CSAIL Web Certificates

CSAIL Web Certificates allow your browser to prove your identity to secure CSAIL websites. They expire a year after you obtain them, or earlier if your account expires earlier. You must have an active CSAIL account before you can obtain certificates. Just as CSAIL accounts are distinct from MIT/Athena accounts, CSAIL certificates are distinct from MIT certificates.

(Re-)obtaining certificates

Please follow directions for your browser, if it is listed below:

• Mozilla Firefox/Iceweasel -- recommended
• Apple Safari
• iPhone ("Mobile Safari")
• Microsoft Internet Explorer
  • IE on Windows XP (or on Windows Mobile devices)
  • Workaround for Windows Vista, Windows 7, etc.
• Google Chrome

Otherwise, these generic directions may help:

1. Install both authority certificates, master.cer and new-master.cer (Click YES to any "trust" checkboxes.)
   • The "Master CA" lets your browser recognize and trust secure CSAIL websites. The "new" Master CA is being phased in over 2011-2012.
2. Request a CSAIL client certificate for your browser
3. Back up your certificate (optional)
   • If you expect to encrypt or sign mail and documents with your certificate, you may wish to export it and store it somewhere safe.

Troubleshooting

You can visit https://inquir.csail.mit.edu/cgi-bin/check-certificate to check the client certificate your browser is presenting to CSAIL Web servers. If your certificate is valid, this page will display information about it.

Common issues

• ssl_error_expired_cert_alert or other "your certificate has expired" errors
  • Your certificates may truly be expired, in which case you should obtain new certificates (see above)
  • If not (for example, if that doesn't help!) see Certificates expired fix.

For other known issues, see browser-specific pages (at top).

Verifying the validity of the authority certificates

There is a printed copy of the Master CA certificate available for your inspection at the TIG Help Desk (32-276). For convenience, the certificate checksums are also given below (but you should not trust this server any more than another):

  SHA-1: F91B A9CC 76F0 68EA 8131   5A08 10AB A637 B812 0792
    MD5: 0E88 F332 92DC 1DC2   91E7 0FC2 AD2A ADC4