edutech4schools Posted January 22, 2013 Posted January 22, 2013 Hi, I have requested a ssl cert using CN = vpn.(school).(LA).sch.uk I have just had an email to say they are processing Domain name = (LA).sch.uk Server Name = vpn.(school).(LA).sch.uk Should I be concerned?
edutech4schools Posted January 22, 2013 Author Posted January 22, 2013 Sorry, I have been finding this very confusing as our LA control the firewall / ports and DNS. So have they got the domain name correct then? LocalAuthority.sch.uk
localzuk Posted January 22, 2013 Posted January 22, 2013 Yes, localauthority.sch.uk is the domain, the other parts are subdomains. So the details they've given are correct.
GrumbleDook Posted January 22, 2013 Posted January 22, 2013 school.region.sch.uk is the domain ... vpn.school.region.sch.uk is the Fully Qualified Domain Name. region.sch.uk is not the domain (though the CA is treating it as such). A domain is the entirety of what is registered via a Domain Registrar. Some vendors have had a tendency to take the cTLD and treat the next zone as the domain, despite very clear instructions.
pete Posted January 22, 2013 Posted January 22, 2013 Yes. Phone them up because some cert and hosting providers really don't grasp how the school.region.sch.uk breaks down. Our certs (for example) are of the whatever.school.region.sch.uk format (i.e moodle, webmail etc) and it did take a bit of "ok, repeat that back to me to ensure you understand it" and a couple of nominet links before it clicked.
localzuk Posted January 22, 2013 Posted January 22, 2013 school.region.sch.uk is the domain ... vpn.school.region.sch.uk is the Fully Qualified Domain Name. region.sch.uk is not the domain (though the CA is treating it as such). A domain is the entirety of what is registered via a Domain Registrar. Some vendors have had a tendency to take the cTLD and treat the next zone as the domain, despite very clear instructions. That's not how the standard was defined, that's why... The standard was supposed to be .com was a tld, a .co.uk was a cctld and then anything else was a domain on one of those. That was according to RFC 1480 and RFC 1591. So, its understandable that registrars don't understand it really!
GrumbleDook Posted January 22, 2013 Posted January 22, 2013 That's not how the standard was defined, that's why... The standard was supposed to be .com was a tld, a .co.uk was a cctld and then anything else was a domain on one of those. That was according to RFC 1480 and RFC 1591. So, its understandable that registrars don't understand it really! To clarify ... *everything* is a domain. TLD means Top Level Domain and it is controlled / managed by given organisations. .uk TLDs (.sch.uk, .me.uk, .org.uk) are dealt with by Nominet (some are delegated such as .police.uk and .gov.uk) and are not a true ccTLD (one of the reasons why I've always been told to refer to it as a cTLD instead) as they are an exception to ISO 3166. The next zone to the left of the TLD is the Second Level Domain. For .sch.uk this is a hierarchical zone to regionalise domains and so they are not used to register a domain (I believe that there are a few historic examples due to previous conversations with nominet but never been told what they are). The Third Level Domain is that which is registered via a Registrar and is considered as the 'domain'. The changes since RFCs 1480 and 1591 were written have been prodded and poked a number of times but perhaps RFC 3071 is an interesting one for folk to read to try to understand how things change, whether through gradual change due to need or simply due to change because that is how things ended up happening.
edutech4schools Posted January 22, 2013 Author Posted January 22, 2013 Thanks for all the info. Just to double check I should contact the CA and get them to use school.region.sch.uk?
FN-GM Posted January 22, 2013 Posted January 22, 2013 Thanks for all the info. Just to double check I should contact the CA and get them to use school.region.sch.uk? Its fine. As per post 4.
edutech4schools Posted January 22, 2013 Author Posted January 22, 2013 but in post 5 school.region.sch.uk is the domain ... vpn.school.region.sch.uk is the Fully Qualified Domain Name. region.sch.uk is not the domain So based on the above info I need school.region.sch.uk and not simply region.sch.uk and in post 6 Yes. Phone them up because some cert and hosting providers really don't grasp how the school.region.sch.uk breaks down. I seem to be getting conflicting help. No wonder so many people get confused. So who is correct?
FN-GM Posted January 22, 2013 Posted January 22, 2013 Post 4 is correct Type your full domain name into WHOIS Search, Domain Name, Website, and IP Tools - Who.is for example school.lea.sch.uk. Right at the top you will see it display as lea.sch.uk this is because the school name is a sub domain of .lea.sch.uk.
edutech4schools Posted January 22, 2013 Author Posted January 22, 2013 Odd. When I use your link it comes back with invalid domain name but if I use this WHOIS tool | Nominet is comes back and tells me the domain is school.region.sch.uk and not region.sch.uk. can I pm you our school info?
