TRIUMF Certificate Authority

TRIUMF users should install this root certificate on TRIUMF computers. (You may, if you wish, install this certificate on personal devices, or on machines at other institutions where authorized.)

Installation:

URL of certificate in PEM (ASCII) format: triumfca.pem, DER (binary) format: triumfca.cer - use for downloading with e.g. wget

This page should be identified as the secure site https://ca.triumf.ca; see how to verify a website identity. The certificate SHA1 Fingerprint when installed should be 0C:CA:3D:69:78:81:15:48:75:53:65:8A:D9:24:30:3A:90:EA:32:F9. If you are in any doubt of the validity of this site or of the certificate, contact the TRIUMF Computing department.

Mozilla browsers (Firefox, Mozilla, SeaMonkey)
Internet Explorer 6
Internet Explorer 7 (similar in IE8, IE9, Windows 7)
Safari and MacOS applications (mail)
Thunderbird (if using smtp.triumf.ca from offsite, or using the staff LDAP addressbook)

Viewing the certificate of a certified website such as https://ccnweb.triumf.ca should now show "verified by TRIUMF", as per this screenshot or this one

Why Bother

TRIUMF requires that passwords and other sensitive information entered in Web pages be protected with SSL - otherwise eavesdroppers can see them on the wireless LAN. Installing our own root certificate gets rid of these security alerts every time we commission a new server.

By completing this installation, you acknowledge that you trust TRIUMF Computing Services to verify the identity of TRIUMF servers, personnel and software providers.

Advanced Topics

Other Clients (Pine, Konqueror ...), also openSSL/openLDAP based clients
System-wide install (Linux only)
Sun (Oracle) Java Linux, Windows
Policy
Signing Documents

For Server Administrators:

Servers (Apache, IMAP, sendmail ...)

About SSL Certificates (Wikipedia)
How to verify a website identity

this page may be referred to as ca.triumf.ca