InCommon Certificate Service SSO and MFA Available
The use of single sign-on and multifactor authentication for accessing the Comodo Certificate Manager is available to any subscriber that also operates an Identity Provider in the InCommon Federation. See this wiki page for details.
The InCommon Certificate Service issues unlimited Extended Validation (EV) SSL/TLS certificates at no additional cost to subscribers. Because EV certificates require additional levels of validation for the requesting organization, our partner Comodo must handle all of the paperwork as well as the validation process for EV certificates.
InCommon and Comodo also offer Anchor Certificates, which pre-validates domains for future EV certificate requests. When you create an Anchor Certificate, you go through the same validation process as an EV certificate, with the anchor valid for approximately 13 months. The anchor is not an actual certificate, but when applied to all of your domains, you can request EV certificates with no further validation during the life of the anchor.
What are EV Certs?
An extended validation certificate is a X.509 public key infrastructure (PKI) digital certificate in which identifying information about the business entity holding the certificate for a web site or other server has been validated by the certificate authority (CA). The CA uses a standardized set of requirements that also set requirements for auditing, revocation and certificate content. Extended validation certificates are generally considered to be high assurance certificates as that term is used within the PKI community.
Why the additional paperwork?
EV certificates have higher validation requirements and are issued by Comodo under a separate Certification Authority (CA). Because of the formal requirements that all EV certificates must comply with, Comodo must manage the validation process with separate governing legal terms. For EV certificates, InCommon subscription covers the fees and the same Certificate management interface, while Comodo directly engages with the university on legal and validation terms.
First-time EV Cert Requests
- Confirm Domain Approval - Confirm that the domain for which you are requesting the EV certificate has already been approved by InCommon.
- Request an EV Cert via the Certificate Manager (CM)
- Comodo CA requires the completion of two documents for EV Validation. The Subscriber agreement is accepted when the initial EV certificate is requested. The Certificate Request form is emailed to the requestor with instruction on how to click thru to complete the process.
- EV SSL Certificate Subscriber Agreement - The EV SSL Certificate Subscriber Agreement is separate from the InCommon Certificate Service Addendum. There is no additional charge for EV certificates, but this agreement with Comodo is required. This is required once per organization.
- EV SSL Certificate Request Form
Be sure to list all domains for which you intend to request EV certificates in both the Legal Opinion and the EV Certificate Request Form. Listing the parent domain will cover all sub-domains. For example, listing foo.edu is sufficient to cover web1.foo.edu, web2.foo.edu, etc.
Requesting an EV Anchor
| An anchor certificate will pre-validate domains for future EV certificate requests. All domains that require an EV certificate should be included in this request. If a domain is not listed in this request, you can still request an EV certificate; however, there the order will need to be processed manually by a validatior. There is no prerequisite to create an EV anchor certificate yet we suggest every organization follow the following steps. Please note there is only one EV anchor certificate that can be applied to each organization (school). This procedure does not change current certificate ordering process - it is simply to help make EV processing more efficient. The EV Anchor is NOT an actual certificate that can be used. |