Guest Guest Posted January 22, 2013 Posted January 22, 2013 (edited) school.lea.sch.uk is your domain. lea.sch.uk is invalid. This domain cannot be registered because it contravenes the Nominet UK naming rules. The reason is: invalid format for a .sch.uk domain name. I have the bi-annual chore of making our CA understand that lea.sch.uk does not exist. Bottom line, yes you should be concerned. Post 4 is correct Type your full domain name into WHOIS Search, Domain Name, Website, and IP Tools - Who.is for example school.lea.sch.uk. Right at the top you will see it display as lea.sch.uk this is because the school name is a sub domain of .lea.sch.uk. Maybe your LEA/RBC has contacted nominet and done things differently, it certainly isn't that way for us and by nominets help pages lea.sch.uk is an invalid format. Edited January 22, 2013 by Guest
GrumbleDook Posted January 22, 2013 Posted January 22, 2013 *Do Not Accept .region.sch.uk* To have a valid certificate you should own / manage / control the domain being used. You do not control .region.sch.uk ... no-one does (except Nominet). Your CA should be validating the ownership of the domain prior to the issuing of the certificate and if you let them proceed it can take flaming ages to get them to realise the mistake they are making. As with @j17sparky ... the voice of bitter experience of having to help out schools over the last 5 years!
sonofsanta Posted January 23, 2013 Posted January 23, 2013 If nothing else, they will want proof that you own the domain, normally by you placing a text file somewhere on your website or updating a DNS record for your domain. You will not be able to do this for region.sch.uk so you need to get them to recognise school.region.sch.uk as your domain name. Had no end of fun with this in the past with GoDaddy, repeatedly explaining that no I cannot put a text file on sch.uk.
edutech4schools Posted January 23, 2013 Author Posted January 23, 2013 No need for the panic. Basically the auto mailer system for the CA company pulls the standard domain which is area.sch.uk and uses that for its confirmation emails but when it comes to creating the actual cert which is checked by a human it would have come back with an whois error and they would have realised it was a UK school which needs school.area.sch.uk and the cert would have been created correctly. That's what they have said, lets see if they do send the correct cert.
mavhc Posted January 23, 2013 Posted January 23, 2013 If someone did get *.la.sch.uk could they do any harm?
edutech4schools Posted January 24, 2013 Author Posted January 24, 2013 Ok, more help needed. I have the certs and have imported the vpn.school.la.sch.uk.cer in to IIS. The next thing the CA company have asked me to do is import a ips.CALEVEL1CA.crt. They say to do this by double clicking the file and selecting import then put it in Intermediate Certification Authorities folder, select the underlying Local Computer folder. Firstly is this done on the IIS server? If so, why when I do this do I not see a local compute folder. Even with physical store ticked I only get registry listed.
edutech4schools Posted January 24, 2013 Author Posted January 24, 2013 (edited) Is the following that I found on-line the same location as the above post issue? and will I be ok to follow this? Click on Start and then Run. In the Run window, type MMC in the Open: field and click on the OK button. The Console1 window will appear. Click on File at the top and then select Add/Remove Snap-in... Alternatively, you can press Ctrl + M. In the Add/Remove Snap-in window, click on the Add... button at the bottom. This will open a third window named Add Standalone Snap-in. Scroll down in the Add Standalone Snap-in window and find the Certificatescomponent. Once found, highlight it and click on the Add button at the bottom. Alternatively, you can double-click on Certificates. In a new window, you will be given 3 options for which account you want the certificates snap-in to manage. Select the Computer account radio button and click on the Next button. At the next screen, click on the Finish button. Edited January 24, 2013 by edutech4schools
sonofsanta Posted January 24, 2013 Posted January 24, 2013 Is the following that I found on-line the same location as the above post issue? and will I be ok to follow this? That's fine to follow that - it's just displaying your certificates in a snap-in, not changing anything on your machine at all. Once you have that open you can go into the Intermediate CA folder, into the Certificates sub-folder, right click in the right hand pane and choose All Tasks > Import. Then just follow the wizard. I'm not definite on this but I suspect that you need to import that into your domain computers (can be done by GPO), as it's part of the certification chain. Someone more definite than me can confirm or deny for you, though!
edutech4schools Posted January 24, 2013 Author Posted January 24, 2013 I also have a third cert ipsCAGlobal.crt which not to sure about.
edutech4schools Posted January 24, 2013 Author Posted January 24, 2013 ok the third cert is already in the trusted CA folder.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now