Area dei Servizi ICT - Documentation - certificati:server
https://docu.units.it/dokuwiki/
2026-04-22T21:50:48+00:00Area dei Servizi ICT - Documentation
https://docu.units.it/dokuwiki/
https://docu.units.it/dokuwiki/_media/wiki:logo.pngtext/html2017-10-02T10:29:17+00:00Anonymous (anonymous@undisclosed.example.com)alternate
https://docu.units.it/dokuwiki/certificati:server:alternate?rev=1506940157&do=diff
v3 Alternate Names
È possibile richiedere certificati con più CN (per più nomi FQDN).
Ad esempio, se un server web risponde ai seguenti nomi:
pippo.units.it
gino.units.it
web.pippo.units.it
è possibile usare un singolo certificato per tutti e 3 i nomi.text/html2021-05-18T14:46:33+00:00Anonymous (anonymous@undisclosed.example.com)iis8
https://docu.units.it/dokuwiki/certificati:server:iis8?rev=1621349193&do=diff
CSR in IIS 8 or IIS 8.5 on Windows Server 2012
Documento di partenza: <https://www.digicert.com/kb/csr-ssl-installation/iis-8-and-8.5.htm>
* Creare la richiesta di certificato usando Microsoft RSA SChannel Cryptographic Provider e 2048 come bit length. Campi di esempio:
* CN: geoportal.units.it
* U: Universita degli Studi di Triestetext/html2025-02-10T09:07:47+00:00Anonymous (anonymous@undisclosed.example.com)openssl
https://docu.units.it/dokuwiki/certificati:server:openssl?rev=1739178467&do=diff
Procedura per OpenSSL
Per effettuare la richiesta del certificato, bisogna generare la chiave privata e la richiesta di certificato.
L'esempio qua sotto usa dummy come nome del server da registrare.
* Creare un file di configurazione openssl.cnf possibilmente diverso da quello di sistema (text/html2016-03-01T11:50:36+00:00Anonymous (anonymous@undisclosed.example.com)tcs_cachain_2
https://docu.units.it/dokuwiki/certificati:server:tcs_cachain_2?rev=1456833036&do=diff
Terena TCS CA Chain #2
Per certificati rilasciati dal 8.10.2014 al 1.7.2015
# TERENA SSL CA 2
-----BEGIN CERTIFICATE-----
MIIF+TCCA+GgAwIBAgIRALD/zzodgkSYFWKdZIhqQWUwDQYJKoZIhvcNAQEMBQAw
gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK
ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD
VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE0
MTAwOTAwMDAwMFoXDTI0MTAwODIzNTk1OVowZDELMAkGA1UEBhMCTkwxFjAUBgNV
BAgTDU5vb3JkLUhvbGxhbmQxEjAQBgNVBAcTCUFtc3RlcmRhbT…text/html2016-03-01T11:58:55+00:00Anonymous (anonymous@undisclosed.example.com)tcs_cachain_3_ev
https://docu.units.it/dokuwiki/certificati:server:tcs_cachain_3_ev?rev=1456833535&do=diff
DigiCert High Assurance EV
Per certificati High Assurance Extended Validation (validi massimo 2 anni) rilasciati dopo il 1.7.2015
#
# TERENA SSL High Assurance CA 3
-----BEGIN CERTIFICATE-----
MIIE4DCCA8igAwIBAgIQC1w0NWdbJGfA1zI3+Q1flDANBgkqhkiG9w0BAQsFADBs
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
ZSBFViBSb290IENBMB4XDTE0MTExODEyMDAwMFoXDTI0MTExODEyMDAwMFowczEL
MAkGA1UEBhMCTkwxFjAUBgNVBAgTDU5vb3JkLUhvbGxh…text/html2016-03-01T11:53:09+00:00Anonymous (anonymous@undisclosed.example.com)tcs_cachain_3
https://docu.units.it/dokuwiki/certificati:server:tcs_cachain_3?rev=1456833189&do=diff
CA Chain DigiCert
Per certificati rilasciati dopo il 1.7.2015
# TERENA SSL CA 3
-----BEGIN CERTIFICATE-----
MIIE+zCCA+OgAwIBAgIQCHC8xa8/25Wakctq7u/kZTANBgkqhkiG9w0BAQsFADBl
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv
b3QgQ0EwHhcNMTQxMTE4MTIwMDAwWhcNMjQxMTE4MTIwMDAwWjBkMQswCQYDVQQG
EwJOTDEWMBQGA1UECBMNTm9vcmQtSG9sbGFuZDESMBAGA1UEBxMJQW1zdGVyZGFt
MQ8wDQYDVQQKEwZURVJFTkExGDAWBgNVBAMTD1RFUkVOQSBTU0wgQ0EgMzCCASIw…text/html2025-08-28T13:52:07+00:00Anonymous (anonymous@undisclosed.example.com)tcs_cachain_harica_geant
https://docu.units.it/dokuwiki/certificati:server:tcs_cachain_harica_geant?rev=1756389127&do=diff
CA Chain HARICA con intermediate GÉANT
Per certificati rilasciati dopo il 6.3.2025
CA Chain per certificati ECC
Se la vostra chiave privata è di tipo ECC (crittografia a curva ellittica), usare questa CA chain.
