TLS certificates

Any service accessible via TLS (https) must have an TLS certificate. This includes any web server with encrypted or “secure” content. An TLS (Transport Layer Security, see RFC 8446) certificate is a signed electronic guarantee that a particular server is the server it claims to be. Certificates are used primarily (but not exclusively) for providing web pages via an encrypted connection. A certificate is signed by a Certificate Authority (CA) which ensures the integrity of the certificate.

A few Certificate Authorities such as Let’s Encrypt, Verisign, Thawte, and Terena are automatically trusted by TLS clients (including web browsers), so certificates signed by these companies are validated without user confirmation. All C&CZ certificates of servers and web applications are signed by Terena (through SURFdiensten).

Obtaining a certificate

Because TLS certificates are used as proof of the validity of the web site or server, it is not possible to acquire a signed TLS certificate for just any domain name. The Certificate Authorities check if the person or organisation requesting a certificate is indeed the owner of the domain name for which the certificate is requested. Domain names registered through C&CZ are owned by the Radboud University. Therefore C&CZ can also request TLS Certificates for these domain names.

Heartbleed OpenSSL bug

April 7, 2014, a two-year-old vulnerability was announced in several versions of OpenSSL. OpenSSL is used for encrypting network traffic. Because of this vulnerability, an attacker could have retrieved the secret key of a service, with which traffic could be decrypted. In addition to this, due to this vulnerability an attacker could read the memory of the service, thereby retrieving sensitive information like passwords.

After the announcement of this Heart Bleed OpenSSL leak all vulnerable C&CZ services were automatically repaired. On Thursday, April 10th, we have deployed new certificates for these services. The old certificates will be revoked. If one has used the following C&CZ services, it is wise to change the Science password on the DIY website. The old password could have become known to an attacker.

The list of vulnerable C&CZ services that employees or students of the Faculty of Science may have used:

  • Mail users:

    • squirrel.science.ru.nl: The old Science webmail service was vulnerable since January 29, 2014.
    • roundcube.science.ru.nl: The new Science webmail service.
    • autoconfig.science.ru.nl: The website for automatic configuration of mail clients like Thunderbird and Outlook.

  • Lecturers: dossiers.science.ru.nl and eduview.science.ru.nl

  • MySQL database owners: phpmyadmin.science.ru.nl

  • FNWI news letter editors: newsroom.science.ru.nl

  • Websites of departments and study association:

Other organisations than C&CZ will also inform users about the need to change passwords due to this vulnerability. A few examples: