CA certificates

The tables below list all ever used X.509 certificates of the University Certification Authority Münster as well as the respective superordinate certification authorities in different formats. The years indicate the periods of use, not the periods of validity.

For security reasons certificates are always used for a limited period only as specified in the certification policies. Thereafter new certificates are used. The old certificates remain valid until their end of life, however, and are still needed to check the certificates issued with them.

When clicking on Import the certificate is downloaded in binary format for automatically importing into your WWW program. When clicking on Binary the certificate is downloaded in the same format but for saving as file. When clicking on Text (.pem) or Text (.crt), the certificate is downloaded in PEM format for saving with the indicated file name extension. When clicking on Binary (.p7b), the certificate is downloaded in PKCS#7 format for saving with the indicated file name extension.

PDF certificates

The digital PDF IDs are signed directly by the root certificate of our own PDF CA, so there is no hierarchy or chain.

 

X.509 PDF CA (root CA)

Now
↑
2022

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

“TCS” certificates

GÉANT TCS uses different CA certificates for different key types (RSA, ECC), different certificate purposes (person, code signing, server), different scopes of application (normal, eScience) and different request paths (normal, ACME).

The root certificates “USERTrust ... Certification Authority” are built into all current programs. Very old software does not yet know these root certificates, but does know the root certificate “AAA Certificate Services” from Commodo (today Sectigo). (Only) If you need to ensure that even very old software can establish connections to your server, you should use the chain with the cross certificate.

 

X.509 GÉANT TCS

X.509 root CA

X.509 alternative root CA

X.509 chain (see below)

Now
↑
2021

User RSA certificates:
GEANT Personal CA 4

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

USERTrust RSA Certification Authority

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Or as a cross certificate from the alternative root CA:

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

AAA Certificate Services

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

User eScience RSA certificates:
GEANT eScience Personal CA 4

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Code Signing RSA certificates:
GEANT Code Signing CA 4

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server RSA certificates:
GEANT OV RSA CA 4

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server eScience RSA certificates:
GEANT eScience SSL CA 4

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server RSA certificates via ACME:
Sectigo RSA Organization Validation Secure Server CA

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

User ECC certificates:
GEANT Personal ECC CA 4

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

USERTrust ECC Certification Authority

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Or as a cross certificate from the alternative root CA:

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

User eScience ECC certificates:
GEANT eScience Personal ECC CA 4

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server ECC certificates:
GEANT OV ECC CA 4

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server eScience ECC certificates:
GEANT eScience SSL ECC CA 4

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server ECC certificates via ACME:
Sectigo ECC Organization Validation Secure Server CA

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

“Global” certificates and predecessors

 

X.509 CA Uni MS

X.509 DFN-PCA

X.509 root CA

X.509 chain (see below)

2022
↑
2016

DFN-Verein Global Issuing CA

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

DFN-Verein Certification Authority 2

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

T-TeleSec GlobalRoot Class 2

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Text (current and historic CA certificates)

2016
↑
2014

Zertifizierungsstelle Universitaet Muenster - G02

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

DFN-Verein PCA Global - G01

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Deutsche Telekom Root CA 2

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

2014

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)
(revoked)

Text (with root)
Text (without root)
(revoked)

2014
↑
2007

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

2007
↑
2006

Zertifizierungsstelle Universitaet Muenster (Classic) 2006-2007

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

DFN-Verein PCA Classic - G01

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

2005
↑
2004

Zertifizierungsstelle 2004-2005

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

DFN Toplevel Certification Authority

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

2003
↑
2002

Zertifizierungsstelle 2002-2003

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

2001
↑
2000

Zertifizierungsstelle 2002-2003

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

DFN Top Level Certification Authority

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Remarks

The column X.509 chain lists files containing the certificates of the CA of the University of Münster and the superordinate certification authorities, both with and without the respective root certificate. Those who operate Apache WWW servers should download the file without root certificate and indicate this file in the configuration option SSLCertificateChainFile to save the users from importing the CA certificate into their browsers.

Those who operate other SSL/TLS server software should indicate in the configuration first the private key of the server, second the certificate of the server, and third the chain without root. With some software it may be necessary to merge all three parts in this order, perhaps separated by an empty line, into a simple text file and to indicate this file in the configuration.

Usually, the cross certificate and the alternative root certificate should no longer be needed. Only very old software does no longer know the USERTrust root certificates.

OpenPGP

For completeness the OpenPGP keys formerly used for certification are listed here.

 

PGP CA Uni MS

PGP DFN-PCA

 

(Service discontinued by the end of 2011)

(Service discontinued by the end of 2009)

2011 ← 2010

Text

2009 ← 2008

Text

Text

2007 ← 2006

Text

2005 ← 2004

Text

Text

2003 ← 2002

Text

Text

2001

Text

Text

2000

Text

1999

Text
(predecessor)

1998 ← 1997

Text