Free SSL Certificates for JANET connected schools

[Dos_Box]

Some of you may find this useful.

 

http://www.ja.net/services/scs.html

 

With effect from 30 November 2006, JANET is offering two types of server certificates to its customers:

 

The first is provided through an agreement between TERENA and GlobalSign; this allows JANET to act as a Registration Authority (RA) to provide GlobalSign server certificates to JANET connected organisations. JANET will absorb the cost of providing the certificates, so there is at present no charge to organisations. These certificates cannot be used for commercial transactions so cannot be used to secure credit card transactions or any other request that will result in the transfer of money between people or organisations.

 

The faq sheet doesn't seem to want to load though :/

[bossman]

Dos_Box:

seems fine to me, maybe your browser?

[Dos_Box]

Yup. Firefox crashed. Damm. Anyway. Here is the FAQs link.

 

http://www.ja.net/services/publications/factsheets/069-using-server-certificates.pdf

[joe90bass]

Just sent in my e-mail request for info, will keep you posted on how it goes!

[joe90bass]

Hello Chris,

 

We currently supply tickets to 'JANET primary connections' and local

authorities who are connected to the JANET network.

 

With this in mind, we would not be able to assist you on this occasion.

 

Kind regards,

 

It was worth a try!

[plock]

Sorry slight off topic, how do you deal with multiple SSL Certificates with one public IP address?

[Dos_Box]

Just sent in my e-mail request for info, will keep you posted on how it goes!

 

I forgot to add that your RBC has to apply to be the certificate 'issuer' and any orders should go through them once they have applied to join the scheme.

[Geoff]

So when are CLEO/LGfL doing that then?

[chaz6]

Sorry slight off topic, how do you deal with multiple SSL Certificates with one public IP address?

 

The only way to use multiple certificates (presumably with HTTPS) with one IP address is to use a distinct port for each certificate you want to use, and provide links in the format https://domain.name:port/. Alternatively you can use one certificate with multiple names defined in the SubjectAltName attribute. The JANET Certificate Service permits this. You just need to supply the appropriate CSR.

[Geoff]

I use IP based virtual hosts to avoid these headaches.

[GrumbleDook]

JANET are rebuilding their site and the information is now available from http://www.ja.net/services/server-certificate-applications/server-certificate-service-process.html

 

I think it may be worth contacting JANET and ask for a list of RBCs that have signed up to be issuers.

[plock]

Sorry slight off topic, how do you deal with multiple SSL Certificates with one public IP address?

 

The only way to use multiple certificates (presumably with HTTPS) with one IP address is to use a distinct port for each certificate you want to use, and provide links in the format https://domain.name:port/. Alternatively you can use one certificate with multiple names defined in the SubjectAltName attribute. The JANET Certificate Service permits this. You just need to supply the appropriate CSR.

 

Cheers for that, this has been put on hold at the moment. I read somewhere about a Multiple Domain Certificate. What is this? How does this work?

 

Cheers.

[Geoff]

It's a wildcard certificate. It basically vaild for *.yourdomain.lea.sch.uk.

 

So for example, if we had a wildcard certificate here for our domain .carrhill.lancs.sch.uk it would mean I could put up new systems called

 

something.carrhill.lancs.sch.uk

otherthing.carrhill.lancs.sch.uk

 

and the wildcard cert would be valid for them.

[GrumbleDook]

A bit more clarification from the folks at JANET.

 

The RBC has to be the 'owner' of the domain (ie the tag has to be with them) for a certificate to be registered and authorised for the domain. eg lodgepark.northants.sch.uk will not be given one because we are the owner, not EMBC.

 

This seems a little strange to me as a recent conversation with Nominet gave the impression that schools were owners of their domains irregardless who the tag holder was.

 

Can anyone tell me if they are the owner of their own domain or whether your RBC is? This is going to be an interesting one now as the way it stands no school in Northants can get a certificate.

[chaz6]

It's a wildcard certificate. It basically vaild for *.yourdomain.lea.sch.uk.

 

This is not what I was referring to. I meant having distinct domains in the certificate, for example:

 

http://www.domain1.com

http://www.domain2.com

mail.domain3.com

 

However you can use a wildcard if you only want to serve sites from one domain.

[GrumbleDook]

You can only register a .ac.uk or .sch.uk domain for the certificate. This is based on providing secure access under the NEN.

[Butuz]

I emailed them asking if we could get a certificate and they said no we would have to pay? Our LEA uses JANET for sure

 

Butuz

[GrumbleDook]

You, as a school, cannot get a certificate. You, as a school that buys in connectivity to JANET through your LA, has to get your LA to get a certificate for you, but it seems that the LA can only do this if they own your .sch.uk domain name.

 

I am not saying that there are hoops here ...

 

Ok ... I am saying that there are hoops here and that there are enough to break the Hula record too!

 

I have asked again for clarification and also passed it onto my RBC to get clarification from them too. I will get an answer about the procedure eventually.

[matt40k]

It appears JANET are going to be charging soon...

 

https://www.ja.net/products-services/janet-connect/janet-certificate-service

https://community.ja.net/groups/janet-certificate-service/article/charging-tariff

 

 

Better get your request in now for your free 3 year certificate before they start charging!!

[Gatt]

Yeah - that was announced a couple of months ago - isn't it about £50 per cert per request - even if it has SANs

Think a Wildcard is a bit more pricey though...

[Edu-IT]

Does anyone know if you can still get this through the emPSN?

[GrumbleDook]

The procedure was to work through your LA, but theoretically it is still possible ... give emPSN a shout and ask.

[Edu-IT]

The procedure was to work through your LA, but theoretically it is still possible ... give emPSN a shout and ask.

I'm on it. Cheers!

 

Hopefully somebody will know the answer and I won't be left running round the houses.

[Frazer]

https://community.ja.net/groups/janet-certificate-service/article/charging-faqs - Free SSL certificates extended to 3rd June 2013!

Might be useful to apply for a wildcard ssl certificate if have some projects coming up!

 

Internal Server Name SSL Certificate Issuance After 2015 - internal hostnames/ip's to be phased out of public certificates.

[Boredguy]

Yep I managed to get one from Janet via the SWGfL last week for one of our servers that had it's self signed certificate expire. A nice free one for the 3 years and it only look 24 hrs from initial request so much improved compared to the older system I used with them last year that took a couple of weeks.