Three passwords are to be assigned during the certificate creation process:

• for the certificate revocation (PIN)
• for the .json file
• for the backup of the .p12 file

Be sure to have knowledge of these.

Group: A meaningful name for the e-mail address (it is automatically prefixed with "GRP -" in the subsequent step).

E-mail: The e-mail address for which the certificate shall apply.

Organisational Unit (OU): Full name of your RWTH institution (e.g.: IT Center, Chair of Computer Science 12).

Namespace: Here you can choose whether city and state should also be specified as part of the DN.

Full name of the applicant: The name of the actual person submitting the application, as it appears on their identification document. This person must also submit the application to the registration authority.

E-mail of the applicant: Your own e-mail address.

Department: Full name of your RWTH institution (e.g.: IT Center, Chair of Software Construction).

Revocation PIN: The PIN is needed to revoke the received certificate if obsolete/compromised. Please keep this PIN in a safe place.

Personal note: This note will be saved in the .json file.

You must agree to comply to the regulations.

You may agree to the publication of the certificate.

You must agree to the processing of your personal data.

Check submitted information and if correct select "Save certificate application data file (JSON)".

This step creates a .json file with the submitted information about the certificate and the applicant as well as the cryptographic keys (RSA keys) to the certificate.

The .json file is stored in encrypted format, you need to assign a password for this encryption. Prepare the .json password.

Enter the password with which the .json file will be encrypted.

You must keep the .json file and its password safe.

You will need both in order to "collect" the issued certificate.

Download certificate application form (PDF):

You need to submit or bring the printed .pdf file to the registration authority so that the personal identification of the applicant can take place.

Save certificate application data file (JSON) again:
Here you can download and save the application file (JSON) again, should you have failed to do so in step 4.

Save and/or print the .pdf file. Read it, date it and sign it by hand.

As the contents of the application form (PDF file) are currently not displayed in English, here in short what you are agreeing to:

• you are not allowed to disclose your private RSA key to users outside the designated group

• all devices on which you use your private RSA key (in extension your DFN-PKI certificate) are adequately protected from unauthorised access and abuse

• your are required to revocate your certificate if any of the following applies:

  • any data, included in the certificate, is no longer valid/applicable

  • your private RSA key or your password to the file containing it has been compromised

  • you are no longer authorised to use the certificate

  • one of the users leaves the group (i.e. is no longer authorised to use the e-mail address specified under "Alternativer Namen")

The DFN-PKI Certificate Policy mandates that the RWTH Registration Authority performs a personal identification of the applicant, for more details see Possible ways of identity verification in order to submit the certificate application form.