Getting SSL/TLS

ULYSSIS does not sell or offer any other SSL certificates than our self-signed certificate. We will however guide requests and install a certificate from the KU Leuven is you are eligible for one, and we will also install certificates you have bought elsewhere.

Requesting SSL from the KU Leuven

The KU Leuven partners with other universities to use free SSL for its services, organisations and employees. We have permission to request SSL for Student Unions recognized by LOKO or another official body. Organisations (Vrije Verenigingen) are required to be recognized by LOKO or another official body and need to supply a reasoning why they need SSL. Individual users can request SSL but ICTS will only grant permission with elaborate reasoning.

Before sending us a request the following steps have to be done:

• Setup the site that needs SSL
• Change the domain's organisation-attribute to KU Leuven or Katholieke Universiteit Leuven
• Create a forwarder from hostmaster@yourdomain.tld to ulyssis@ulyssis.org

Then you can send an email to ulyssis@ulyssis.org containing your name, the name of the organisation, what you will use SSL for and the domain and if needed a list of subdomains.

We will then generate the required cryptographic key and request and submit them with ICTS. It usually takes a few days before they have had time to verify both the domain and then the request for SSL itself. As soon as ICTS approves the request we will install the certificate and notify you.

External certificates

To install external certificates we require the certificate itself, the private key, and possibly the chain. We prefer you also send us (a link to) the documentation of your supplier. As certificate files, especially private keys, are a delicate matter we suggest you just email us the path in your homedirectory you've put them and we will move them over to the webserver safely. For more information concerning this procedure you can always contact us on ulyssis@ulyssis.org

Let's Encrypt

We currently do not have an automated system for renewing and deploying certificates such as those supplied by Let's Encrypt. We are however looking into automating this process in the future. Since more of our users are starting to use Let's Encrypt, and all of their certificates need to be renewed frequently, we have a specific procedure now.

For the first installation of a certificate, you will have to generate a new key as well as a certificate. For renewals, please always reuse the old key, so we only have to replace your certificate and not the key every few months.

When wishing to add a certificate with Let's Encrypt to your website, or renew your existing one, first create a folder letsencrypt in your home folder. Then add a folder per domain or group of domains, then add the relevant files to the right domain folder. Please keep in mind that it is always good practice to have your key be only readable by you, so check your permissions. Always remove irrevelant files, we won't search for the right certificate.

Your structure should look something like this:

letsencrypt/
├── interestingdomain.be
│   ├── interestingdomain.be.chain
│   ├── interestingdomain.be.crt
│   └── interestingdomain.be.key
└── otherdomain.com
    ├── otherdomain.com.chain
    ├── otherdomain.com.crt
    └── otherdomain.com.key

Once you have placed your files in the correct folder, you can send us an email clearly stating for which domains we need to add certificates and where the files are stored. If you are renewing existing certificates, also clearly state that in your email.

We have largely automated the installation of certificates. If you do not follow these instructions, your request will be denied or you may end up with broken SSL. So make sure you follow this procedure carefully.

Logs

Due to the nature of our setup (dumb loadbalancer combined with shibboleth on webworkers), all https traffic will seem to come from our loadbalancer IP address instead of the actual originating IP address. Keep this in mind when checking log files.