DESY CA

| DESY Certificate Authority

DESY CA

DESY Certificate Authority

DESY Certificate Authority

DESY Certificate Authority

We're using GÉANT TCS via DFN. Certificates are currently issued by Sectigo.

For server certificates it's best to use ACME, either via Puppet or a similar centrally managed service or Let's Encrypt. Let's Encrypt can also be used for internal services if you use acme-qip . If ACME ain't an option, you can request server certificates manually.

For user certificates, e.g. to sign your mails, check out the UCO documentation.