Jefferson Lab Root Certificate Authority -- Client Instructions


JLab maintains its own Certificate Authority to create and sign TLS/SSL certificates used to secure connections to numerous web and other network services. You must install JLab's signing certificate into your web browsers, email, and other clients that use TLS/SSL for secure connections. Without installing this certificate, some clients may generate warnings, while others may simply not connect.

JLAB Windows domain systems receive the JLab root certificate by default and place it in the system-wide certificate trust store. Windows integrated applications use this trust store by default and so should not generate warnings regarding JLab issued certificates. Applications that do not use this common central certificate repository will need to have the certificate installed explicitly. Examples of such applications include Firefocx and Thunderbird.

Note: Some programs give you the option of adding an exception, or otherwise ignoring whatever warning condition is detected. Such exceptions should never be made unless you are very certain that the exception is safe. A far better approach is to install the JLab root certificate so that your system or application will accept certificates issued by JLab by default.

JLab Root Signing Certificate

The certificate file that must be installed is available via the link below. It's identifying "fingerprint" (also, occasionally called the "thumbprint") is also provided. When installing any certificate, its fingerprint should be confirmed using a trusted source to insure the certificate is not forged.
  Depending on the program, the fingerprint is sometimes shown with colons between
  each pair of digits. This does not constitute a mismatch, it is simply 
  an attempt to make it easier to read.
  
  Both of the links above are for the same certificate in two different formats. You only
  need one or the other in any single system or application. Both formats are provided to make it 
  easier in cases where you have a system that prefers one format over the other.
Note: For convenience, this certificate file is also available at

Instructions

Instructions are provided below for Thunderbird, and several common web browsers -- Firefox, Internet Explorer and Chrome. Instructions are also provided for subversion. Instructions for other applications will be added if needed.

Step 1 -- Download and save the certificate for installation

Most web browsers allow you to doanload and open certificate files in one step, and then provide the option to install the certificate if desired. For other applications, you will need to download and save the certificate file on your system, and then install it into the application.

Step 2 -- Install the certificate in Common Applications

Install the certificate in Firefox

Assuming you are viwewing this page in Firefox, the certificate can be installed directly (without first saving it to a file on your system).

Thunderbird

If you use Thunderbird as an email client, you must first download and save the certificate file as described in step 1. Then, the filel is installed into Thunderbird using the steps below. Upon completion of the steps above, Thunderbird should now happily connect to JLab TLS/SSL-enabld mail servers without generating warnings. If you get any warnings or errors from here on, they should be reported and the cause found and fixed.

Microsoft Edge

Edge is Microsoft's new web browser that is available in Windows 10. For JLab Domain Windows systems, the certificate shoudl be installed by default, so you should not need to perform these steps.

When you click on the certificate link provided above, Edge will download the file by default and save it in your Downloads directory. Once the donwload is complete, you should get a dialog bar at the bottom of the browser windows askign whether you wish to open the file or View Downloads.

Internet Explorer (IE)

With IE, when you click on the URL link above, you will get a dialog asking to open or save the file.

Chrome

Chrome uses the same set of Certificates as IE. So, if you've installed the certificate for Internet Explorer, it is not necessary to install it in Chrome. If you use Chrome but not IE, the process of installing it is similar --

Subversion Command-line client

Installing the JLab Root Certificate into your Subversion Configuration

By installing the JLab root certificate into your subversion configuration, subversion will inherently trust certificates that are issued by the JLab PKI as long as they match the name you asked to connect to, they are within their validity period and have not been revoked (assuming your subversion client performs revocation checking). This is useful since certificates expire and must be replaced from time to time and such changes will trigger warnings if you explicitly trusted the individual server certificate previously by telling subversion to accept the certificate permanently.

To install the jlab root certificate into subversion --

Connecting Without Installing the Jlab Root Certificate into Subversion

If you do not install the JLab root certificate in your Subversion configuration, when you connect to an https-based subversion server URL, the client will inform you that
Error validating server certificate for 'https://someserver.jlab.org:443':
 - The certificate is not issued by a trusted authority. Use the
   fingerprint to validate the certificate manually!
Certificate information:
 - Hostname: someserver
 - Valid: from Mon, 11 Jul 2016 13:04:04 GMT until Tue, 09 Jul 2019 16:26:29 GMT
 - Issuer: jlab, org
 - Fingerprint: <hex fingerprint>
(R)eject, accept (t)emporarily or accept (p)ermanently?

You can choose to reject the connection, or accept it temporarily (for this session only), or accept it permanently. The last option stores the certificate into your subversion configuration so that if you connect to the same server again, you will not be prompted.

The fingerprint given is the fingerprint of the subversion server"s certificate -- not of the root certificate provided above. So, you should compare the thumbprint provided to the thumbprint below for the particular server you are connecting to.

SHA1 Fingerprints for current certificates of JLab https subversion servers is provided below

Subversion ServerCertificate Fingerprint
svncccd4:9b:4a:b9:54:be:ef:ab:89:bd:f8:fe:58:65:16:dc:9c:c4:38:d9
svncasaed:aa:8a:9d:d9:13:32:32:ff:50:5e:65:6a:26:b4:ea:d1:c5:7d:45
qweaksvn00:81:e6:f7:33:6c:83:aa:34:d3:5b:5b:cf:59:b4:5b:00:63:8e:46
jlabsvnd7:fb:15:9b:be:04:58:03:a2:8d:c5:a5:bc:49:83:42:3a:d5:42:40
halldsvnc4:1d:45:5c:77:de:83:de:94:a8:76:e7:a3:df:4a:70:17:d7:71:19
clas12svnf6:fd:49:2e:c7:79:09:93:c4:d6:c0:30:8e:44:6c:aa:e3:32:0b:2f
phys12svn27:6f:7d:62:e5:a2:77:1c:a0:8d:9a:d9:80:7a:9f:7b:1f:e2:40:b1