SSL certificates for server

• Free SSL certificate types are marked accordingly in the certificate portal. Products that are subject to a fee must be paid for by the user.
• SSL certificates can only be requested by employees who are actively employed with an official email address of the University of Vienna (in the format firstname.lastname@univie.ac.at).
• SSL certificates can only be issued to domains owned by the University of Vienna. If your domain is currently registered to another owner, you can transfer it to the University of Vienna.
• No certificates can be issued for domains registered personally to employees or students of the University of Vienna.
• SSL certificates of the University of Vienna must not be used for commercial purposes.
• Special regulations may apply for financial transactions.
• The domain must be hosted with all services on the servers of the University of Vienna. Justified exceptions require approval by the IT Security Team of the ZID.
• A wildcard certificate for *.univie.ac.at can only be issued in case of special technical reasons. If necessary, choose a multi-domain certificate instead or add a comment to your application for a wildcard certificate, specifying the technical reason.

1. Open the certificate portal. Use only the Academic Login to log in. Other login methods are not supported by the ZID.
   If you receive an error message when logging in, use a different web browser or delete your browser’s session data.
2. Enter univie.ac.at in the search field and select the entry University of Vienna.
3. You will be automatically redirected to the weblogin of the University of Vienna. Log in with your u:account user ID (example: doejamie1) and the corresponding password.
4. Click on the Server entry in the menu on the left.
5. In the Domains tab, you can enter the domains manually.
6. In the Product tab, select the certificate you want that is marked as Free. You must pay for products that are subject to a fee yourself.
7. In the Submit tab, upload the CSR file that you previously generated on the server for which the certificate is intended.
8. The ZID will then review the application and approve it as fast as possible.
9. You will be notified of the completion via e-mail.
10. You can then download your certificate in several formats. The ZID recommends downloading in PEM bundle format. This ensures that the complete certificate chain is included. This also supports end devices that do not actively load additional certificates or do not yet have the current Root CA Certificate.

The maximum validity period of a newly issued SSL certificate from the Certificate Service is currently 1 year. If necessary, it can be renewed before the end of its validity period via the Certificate Portal.

From a technical point of view, a certificate is not extended when it is renewed, but reissued.

Due to the ever-shorter lifespan of certificates, the ZID offers ACME (Automated Certificate Management Environment) access as an alternative. This automates the entire lifecycle of SSL certificates.

ACME eliminates the need for manual steps by using standardised communication between ACME clients and the certification authority to manage the issuance, validation, installation, renewal and revocation of certificates.

The setup effort is particularly worthwhile for many services/hosts and in dynamic environments (e.g. containers) and serves to minimise the risk of failure due to certificates that expire.

Request ACME access for SSL certificates via the Servicedesk.

If you have any questions, please use the Servicedesk form SSL certificate (login, in German).