letsencrypt.org/ as Certificate Authority (CA).

	After executing this command with the right parameters, your certificate should be generated successfully. When you have to renew the certificate in the future, you should follow the instructions in the next section. '''Don't forget to email us to install your new certificate.''' More information in the last section on this page.		After executing this command with the right parameters, your certificate should be generated successfully. When you have to renew the certificate in the future, you should follow the instructions in the next section. '''Don't forget to email us to install your new certificate.''' More information in the last section on this page.

Vincenttc: Reverted edits by Pcy (talk) to last revision by Bert

2021-04-20T13:12:23Z

Reverted edits by Pcy (talk) to last revision by Bert

← Older revision		Revision as of 15:12, 20 April 2021
Line 33:		Line 33:
	letsencrypt/		letsencrypt/
	└── mydomain.be/		└── mydomain.be/
	├── mydomain.be.chain (the CA file~~; "full chain", not the regular chain~~)		├── mydomain.be.chain (the CA file)
	├── mydomain.be.crt (the cert file; "public key")		├── mydomain.be.crt (the cert file; "public key")
	└── mydomain.be.key (the key file; "private key")		└── mydomain.be.key (the key file; "private key")

Pcy: /* Let's Encrypt */ fullchain verduidelijking

2021-04-20T13:04:04Z

Let's Encrypt: fullchain verduidelijking

← Older revision		Revision as of 15:04, 20 April 2021
Line 33:		Line 33:
	letsencrypt/		letsencrypt/
	└── mydomain.be/		└── mydomain.be/
	├── mydomain.be.chain (the CA file)		├── mydomain.be.chain (the CA file; "full chain", not the regular chain)
	├── mydomain.be.crt (the cert file; "public key")		├── mydomain.be.crt (the cert file; "public key")
	└── mydomain.be.key (the key file; "private key")		└── mydomain.be.key (the key file; "private key")

Bert at 08:48, 16 February 2021

2021-02-16T08:48:57Z

← Older revision		Revision as of 10:48, 16 February 2021
Line 3:		Line 3:
	==Requesting SSL from the KU Leuven==		==Requesting SSL from the KU Leuven==

	The KU Leuven partners with other universities through TERENA/Géant to arrange certificates for its services, organisations and academic structures. We have permission to request free SSL/TLS certificates for student unions (kringen) recognized by LOKO or faculty consultative bodies (facultaire overlegorganen) recognized by Studentenraad KU Leuven as well as organisations (vrije verenigingen) recognized by LOKO or KU Leuven. We are not eligible to request SSL/TLS certificates for individuals with a personal account, nor research groups or staff associations. We suggest those latter groups request certificates from KU Leuven ICTS directly.		The KU Leuven partners with other universities through TERENA/Géant to arrange certificates for its services, organisations and academic structures. We have permission to request free SSL/TLS certificates for student unions (kringen) recognized by LOKO or faculty consultative bodies (facultaire overlegorganen) recognized by Studentenraad KU Leuven as well as organisations (vrije verenigingen) recognized by LOKO or KU Leuven. We are not eligible to request SSL/TLS certificates for individuals with a personal account, nor research groups or staff associations. We suggest those latter groups request certificates from KU Leuven ICTS directly or consider Let's Encrypt or another third party service.

	Before sending us a request, the following steps have to be performed:		Before sending us a request, the following steps have to be performed:

Bert at 08:45, 16 February 2021

2021-02-16T08:45:48Z

← Older revision		Revision as of 10:45, 16 February 2021
Line 3:		Line 3:
	==Requesting SSL from the KU Leuven==		==Requesting SSL from the KU Leuven==

	The KU Leuven partners with other universities through TERENA/Géant to arrange certificates for its services, organisations and academic structures. We have permission to request free SSL/TLS certificates for student unions (kringen) recognized by LOKO or faculty consultative bodies (facultaire overlegorganen) recognized by ~~Stura body~~ as well as organisations (vrije verenigingen) recognized by LOKO or KU Leuven.		The KU Leuven partners with other universities through TERENA/Géant to arrange certificates for its services, organisations and academic structures. We have permission to request free SSL/TLS certificates for student unions (kringen) recognized by LOKO or faculty consultative bodies (facultaire overlegorganen) recognized by Studentenraad KU Leuven as well as organisations (vrije verenigingen) recognized by LOKO or KU Leuven. We are not eligible to request SSL/TLS certificates for individuals with a personal account, nor research groups or staff associations. We suggest those latter groups request certificates from KU Leuven ICTS directly.

	Before sending us a request, the following steps have to be performed:		Before sending us a request, the following steps have to be performed:

Vincenttc: /* Requesting SSL from the KU Leuven */

2021-02-15T16:38:38Z

Requesting SSL from the KU Leuven

← Older revision		Revision as of 18:38, 15 February 2021
Line 7:		Line 7:
	Before sending us a request, the following steps have to be performed:		Before sending us a request, the following steps have to be performed:
	* Set up the site that needs SSL if that's not already the case		* Set up the site that needs SSL if that's not already the case
	* Create a forwarder from hostmaster@yourdomain.tld to ulyssis@ulyssis.org
	* Make sure our nameservers are being used for the involved domain(s), as explained on [[Adding domain names]]		* Make sure our nameservers are being used for the involved domain(s), as explained on [[Adding domain names]]
	* Consider all subdomains (whether separate websites or not) you wish to have certificates for		* Consider all subdomains (whether separate websites or not) you wish to have certificates for

Principis: /* Getting your certificates installed */

2020-12-12T00:35:48Z

Getting your certificates installed

← Older revision		Revision as of 02:35, 12 December 2020
Line 97:		Line 97:
	If everything looks good, you should only see lines starting with <code>[ OK ]</code>. Any line starting with <code>[FAIL]</code> or <code>[ABRT]</code> means a check has failed, you must correct this error before asking us to install your certificate.		If everything looks good, you should only see lines starting with <code>[ OK ]</code>. Any line starting with <code>[FAIL]</code> or <code>[ABRT]</code> means a check has failed, you must correct this error before asking us to install your certificate.

	Once all steps are done, the account holder ~~can~~ '''send us an email clearly stating the account name, for which domains we need to add certificates and where the files are stored'''. If you are renewing existing certificates, also clearly state that in ~~the~~ email.		Once all steps are done and if you are the '''account holder''', '''you can send us an email clearly stating the account name, for which domains we need to add certificates and where the files are stored'''. If you are renewing existing certificates, also clearly state that in your email.

	We have largely automated the installation of certificates. If you do not follow these instructions, your request will be denied or you may end up with broken SSL, so make sure you follow this procedure carefully.		We have largely automated the installation of certificates. If you do not follow these instructions, your request will be denied or you may end up with broken SSL, so make sure you follow this procedure carefully.

	[[Category:Webserver]]		[[Category:Webserver]]