SUB CA GEANT
Subject: C = GR, O = Hellenic Academic and Research Institutions CA, CN = GEANT TLS ECC 1
Issuer: C = GR, O = Hellenic Academic and Research Institutions CA, CN = HARICA TLS ECC Root CA 2021
-----BEGIN CERTIFICATE-----
MIIDNzCCArygAwIBAgIQQv3c4SYWB+Gl5pNaQAFh3TAKBggqhkj…text/html2025-02-10T08:58:10+00:00Anonymous (anonymous@undisclosed.example.com)tcs_cachain_harica
https://docu.units.it/dokuwiki/certificati:server:tcs_cachain_harica?rev=1739177890&do=diff
CA Chain HARICA
Per certificati rilasciati dopo il 3.2.2025
CA Chain per certificati ECC
Se la vostra chiave privata è di tipo ECC (crittografia a curva ellittica), usare questa CA chain.
Serial Number: 62:11:66:e7:7a:36:5b:2a:ff:f9:2e:c9:23:2d:53:68
Signature Algorithm: ecdsa-with-SHA384
Issuer: C=GR, O=Hellenic Academic and Research Institutions CA, CN=HARICA TLS ECC Root CA 2021
Subject: C=GR, O=Hellenic Academic and Research Institutions CA, CN=HARICA DV TLS ECC
-----BEGIN CERTIFICATE-…text/html2022-02-24T15:33:46+00:00Anonymous (anonymous@undisclosed.example.com)tcs_cachain_sectigo0
https://docu.units.it/dokuwiki/certificati:server:tcs_cachain_sectigo0?rev=1645716826&do=diff
Root CA Sectigo
Per certificati rilasciati dopo il 5.5.2020
# USERTrust RSA Certification Authority
# SHA-256 fingerprint E7:93:C9:B0:2F:D8:AA:13:E2:1C:31:22:8A:CC:B0:81:19:64:3B:74:9C:89:89:64:B1:74:6D:46:C3:D4:CB:D2
# 1/5/2033
-----BEGIN CERTIFICATE-----
MIIG5TCCBM2gAwIBAgIRANpDvROb0li7TdYcrMTz2+AwDQYJKoZIhvcNAQEMBQAw
gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK
ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD
VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQ…text/html2025-02-07T11:51:49+00:00Anonymous (anonymous@undisclosed.example.com)tcs_cachain_sectigo1
https://docu.units.it/dokuwiki/certificati:server:tcs_cachain_sectigo1?rev=1738929109&do=diff
CA Chain Sectigo
Per certificati rilasciati dopo il 5.5.2020 e prima del 10.01.2025
# AAA Certificate Services
# Expires: 01/01/2029.
# Root Certificate
-----BEGIN CERTIFICATE-----
MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj
YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL
MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQ…text/html2016-03-01T11:56:31+00:00Anonymous (anonymous@undisclosed.example.com)tcs_cachain
https://docu.units.it/dokuwiki/certificati:server:tcs_cachain?rev=1456833391&do=diff
Terena TCS CA Chain
Per certificati rilasciati prima del 8.10.2014
# TERENA SSL CA
-----BEGIN CERTIFICATE-----
MIIEmDCCA4CgAwIBAgIQS8gUAy8H+mqk8Nop32F5ujANBgkqhkiG9w0BAQUFADCB
lzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug
Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho
dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3Qt
SGFyZHdhcmUwHhcNMDkwNTE4MDAwMDAwWhcNMjAwNTMwMTA0ODM4WjA2MQswCQYD
VQQGEwJOTDEPMA0GA1UEChMGVEVSRU5BMRYwFAYDVQQDEw1URVJFTkEgU1NMI…