CA certificates

The tables below list all ever used X.509 certificates of the University Certification Authority Münster as well as the respective superordinate certification authorities in different formats. The years indicate the periods of use, not the periods of validity.

For security reasons certificates are always used for a limited period only as specified in the certification policies. Thereafter new certificates are used. The old certificates remain valid until their end of life, however, and are still needed to check the certificates issued with them.

When clicking on Import the certificate is downloaded in binary format for automatically importing into your WWW program. When clicking on Binary the certificate is downloaded in the same format but for saving as file. When clicking on Text (.pem) or Text (.crt), the certificate is downloaded in PEM format for saving with the indicated file name extension. When clicking on Binary (.p7b), the certificate is downloaded in PKCS#7 format for saving with the indicated file name extension.

PDF certificates

The digital PDF IDs are signed directly by the root certificate of our own PDF CA, so there is no hierarchy or chain.

 

PDF CA (root CA)

Now
↑
2022

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

“TCS” certificates

GÉANT TCS uses different CA certificates from different contractors for different key types (RSA, ECC), different certificate purposes (person, code signing, server), different scopes of application (normal, eScience), different request paths (normal, ACME) and different time periods (2021→2025, 2025→now).

The root certificates are built into all current programs. Very old software does not yet recognize newer root certificates, which is why such root certificates are cross-certified by older root certificates. (Only) If you need very old software to be able to establish connections to your server, you should use the chain with the cross-certificate.

 

intermediate CA

root CA

alternative root CA

chain (see below)

Now
↑
2025

User RSA certificates:

GEANT S/MIME RSA 1
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

HARICA S/MIME RSA
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

HARICA Client RSA Root CA 2021
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Server RSA certificates:

GEANT TLS RSA 1
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

HARICA OV TLS RSA
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

HARICA TLS RSA Root CA 2021
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Or as a cross certificate from the alternative root CA:

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Hellenic Academic and Research Institutions RootCA 2015
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Oder mit dem Cross-Zertifikat:

Text (with root)
Text (without root)

User ECC certificates:

GEANT S/MIME ECC 1
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

HARICA S/MIME ECC
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

HARICA Client ECC Root CA 2021
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Server ECC certificates:

GEANT TLS ECC 1
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

HARICA OV TLS ECC
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

HARICA TLS ECC Root CA 2021
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Or as a cross certificate from the alternative root CA:

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Hellenic Academic and Research Institutions ECC RootCA 2015
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Oder mit dem Cross-Zertifikat:

Text (with root)
Text (without root)

 

intermediate CA

root CA

alternative root CA

chain (see below)

2025
↑
2021

User RSA certificates:

GEANT Personal CA 4
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

USERTrust RSA Certification Authority
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Or as a cross certificate from the alternative root CA:

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

AAA Certificate Services
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

User eScience RSA certificates:

GEANT eScience Personal CA 4
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Code Signing RSA certificates:

GEANT Code Signing CA 4
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server RSA certificates:

GEANT OV RSA CA 4
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server eScience RSA certificates:

GEANT eScience SSL CA 4
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server RSA certificates via ACME:

Sectigo RSA Organization Validation Secure Server CA
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

User ECC certificates:

GEANT Personal ECC CA 4
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

USERTrust ECC Certification Authority
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Or as a cross certificate from the alternative root CA:

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

User eScience ECC certificates:

GEANT eScience Personal ECC CA 4
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server ECC certificates:

GEANT OV ECC CA 4
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server eScience ECC certificates:

GEANT eScience SSL ECC CA 4
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

Server ECC certificates via ACME:

Sectigo ECC Organization Validation Secure Server CA
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Or with the cross certificate:

Text (with root)
Text (without root)

“Global” certificates and predecessors

These hierarchies were in use until end of 2024.

 

CA Uni MS

DFN-PCA

root CA

chain (see below)

2022
↑
2016

DFN-Verein Global Issuing CA
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

DFN-Verein Certification Authority 2
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

T-TeleSec GlobalRoot Class 2
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

Text (current and historic CA certificates)

2016
↑
2014

Zertifizierungsstelle Universitaet Muenster - G02
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

DFN-Verein PCA Global - G01
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Deutsche Telekom Root CA 2
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

2014

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)
(revoked)

Text (with root)
Text (without root)
(revoked)

2014
↑
2007

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

2007
↑
2006

Zertifizierungsstelle Universitaet Muenster (Classic) 2006-2007
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

DFN-Verein PCA Classic - G01
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

2005
↑
2004

Zertifizierungsstelle 2004-2005
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

DFN Toplevel Certification Authority
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

2003
↑
2002

Zertifizierungsstelle 2002-2003
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

2001
↑
2000

Zertifizierungsstelle 2002-2003
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

DFN Top Level Certification Authority
Import (.der)
Import (.cer)
Binary
Text (.pem)
Text (.crt)
Binary (.p7b)

Text (with root)
Text (without root)

“Community” certificates

 

intermediate CA

root CA

chain (see below.)

2042
↑
2022

DFN-Verein Community Issuing CA 2022
Import (.der)
Import (.cer)
Binär
Text (.pem)
Text (.crt)
Binär (.p7b)

DFN-Verein Community Root CA 2022
Import (.der)
Import (.cer)
Binär
Text (.pem)
Text (.crt)
Binär (.p7b)

Text (mit Wurzel)
Text (ohne Wurzel)

Remarks

The column chain lists files containing the certificates of the CA of the University of Münster and the superordinate certification authorities, both with and without the respective root certificate. Those who operate Apache WWW servers should download the file without root certificate and indicate this file in the configuration option SSLCertificateChainFile to save the users from importing the CA certificate into their browsers.

Those who operate other SSL/TLS server software should indicate in the configuration first the private key of the server, second the certificate of the server, and third the chain without root. With some software it may be necessary to merge all three parts in this order, perhaps separated by an empty line, into a simple text file and to indicate this file in the configuration.

Usually, the cross certificate and the alternative root certificate should no longer be needed. Only very old software does no longer know the USERTrust root certificates.

OpenPGP

For completeness the OpenPGP keys formerly used for certification are listed here.

 

PGP CA Uni MS

PGP DFN-PCA

 

(Service discontinued by the end of 2011)

(Service discontinued by the end of 2009)

2011 ← 2010

Text

2009 ← 2008

Text

Text

2007 ← 2006

Text

2005 ← 2004

Text

Text

2003 ← 2002

Text

Text

2001

Text

Text

2000

Text

1999

Text
(predecessor)

1998 ← 1997

Text