RA-Portal

Harica is obligated to revoke a substantial number of SSL certificates.
All SSL certificates issued between 15th June and 15th July of 2026 are affected. They will be revoked automatically by Harica starting from 20th July 2026 12:00 CET.
To ensure the availability of your services via SSL (HTTPS, IPSEC), the affected certificates must either be renewed or newly requested and installed on your servers.

Client certificates are unaffected, as well as SSL certificates issued up until 14th June 2026 and starting from 16th July 2026 and onwards.

Background: The SSL certificates were issued with Extended Key Usage "clientAuth", which was against Harica's Certificate Policy Statement from 15th June to 15th July 2026. To preserve the integrity and trustworthiness of the global certificate ecosystem, these non-conforming certificates must be revoked by Harica within a short period of time.

All affected network contact persons will be notified via e-mail by the RA-Portal.

The new SSL certificates still contain EKU clientAuth. It is the combination of clientAuth and issue date 15.06.2026-15.07.2026 that is not CPS compliant.

During the specified maintenance window, the IT Center will perform maintenance on the MySQL databases used by the Multi-Factor Authentication (MFA) service. As part of the maintenance, the databases will be unavailable for a total of approximately 15 minutes.

During this time, new logins to services using RWTH Single Sign-On will not be possible. Existing sessions will remain active and will not be affected by the maintenance.

Trying to send an SSL certificate request to the CA gives you https error 500 with the explanation "undefined method '_fqdn_in_validated_domains?' for an instance of SSLCertificate". We are working on remedying the software error.

Problem solved.

Although you apply for an SSL certificate from the DFN-Verein Community PKI with multiple SANs, the issued certificate contains only the CN as SAN. We are working on resolving this problem. We will inform all affected certificate applicants individually via e-mail, as soon as a solution is in place.

Multiple SANs in the SSL-Certificate are now possible.