University of Strathclyde Digital Certificates

This page contains information about digital certificates and their respective issuing Certificate Authorities. It may be used to verify certificate information being offered by services.

If you note any discrepancies, either on this page, or with servers purporting to be related to the University but not covered by this information, or you have any other questions, then please let us know via certmaster@strath.ac.uk.

Local (Strathclyde) Certificate Authorities

Strathclyde Network Support Root CA 1

The Network Team operates a Certificate Authority, for internal purposes.

The root certificate is:

• Subject (Issued to): /C=UK/ST=Scotland/O=The University Of Strathclyde/OU=Information Services/CN=University Of Strathclyde Network Support Root CA 1
• Issued By: /C=UK/ST=Scotland/O=The University Of Strathclyde/OU=Information Services/CN=University Of Strathclyde Network Support Root CA 1
• Valid not before: Jan 12 15:20:06 2016 GMT
• Valid not after: Jan 4 15:20:06 2046 GMT
• SHA1 fingerprint (thumbprint): CB:BF:F5:C0:AB:77:5F:83:B1:0F:D4:43:17:B6:04:17:B3:9D:0F:C8
• Download: [PEM]

ITS-ROOTCA

The DS Windows domain operates a Certificate Authority, for internal purposes.

The root certificate is:

• Subject (Issued to): /CN=ITS-ROOTCA
• Issued By: /CN=ITS-ROOTCA
• Serial: 658B0D984A4DF7A84B33EA22042E2754
• Valid not before: Feb 7 15:00:11 2017 GMT
• Valid not after: Feb 7 15:10:06 2037 GMT
• SHA1 fingerprint (thumbprint): 1E:44:E6:FD:61:D3:EC:9D:16:6E:ED:5F:B7:85:22:18:3B:B4:1D:DE
• SHA256 fingerprint (thumbprint): B4:E2:12:1D:CA:C6:58:22:8D:08:6C:14:47:9C:B1:89:9F:04:F8:24:93:EC:40:8C:B0:4E:DC:93:17:B1:CD:67
• Download: [PEM]

There is an intermediate certificate:

• Subject (Issued to): /DC=uk/DC=ac/DC=strath/DC=ds/CN=ITS-CA1
• Issued By: /CN=ITS-ROOTCA
• Serial: 51000000029A19EB285B26B70F000000000002
• Valid not before: Feb 8 10:35:36 2017 GMT
• Valid not after: Feb 8 10:45:36 2027 GMT
• SHA1 fingerprint (thumbprint): FF:79:EC:6A:B2:42:AB:AF:4A:BA:E6:6C:BB:05:61:BD:06:DA:A3:64
• SHA256 fingerprint (thumbprint): A0:71:33:86:C0:C7:37:35:C2:FC:04:B0:90:48:00:FD:84:CF:18:CF:3D:F6:D4:B4:E6:DF:0C:D7:67:D2:45:22
• Download: [PEM]

Eduroam 802.1X certificates

eduroam.strath.ac.uk

The following certificate is in use for 802.1X authentication via eduroam. It is issued and signed by Strathclyde Network Support Root CA 1.

• Subject (Issued to):C = UK, ST = Scotland, L = Glasgow, O = The University Of Strathclyde, OU = Information Services, CN = eduroam.strath.ac.uk
• Issued By: C = UK, ST = Scotland, O = The University Of Strathclyde, OU = Information Services, CN = University Of Strathclyde Network Support Root CA 1
• Serial: B44369B8B7768C3F
• Valid not before: Jul 30 18:36:02 2026 GMT
• Valid not after: Feb 24 18:36:02 2032 GMT
• SHA1 fingerprint (thumbprint): 01:D2:1B:50:4F:00:A3:B6:5A:D0:5B:92:44:54:5E:B5:57:82:73:23
• SHA256 fingerprint (thumbprint): 83:21:5F:59:F0:86:DB:D4:46:D6:A9:27:8C:88:9F:43:89:DC:48:9D:30:F3:D1:70:42:CD:9E:CF:A2:DC:74:67
• Download: [PEM]

Commercial certificates via Sectigo (arrangement from 2025)

The University has a contract with Sectigo for 2 years from April 2025 for TLS certificates.

