Support and Contacts
+06 4962 2000
+39 050 221 3158
Other contacts
For membership requests, support, technical issues, and admin account management, please write to:
For general questions about using the platform, types of certificates, their creation, and usage, use the mailing list:
Subscription to the mailing list is managed by GARR CS and is reserved for Registration Authority Officers and Department Registration Authority Officers appointed by each organization.
GARR CS (Certification Service)
The Certification Service provides digital certificates free of charge to its community. These certificates, available in both personal and server versions, are issued by SECTIGO, a leading commercial Certification Authority that is automatically recognized by nearly all web browsers.
This service is available at no cost to all organizations connected to the GARR network.
GARR participates in the Trusted Certificate Service (TCS) promoted by Géant for the benefit of European research networks
Server TCS certificates
SERVER CERTIFICATE GENERATION
Starting from May 1, 2020, the new provider of the TCS service will be the Certification Authority Sectigo Limited. All certificates already issued by Digicert will remain valid and will retain their validity until the expiration date specified in the certificate itself.
For certificate signing requests (CSR) generation, please refer to the guidelines provided by Sectigo on the GARR CS wiki.
For submitting requests, refer to the instructions provided by your Organization's Administrators.
Alternative names
You can request certificates with multiple names.
You can include alternative names directly within the CSR, or more simply, add them during the request form completion starting from a CSR with only one name:
guidelines for multiple names
An admin can request certificates with multiple names by logging into the Sectigo SCM portal and selecting the Géant OV Multi-Domain type
Within the certificate request form, after uploading the CSR, there is a specific text area labeled "Subject Alternative Names" where additional domain names can be easily entered, separated by commas, to include them in the certificate.
Wild Card
You can request certificates containing a wildcard (*) in both the CN (Common Name) field and within the alternative names, with the following restrictions:
1.A wildcard (*) can replace a subdomain but not part of it
- *.dir.garr.it CORRECT
- xyz*.dir.garr.it WRONG!
2. You cannot request alternative names if the CN field contains a wildcard
- WARNING: Wildcard certificates like *.domain.it cannot be used to authenticate domain names of the form abc.subdomain.domain.it.
- For security reasons, the use of this type of certificates should be as limited as possible. In any case, their issuance must be discussed in advance with the service.
REFERENCES
Personal TCS Certificates
REQUEST AND RENEWAL OF PERSONAL CERTIFICATES
Users can request and renew personal and personal grid certificates by accessing the dedicated Sectigo website for GARR. You will need to authenticate using your organization's IDEM credentials.
From the request form, you can select the following types of certificates:
- GÉANT Personal email signing and encryption
Personal certificates issued by a public CA for email signing and encryption purposes. Not suitable for document signing and client authentication. - GÉANT Personal Authentication
Personal certificates issued by a private CA for use in grid/IGTF environments and for client authentication. Not suitable for email signing and encryption, or for document signing. - GÉANT Personal Automated Authentication Personal robot certificates issued by a private CA for use in software agents authenticating on behalf of the user (grid/IGTF environment). Not suitable for email signing and encryption, or for document signing.
Entities affiliated with the IDEM Federation can activate the service for their users by following the configuration instructions:
Follow the tutorials for requesting personal certificates on Sectigo
Log in with IDEM: 1,01 min.
Generate a certificate: 57 sec.
Generate a certificate with CSR: 1,14 min.
Command to generate the CSR from the terminal
openssl req -newkey rsa:2048 -keyout nome_cognome-key.pem -out nome_cognome-csr.pem -subj "/CN=Nome Cognome"
Guidelines to generate a request with CSR
To generate a PKCS12 file (.p12) using the downloaded certificate file (.crt) and the private key file (private.key), you can use the following command in the terminal:
Command to generate the file in PKCS12 format
openssl pkcs12 -export -in mario_rossi.crt -inkey private.key -out mioCertificato.p12
Let's import the generated certificate into our browser.
Personal TCS certificates can only be issued to members of organizations affiliated with IDEM and enabled for the service
OpensslIt is software available for Linux, macOS, and Windows systems.
