GAS (Global Agent System)

Transcription

1 over 10 years of securing identities, web sites & transactions GAS (Global Agent System) Retail Certificate Issuance Edition 1.2 GlobalSign created the GAS (Global Agent System) as a highly flexible, multi-tiered, multi user certificate lifecycle management tool to maximize the benefits in choosing GlobalSign as the provider of your digital identities. This user guide addresses the specific needs of the Retail account user as well as a basic understanding of digital certificates. If you require advice or information concerning SSL Managed Service accounts or Partner/Reseller accounts, please contact your GlobalSign Account Manager or sales@globalsign.com. A very basic architecture of the GAS system is illustrated below, highlighting the three alternative account types. GAS (Global Agent System) The latest versions of the user guides are located here: For more enhanced details on anything in this user guide please refer to: support@globalsign.com US: UK: EU: JP: GlobalSign Ltd. US Office - Two International Drive Suite 330 Portsmouth NH EU Office UbiCenter Philipssite Leuven Belgium Page 1 of 23 UK Office 6 Kings Row Armstrong Road Maidstone Kent ME15 6AQ Japan Office 20-1 Sakura-gaoka-cho Shibuya-ku Tokyo

2 1. Useful numbers and answers to FAQ s Technical Support All technical questions regarding your certificates should be forwarded to our Support Department, but please first have a look at our FAQ's. ( ) It is very likely that this will allow you to find an answer to your question and this also allows us to solve your issue most efficiently. support@globalsign.com Support Web Site Vetting Department Fax your vetting documents to your regional office Tel US: ra@globalsign.com Fax vetting documents to: Fax US: Vetting Department Fax your vetting documents to your regional office Tel EU English speaking: Tel EU Non-English speaking: ra@globalsign.com Fax vetting documents to: Fax EU: Contents Section 1. Useful numbers and answers to FAQ s Contents General Principles:- Why should I use my Retail Account?: General Principles:- How to use this User Guide: General Principles:- The Retail Account Screen Layout and callout styles: General Principles:- The Retail Purchase Process Process: DomainSSL:- The Purchase Process Certificate Selection DomainSSL:- The Purchase Process Account Setup DomainSSL:- The Purchase Process CSR Entry DomainSSL:- The Purchase Process Approver page DomainSSL:- The Purchase Process Application end user information DomainSSL:- The Purchase Process SAN Support DomainSSL:- The Purchase Process The Approver OrganizationSSL:- The Purchase Process Certificate Selection OrganizationSSL:- The Purchase Process Account Setup OrganizationSSL:- The Purchase Process CSR Entry OrganizationSSL:- The Purchase Process Application end user information DomainSSL:- The Purchase Process SAN Support OrganizationSSL:- The Purchase Process Seal profile information entry Retail Account Configuration :- The Account Administrator Menu: General Principles:- Delegated Administration: Certificate Management New Certificate Application Certificate Management Certificate Application History Certificate Application History Edit Certificate Details Certificate Management Pending Certificate Approvals Upgrading to an SSL Managed Service Account Deposit Management - Create Bulk Order & Add Deposit Additional information: GlobalSign Root Certificates: Page 2007 GlobalSign Ltd. Page 2 of 23

3 3. General Principles:- Why should I use my Retail Account?:- This guide highlights how to use the Global Agent System to purchase a certificate through the retail web site. As part of the process you will be provided an Account which offers the following benefits:- Complete Certificate lifecycle management With a retail account you can control the application, issuance, re-issuance, renewal and revocation across many departments. A benefit of an Account is that purchasing all certificates through a common interface provides the possibility of enhanced discounts - no service fees and the ability to save considerable budget compared to buying certificates separately or from a GlobalSign competitor No infrastructure or personnel overhead - GlobalSign runs the WebTrust certified certificate factory, enterprises just log in and manage certificates Advanced Delegated Administration - administrator creates users based on roles and assigns appropriate privileges Approval based model - Administrator and users with Approver privileges decide whether applications should be issued ( alerts sent to Approvers) Full billing management - view and download invoices and automatically create new downloadable "quotes" for internal authorization Comprehensive reporting and auditing functions - report on spend, certificates, upcoming renewals, etc XML based API to allow full integrationn with enterprisee purchasing systems Account administrators also have the possibility to upgrade to an SSL Managed Service account which provides the following:- A benefit of Pre-vetting of domains allows for instant issuance to any domain or sub-domain under the main TLD (Top Level Domain). OrganizationSSL certificates can then be provisioned instantly. (To upgrade the account, please see Section 26) 4. General Principles:- How to use this User Guide:- This user guide has been structured to follow the process of applying for a retail certificate. In order to better understand the guide the following symbols are used to illustrate the menus and permissions:- Role Symbol Description of Role Permission Symbol Description of Approval/Permission Account Administrator The top level account owner that can see all menus and has the ability to amend or create a hierarchy of Managers and Staff in Charge Certificate Approval By default the Account Administrator has certificate approval permissions, however these can be delegated to Managers and/or Staff Manager With administration rights defined by the Account Administrator and a unique log-in to the account, a Manager is also able to create a further sub level and delegate tasks including certificatee approval and deposit authorization Deposit Authorization By default the Account Administrator has Deposit Authorization permissions, however these can be delegated to Managers and/or Staff Staff With administration rights defined by either the Account Administrator or the manager levels Staff members have a unique log-in cannot create any to the account, a Staff member additional account users. System Default Approval level:- Please note that Only the Account Administrator has default approval permissions to approve pending certificate requests and to deposit additional funds. Billing Contact A separate contactt can be created to receive confirmation information and billing information. 5. General Principles:- The Retail Account Screen Layout and callout styles:- Throughout this guide callouts are used to highlight specific points of interest. For example:- Menu Items Example Information Window Importantt points are highlighted with Red callouts. Important Point Example 2007 GlobalSign Ltd. GAS (Global Agent System) User Guide Retail Certificate Issuance Page 3 of 23

