The CERTInext Dashboard requires an invitation to be able to access it. These invitations are created by ISO.

There are various roles that can be assigned, including custom roles that ISO has designed. After logging in, the Dashboard will display the options available to your account - and will be completely dependent on what role you have been assigned and what permissions are allowed within that role.

When you visit the above URL, you will be presented with the following login page, use the credentials that you established when accepting your invitation. You can not use SSO, Google or Microsoft. You also can not click “Sign up”.

Open

Open

Part	Description / Function

Part	Description / Function
Organization	This will always be “The University of Texas at Austin”.
Group Selector	Open The Group menu shows the CERTInext Groups associated with the account. An account may be associated with multiple Groups. Groups are used to control certificate permissions, including which domains/FQDNs the account is permitted to use.
Dashboard	Clicking this returns you to the original dashboard that you see when you first log in.
Certificates	Open Note: “Provisioning” is yet supported and may produce an error. Click “Orders” and you will be presented with the a page that has three tabs: Orders, Organization, Domains. Open Orders: Displays certificate orders (requests) and their status. Organizations: Displays the organizations that CERTInext uses for certificate identities. Domains: Displays all known domains to CERTInext and their DCV (Domain Control Validaton) status.
Integrations	Open The only option that is currently supported is “APIs”. This is when ACME and REST API accounts are created. It will show any previously created accounts in a list below. It will display the columns: Created Date: when the account was created API type: An ACME or REST API account. CA Connector: Should always show “emsign”. Identifier: The name given to the credential. API key credentials: Will show “View”, when clicked displays the credentials Group Name: The group assigned to the credential User: The user account that the credential is assigned. Products: What product can be issued by the credential. Tags: Any user supplied “tags” (for organizational purposes) Status: The status of the credential (disabled or active).

Collect the CN (Common Name), hostname, or FQDNs, including any SANs (additional domains) from the ticket. For each domain, check that it has been validated.

Check the (DC) SPLUNK Dashboards (refreshed daily at 4 AM from CERTINext). Only domains showing green / verified can have certificates issued against them. Anything still pending will be rejected — the portal will refuse the request rather than queue it. You can filter the dashboard to verified-only, or substring-search the domain name.

1. Log in to the CERTINext portal.

2. Click the large black "new certificate" button on the left.

   Open

   

3. If group shows up (will only show up if you have been assigned to multiple groups), you will need to select which group you wish to attempt to create the certificate under. Remember that a certificate can only be created for a domain that is registered within a specific group.

4. CA Source → select emSign.

5. Certificate Type → select SSL/TSL Certifactes.

6. Product → Choose the appropriate certificate product.

   Open

   

   • If the certificate has a single domain, choose “InCommon OV SSL Certificate”.

   • If the certificate has a SANs, choose “InCommon OV SSL Certificate UCC”.

7. Click Next.

8. Paste the CSR.
   A CSR is required! The end user should provide you one attached to the ticket. If they have not, you will need to request one.

9. Click Next. The portal validates the CSR and if it can not continue, it will explain why.

10. Organization details.

    • Review the organizational information – it should have at minimum the following information.

      • Organization: The University of Texas at Austin

      • State: Texas

      • Country: US

    • Ignore the fields: “Street Address 1”, “Street Address 2”, “Organization Unit”, “City”, and “Postal Code”. These are not used as documented in the RFC 5280, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile."

    • Ignore the fields with “*” (red asterisks). They are not enforced.

11. Contact / Download Delegation: Skip this section entirely.
    You can supply a “Contact name” and “Email ID” should you wish to have a download link sent to that person that will contain the certificate and chain.

12. Click Next.

13. Certificate Information
    Verify that the domain name and any SANs are correct, based on the information found in the ticket.
    DO NOT click “Automatically secure 'www' variant of websites.”

14. Click Next.

15. Additional Information

    • Auto-renew → OFF. Always. The client should handle renewal via automation.

    • No check boxes should be selected.

    • You more than welcome to add tags or order remarks if you wish, they are not required.

16. Order Summary

    • Last chance to verify the domain name (CN, FQDN, hostname) and additional SANs.

17. Click Submit.

18. Review the information provided. It will display everything about the new certificate order. How long it is valid, when it will expire, along with other information.

On the right, click Certificates → Orders.	Open
Click the “Orders” tab.	Open
Scroll to the right side and look for the “Order Status” column. Locate your certificate (should be near the top). Wait for the status to change to Order Fulfilled.	Open
Click the “View” button.
Click on the three-dot menu. Click Download Certificate	Open
Select “Zip” Click “Download”. A file should be downloaded to your computer (in your Downloads folder).	Open

• Send the ZIP file to the requester (attach it to ServiceNow ticket).
  Inform the customer that they might receive an email with download links (if you entered their email address, see Step 11 above).

• Copy the above information (Zip File contents) and paste that into the ticket, so the requester know what each file is.

The requester should know their service and what certificates are required, if they need assistance, escalate: https://cloud.wikis.utexas.edu/wiki/spaces/digitalcertificates/pages/1721073730.