Server Certificates

CUIT offers standard, multi-domain (SAN), and wildcard Secure Sockets Layer (SSL) certificates for University departments and affiliates at no additional cost. CUIT purchased a bulk license for the InCommon Certificate Service for unlimited standard, SAN, and wildcard SSL certificates. Through an arrangement with the Internet2 InCommon consortium, these certificates are provided by Comodo, a leading commercial provider of certificates.

Certificates are also required when upgrading sites from HTTP (hyper text transfer protocol) to HTTPS, the secure version of HTTP. A website must have a trusted SSL digital certificate to be labeled as HTTPS in the browser address bar. This security measure ensures communications between the user’s browser and the website are encrypted.

As SSL/TLS certificate lifespans continue to shorten industry-wide—TLS certificate maximum lifetimes decreased from 398 days to 200 days on March 15, 2026, and will further decrease to 100 days on March 15, 2027, and 47 days on March 15, 2029—manual renewal workflows pose an increasingly high risk of accidental service disruptions. To help safeguard university infrastructure, Columbia University IT (CUIT) has outlined updated guidance and operational best practices below to assist departments in transitioning to fully automated certificate management.

Guidance for Departmental (Non-CUIT) System Managers

Departments operating independent servers or services are responsible for selecting, implementing, and maintaining a certificate solution that meets their operational needs. You should begin evaluating and adopting an automated renewal workflow to prevent service disruptions.

Primary Recommendation: Let's Encrypt

Let's Encrypt is widely recommended because it is free, trusted by all major browsers, and supports automated issuance and renewal via standard ACME tools.

• Validation Requirements: Let's Encrypt requires automated proof of domain control, typically via HTTP-01 (HTTP validation) or DNS-01 (DNS validation).
• Alternative Providers: If your environment cannot support these validation methods due to network, DNS, or hosting constraints, you must select an alternative certificate provider that supports your infrastructure.

Operational Best Practices (All Providers)

• Use Supported Tools: Deploy reputable, actively maintained ACME clients or automation agents; avoid deprecated or unvetted scripts.
• Monitor Expiration: Set up independent monitoring and alerting to detect failed renewals well before expiration.
• Account for Rate Limits: Review provider limits (e.g., Let's Encrypt issuance caps) and design your deployment accordingly.

CUIT's Role

CUIT provides general architecture guidance and policy information. Individual departments remain responsible for selecting, deploying, and managing the certificate solutions across their respective systems.

Please reach out to the CUIT team if you have any questions or need further clarification regarding your environment.

To request a certificate, please fill in this form via CUIT’s InCommon SSL Certificate portal. Please note the following:

• Requests submitted via other certificate authorities will not be authorized.
• Approvals may take up to 5 business days.
• Initial requests for non-.columbia.edu domains will take longer due to additional information that will need to be submitted and necessary changes to be made to the DNS records by the WHOIS admin contact.
• If you are requesting a wildcard certificate, it will require additional validation by the certificate authority and you may be contacted for additional information.