---
type: concept
title: Server Certificates
tags: [pki, ssl, tls, security]
related: [dfn-pki-zertifikate, harica, certificate-signing-request, pem-bundle, universitatsrechenzentrum-urz, iis, unihgw-ca]
created: 2026-06-30
updated: 2026-06-30
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_dfn_pki_zertifikate_serverzertifikate.md", "output/rz_uni_greifswald_de_dienste_allgemein_dfn_pki_zertifikate_serverzertifikate_har.md", "output/rz_uni_greifswald_de_dienste_allgemein_dfn_pki_zertifikate_serverzertifikate_mic.md", "output/rz_uni_greifswald_de_dienste_allgemein_dfn_pki_zertifikate_unihgw_ca.md"]
---

# Server Certificates

**Server Certificates** (Serverzertifikate) are digital certificates used to authenticate a server and enable encrypted communication via SSL/TLS between a server and its clients. Within the Universität Greifswald infrastructure, these are part of the [[dfn-pki-zertifikate]] framework.

## Issuer Selection

Depending on the target audience of the server, different Certificate Authorities (CAs) are used:

- **Public-Facing Servers**: Must use globally trusted certificates (e.g., via [[dfn-pki-zertifikate]] / HARICA) to avoid browser security warnings.
- **Internal Servers**: May use the [[unihgw-ca]] for university-internal web servers, providing the university with operational independence from external providers.

## Provisioning Process

The process for obtaining a server certificate involves the generation of a request and a specific submission workflow.

### 1. Generation of Request
The administrator must generate a private key and a [[certificate-signing-request]] (CSR). Common tools used for this include:
- [[OpenSSL]]
- [[IIS]] (Microsoft Internet Information Services)

### 2. Submission and Approval Workflow
Depending on the source documentation, the submission process is described as follows:

**Via [[harica]] Certificate Manager:**
1. **Request**: Log into the HARICA system and select the **Server** menu.
2. **Configuration**: 
   - Enter the desired domain names (maximum of 20 domains per certificate).
   - Select the **Domain-only (DV)** validation type.
3. **Submission**: Upload the CSR manually.
4. **Approval**: The request is sent to the [[universitatsrechenzentrum-urz]] for manual approval.
5. **Installation**: Once approved, the certificate is available under "Valid Certificates" in the dashboard. It is recommended to download it as a [[pem-bundle]].

**Via DFN-PKI Portal:**
1. **Application**: The CSR is uploaded to the **DFN-PKI** portal.
2. **Approval**: The request is subject to mandatory approval by the **Universitätsrechenzentrum (URZ)**.
3. **Installation**: The issued certificate is imported back into the server software (e.g., via the "Complete Certificate Request" function in IIS).

## Technical Notes and Constraints

### General Technical Notes
- **Validation**: The current standard for these requests is Domain Validation (DV).
- **CSR Constraints**: DNS data inside the CSR is ignored by HARICA; domain names must be entered in the web interface.

### Naming Conventions
To avoid rejection when requesting certificates for the university, the following constraints must be followed:
- **Organization Name**: Must be written exactly as `Universitaet Greifswald`.
- **Character Set**: No umlauts are allowed in the request fields.

## Support
Issues regarding server certificates are managed by the [[universitatsrechenzentrum-urz]] through their [[groupware]] ticket system or the internal hotline.