User Certificates

A certificate, in this case a user certificate, is a digital identity that has been authenticated by a trustworthy authority. It acts as an electronic ID.

Everything you need to know about user certificates

FH Erfurt issues personal digital certificates for its employees and public servants. They are primarily used for signing digital requests and applications.

Please note: This is not a universally valid certificate. It is legally valid for signatures within the University of Applied Sciences Erfurt. However, a document with your digital signature may not be accepted/recognised outside our university.

In the following steps, we explain how to obtain a personal user certificate, how to use it, how to verify it and other certificates and how to block it if you lose it.

Digital certificates are used to secure the confidentiality, integrity and identification of electronic communication, e.g. by email or with web services.

For this reason, user certificates must be protected by a password that is as complex as possible and may under no circumstances be passed on to third parties.

A user certificate consists of a public and a private encryption key.

The private encryption key belongs exclusively to the owner of the user certificate and is secret.
The public key should be known to everyone, as other people can use this key to send you encrypted emails, for example. The public key infrastructure (PKI) of the German Research Network (DFN) ensures that your public key actually originates from you as it has to be signed.

Digital certificates are issued by a Certificate Authority (CA). By issuing the digital certificate, the CA confirms the identity of the owner.

Currently, the service for issuing certificates is provided by GÉANT and managed by Harica.

Further information and FAQs can be found on the DFN website.
To apply or renew, please use the HARICA Self-Service portal
Obtaining your user certificate
- At the end of the process in HARICA Self-Service, you can download the Certificat.p12 file.
  Please note that you can only do this once, while the browser window is open.
- Save your user certificate in a secure location (e.g., your home drive) and not just locally on your PC.
- A password is required to use or import the certificate. You set this password yourself when you retrieved the certificate.
  Please note that once set, it cannot be changed.
To use your certificate (*.p12), you will need to add/import it into the certificate repository of the device you are using.
- In Windows, double-click on your certificate file (*.p12) and follow the instructions
- It is recommended to select a high security level and make it accessible only to this user (their access).
- You do not need to re-export, as you have already backed up the original file outside the device you are using (e.g. home drive)
Once this has been done, your certificate can be used by the software installed on the device.

Configuration for use in Adobe Acrobat:
- Open Adobe Acrobat.
- Select "Settings" in the "Edit" menu.
- Select the "Signatures" category.
- Select "Identities and trusted certificates" and click on "More".
- Your user certificate should appear. Select your certificate.
- In the menu, select "Pen" and then "Use to sign".
You can now sign signature boxes in PDF forms with your user certificate.

The first time you use it, you will have to confirm that you wish to allow the connection to a time server at DFN. This is necessary and will be saved in the document, providing additional security during verification.
You are advised to check all signed documents.

Acrobat checks signed documents every time they are opened.
You can tell by the green tick (under the menu bar) whether a document has been successfully verified.

Please note: To verify the digital signature, Adobe must also be allowed to use the Windows certificate store for verification. Unfortunately, this is not a standard setting during basic installation.
Your departmental admin will be able to help.

To check individual signatures in Acrobat, right-click on the signature and select the "Check signature" menu item. You will see a brief summary of the verification process.

The "Show signature properties" menu item will take you to a more comprehensive overview where you can also check the verification paths.
If your certificate is lost or stolen, please contact 333@fh-erfurt.de.

When your employment contract ends (e.g. due to the end of a fixed-term contract, annulment, dismissal, retirement, etc.), your digital certificate will automatically be revoked.
Your user certificate can be used in a variety of ways. You can also use it to sign and encrypt emails, for example.

If you need to integrate the user certificate into your mail client, you can contact your departmental admin for assistance.

Please note:
1. If you intend to work with signed emails, you should integrate the user certificate into your email client on all the devices you use.
2. It is not possible to integrate/use it in OWA (Outlook WebAccess).
3. If you have proxy access to functional mailboxes, you may receive unwanted messages when sending emails, as the user certificate can only be used for your personal email address.
4. If you lose your certificate and password, all emails encrypted with them will be unreadable.