Certificates

Certificate lifetimes and Domain Control Validation (DCV) will be severely reduced until 2029. This was approved in ballot SC-081v3 in April 2025 by the Certification Authority Browser Forum and applies to all PKI TLS certificates.

• Maximum certificate lifetime will be 100 days, with only 10 days of Domain Control Validation (DCV) reuse, from 15 March 2028.
• Maximum certificate lifetime will be 47 days, with only 10 days of Domain Control Validation (DCV) reuse, from 15 March 2029.

Institutions should therefore have an automation strategy -- and implementation -- for all PKI TLS certificates throughout their organization before 15/3 2029 at the latest. DeiC can help with advice, workshops, consultants or with our free ACME-DNS service, that simplifies and secures DNS-01 challenges for possible wildcard and internal server certificates using the ACME protocol.

Through GÉANT's partnership with HARICA (Certificate Authority), all institutions on Forskningsnettet can now order:

• Domain Validated (DV) Server Certificates
• Organisation Validated (OV) Server Certificates
• OV IGTF Server Certificates
• IGTF Client Authentication Certificates
• Email Only S/MIME Certificates
• IV+OV S/MIME Certificates
• PSD2
  • QWAC Certificates
  • eSeals
• Code Signing Certificates
• eSignatures

Rules for TCS certificates:

1. Certificates may only be used by research, educational and government institutions/departments; no commercial use.
2. The institution must sign a Trusted Certificate Service Subscriber Agreement reflecting HARICA's conditions.
3. The institution must appoint responsible administrator(s) who order certificates on the institution's behalf.
4. DeiC verifies the institution and assigns administrator rights for direct ordering.

If you are not on the Danish Research Network (Forskningsnettet), but are a research, educational or government institution/department, contact us for participation/pricing.

1. Log into HARICA Cert Manager using "Academic Login".
2. Select your institution and authenticate via WAYF.
3. Make sure you have enabled Two-Factor Authentication (2FA) under your Profile on HARICA.

• HARICA support: guides.harica.gr
• GÉANT maintains a FAQ with a lot of answers, like how to use ACME with HARICA
• Enterprise Manager Guide
• Enterprise Admin Guide
• Enterprise Approver Guide
• API documentation: developer.harica.gr
• Staging service for testing without cost: cm-stg.harica.gr

HARICA has a lot of features that make it a great fit for the education sector and a "One Stop Shop" for all your certificates.

• Free and unlimited server and client certificates (even OV certificates) for institutions on Forskningsnettet.
• Ability to order multiple other certificate types from one place (like S/MIME, eSignatures and Code Signing Certificates).
• Support for IGTF certificates (that many commercial CAs don't provide).
• No rate limits. Free CAs like Let's Encrypt limits the number of requests you can make in certain time periods.
• Great support for ACME with two different modes supported:
  • ACME for Enterprise Admins
  • ACME for End Users
• A support desk.
• Certificate Lifecycle Management (CLM) through an easy-to-use portal (CertManager).
• EU based terms and conditions and contractual terms negotiated for you.

GÉANT TCS Certificates

From 1 January 2026 most certificates for institutions on Forskningsnettet are free and unlimited, and included in the Research Network's yearly subscription.

Extended Validation (EV) certificates are not covered but may be ordered directly from HARICA. Code Signing Certificates, eSignatures and eSeals require a hardware token and additional charge for these certificates. See more on TCS Certificate Types 2025 for discount and instructions.

DeiC Services

DeiC's ACME-DNS service with DNS-01 challenge validation is free for everyone on the Danish Research Network. You can also use our free ACME-DNS service with any other Certificate Authority that supports ACME.

DeiC offers consulting support with implementation at DKK 950 per hour.