Certificate chain:

• AAA Certificate Services [root]
  • USERTrust RSA Certification Authority [subordinate CA 1]
    • Sectigo RSA Organizational Validation Secure Server CA [subordinate CA 2]
      • Server certificate

Note that for certificates issued from May 15 2025, the Root and Subordinate CA certificates for RSA based keys will change to be:

• Root CA: Sectigo Public Server Authentication Root R46 (crt.sh record)
• Subordinate CA: Sectigo Public Server Authentication CA OV R36 (crt.sh record)

Note that on 14th April, the CA/Browser Forum voted to amend the TLS Baseline Requirements, setting a schedule for the shorterning of the lifetime of TLS certs:

• Until March 15, 2026, the maximum lifetime for a TLS certificate is 398 days
• As of March 15, 2026, the maximum lifetime for a TLS certificate will be 200 days
• As of March 15, 2027, the maximum lifetime for a TLS certificate will be 100 days
• As of March 15, 2029, the maximum lifetime for a TLS certificate will be 47 days

AAA Certificate Services

This root certificate is used by Sectigo to sign the first subordinate CA (intermediate) certificate, and is signed by itself.

• Subject (Issued to): /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
• Issued By: /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
• Serial: 01
• Valid not before: Jan 1 00:00:00 2004 GMT
• Valid not after: Dec 31 23:59:59 2028 GMT
• SHA1 fingerprint (thumbprint): D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49
• SHA256 fingerprint (thumbprint): D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4
• First line of PEM: MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
• Download: [PEM (local)] | [DER (from Sectigo (Comodo))] | [detailed cert info]

USERTrust RSA Certification Authority

This first subordinate CA (intermediate) certificate is used by Sectigo to sign the second subordinate CA (intermediate) certificate, and is itself signed by the root certificate.

• Subject (Issued to): /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
• Issued By: /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
• Serial: 3972443AF922B751D7D36C10DD313595
• Valid not before: Mar 12 00:00:00 2019 GMT
• Valid not after: Dec 31 23:59:59 2028 GMT
• SHA1 fingerprint (thumbprint): D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C
• SHA256 fingerprint (thumbprint): 68:B9:C7:61:21:9A:5B:1F:01:31:78:44:74:66:5D:B6:1B:BD:B1:09:E0:0F:05:CA:9F:74:24:4E:E5:F5:F5:2B
• First line of PEM: MIIFgTCCBGmgAwIBAgIQOXJEOvkit1HX02wQ3TE1lTANBgkqhkiG9w0BAQwFADB7
• Download: [PEM (local)] | [DER (from Sectigo (Comodo))] | [detailed cert info]

Sectigo RSA Organization Validation Secure Server CA

This second subordinate CA (intermediate) certificate is used by Sectigo to sign the server certificate, and is itself signed by the first subordinate CA (intermediate) certificate.

• Subject (Issued to): subject= C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Organization Validation Secure Server CA
• Issued By: C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority, CN=USERTrust RSA Certification Authority
• Serial: 137D539CAA7C31A9A433701968847A8D
• Valid not before: Nov 2 00:00:00 2018 GMT
• Valid not after: Dec 31 23:59:59 2030 GMT
• SHA1 fingerprint (thumbprint): 40:CE:F3:04:6C:91:6E:D7:AE:55:7F:60:E7:68:42:82:8B:51:DE:53
• SHA256 fingerprint (thumbprint): 72:A3:4A:C2:B4:24:AE:D3:F6:B0:B0:47:55:B8:8C:C0:27:DC:CC:80:6F:DD:B2:2B:4C:D7:C4:77:73:97:3E:C0
• First line of PEM: MIIGGTCCBAGgAwIBAgIQE31TnKp8MamkM3AZaIR6jTANBgkqhkiG9w0BAQwFADCB
• Download: [PEM (local)] | [detailed cert info]

Legacy Information

Information on previous certificates and authorities and services is given here.