4 6. General Principles:- The Retail Purchase Process:- GAS (Global Agent System) User Guide Retail The purchase process for a certificate is highlighted in the diagram below. Either a DomainSSL or an OrganizationSSL certificate can be purchased through the retail web site. The majority of the processes are similar with the exception of the vetting and authentication stages (Step 5 below). Please note that a DomainSSL certificate can be purchased and issued in several minutes, where as an OrganizationSSL certificate can take 2-3 working days. Sign Up Follow on orders The process is initiated from inside the account 2 2 Account creation skipped If the organization is the same this may be skipped 6 6 Detailed Description A CSR (Certificate Signing request) is required from either your hosting provider if you have a managed service, or it can be created from your web hosting control panel. For more details on creating CSR s please review:- Please select the appropriate purchase link from the web site and select the appropriate features, such as duration, number of licenses and support for SAN (Subject Alternative Name). At this point either DomainSSL or OrganizationSSL may be chosen Provide the details for the Account Administrator, selecting username and password etc. Paste the CSR and if appropriate customize the valid from and valid to dates. You will also be asked for payment information. For DomainSSL certificates a challenge response will be sent. Once the has been received the will direct you to a web page where domain ownership can be verified. A DomainSSL certificate will be issued once the challenge response has been completed and payment has been collected.. It may be possible for GlobalSign to authenticate the organization information in the CSR from a DUNS number provided. If not, GlobalSign may require additional proof of incorporation. An OrganizationSSL certificate together with a site seal will be issued once the challenge response has been completed and payment has been collected.. Page Reference in this manual (web link to external resource) Section 7 on Page 5 for DomainSSL and Section 14 on Page 10 for OrganizationSSL Section 8 on Page 6 for DomainSSL and Section 15 on Page 11 for OrganizationSSL Section 9 on Page 7 for DomainSSL and Section 16 on Page 12 for OrganizationSSL Section 10 on Page 8 Section 13 on Page 9 Section 17 on Page 13 Section 19 on Page GlobalSign Ltd. Page 4 of 23

5 7. DomainSSL:- The Purchase Process Certificate Selection A DomainSSL certificate offers a simple, quick and easy way to secure a FQDN (Fully Qualified Domain Name). The process to purchase a DomainSSL is highlighted opposite. Please note that you will need a CSR to complete Step 1 (Certificate Signing Request). For more information on how to generate a CSR, please review the GlobalSign support web site for details. Standard SSL Please note you will need one IP per SSL certificate Example domains Server Notes that can be hosted Certificate Selection Product DomainSSL SSL Certifiacte Type Standard SSL issued to a single Fully Qualified Domain Name only Wildcard SSL issued to "*.domain.com" Standard SSL with SANs (Subject Alternative Names) Please select the type of SSL Certificate issued to a single Fully Qualified Domain Name and up to three internal server names e.g. "server1" Number of Licences Our current promotion gives you 3 licenses per license block below, e.g. selecting "1" gives you 3 licenses, "2" gives you 6 licenses Certificate Validity Period & Customization of Start & End Date Check if you require the certificate to be valid from a specific Wildcard date. SSL Leave blank and the certificate will be valid upon completion of vetting. Server Year Price Six months XXX 1 year XXX 2 years XXX 3 years XXX 4 years XXX 5 years XXX Single Server, Si l IP Customization period XXX Is this order New or transfer Renewal Switching from a competitor Campaign Code Coupon Code If you have a campaign code, please enter here If you have a coupon code, please enter here Single Server, Single IP Single Server, Single IP Single Server, Multiple IPs (Assume shared IP) secureserver payroll server Example domains that can be hosted secure.domain.com news.domain.com Setting the Customization Period will allow you to modify the issue date and expiry date of your SSL certificate. The rules for this are highlighted later on. If a single IP address is allocated to this server, then only a single SSL certificate can be installed to secure ONE domain. If a single IP address is allocated to this server, then internal server names can be supported with the SAN option. If multiple IP addresses are allocated to this server, then a single SSL certificate per IP can be installed. Notes If a single IP address is allocated to this server, then all sub-domains can be secured with SSL Option Amount tax included XXX Please do not use your browser back button. To return to past pages click Back within the page body. Completing this form moves you on to the Account set-up process where the account administrator is set up. Full details of the DomainSSL product are located here: GlobalSign Ltd. Page 5 of 23

6 8. DomainSSL:- The Purchase Process Account Setup The Account is set-up by entering details about the organization, followed by details of the account administrator. A optional billing contact may be included. All items in RED are mandatory. Please enter the information carefully and accurately. Account Setup Summary - Organization Details Please verify your organization details. By ensuring the accuracy of the information you have provided to us in the summary below, you will experience the best service from your Global Agent System (GAS) SSL Managed Service account. Organization Name Business type VAT Number Street Address 1 Street Address 2 City State or County Zip Code / Postal Code Country e.g. GlobalSign Inc If no VAT number is entered and VAT is applicable in your country, you will be charged VAT. Although this can be entered later it is advised to ensure this is correct during the initial application. Other address info Time zone Telephone (inc. region code) Fax (inc region code) DUNS (if available How did you hear about GlobalSign? Certificate Application Details Please detail the person / company making the application. This is where you createe the Account details:- For the Account administrator. Please use a strong password to protect the account and ensuree the address is correct. The button can be clicked to copy the organisation details from the section above Click if your Technical Contact details as the same as your Organization Details. User ID Password Confirm Password Department First Name Last name Job Title Address An optional billing contact can be added by leaving the check box of same as Application Details clear and entering new details Pressing presents a summary of the information entered, and also the GAS terms of service. You must select to continue. *Please check your address has been entered correctly etc Please do not use your browser back button. To return to past pages click Back within the page body GlobalSign Ltd. GAS (Global Agent System) User Guide Retail Certificate Issuance Page 6 of 23

7 9. DomainSSL:- The Purchase Process CSR Entry GAS (Global Agent System) User Guide Retail A CSR (certificate Signing Request) is one of the most important requirements in the SSL purchase process. The CSR forms the basis of the certificate that GlobalSign will eventually send back to you once the process is complete. Please ensure the CSR you submit in this section is created using the web server you intend to use the SSL certificate on so that the public and private keys match when you install the final certificate. The GAS system will parse the CSR and show you the information on the next confirmation screen DomainSSL application CSR entry If Customization Period was selected on the previous page, then the issue date and expiry date of the certificate can be customized. (Please see the rules below) Contract Period 3 years Customization Period Certificate Signing Request ( CSR ) Generating a CSR and paste into the form. Make sure that your CSR contains the complete header and footer "BEGIN" and "END" lines. For assistance on generating your CSR, please click here -----BEGIN CERTIFICATE REQUEST----- MIIB8jCCAVsCAQAwgbExCzAJBgNVBAYTAkdCMRMw EQYDVQQIEwpTb21lLVN0YXRlMRIwEAYDVQQHEwlT b21lienpdhkxidaebgnvbaotf0fuigv4yw1wbgug T3JnYW5pc2F0aW9uMRUwEwYDVQQLEwxBIGRlcGFy dg1lbnqxfzavbgnvbamtdnd3dy5kb21haw4uy29t MScwJQYJKoZIhvcNAQkBFhhleGFtcGxlLWVtYWls QGRvbWFpbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD gy0amigjaogbamstapbtlabejgojlq9ynmz5951c imt04kh+gs5dzpqclbsxuvgix5lyv/qy9be07w3/ FNSwQ+naT/9abKq+0WJxz7oTXJYGXjGEpbf9JYZm lhrunbub783dfajiiv6fra8edmqh4rtgkavg9uf8 t7iitqqxe+gxwgih5xb5dgyzagmbaaggadanbgkq hkig9w0baqufaaobgqbzbkt07vo50wakdrjfsxqh RWsZnXBLZSLQjc0K/PJCXeZ3eta4teNHOYy0XiVU g6i7/gassig1yqrkzuslvngydkoq9nw9hz0g3lqg CdvuhkXgwggawvBgnKrcl2oH84FQHZN/otaBm1sI CGmw5EEF2s31mmcs+ouX2ECGvNdWKA== -----END CERTIFICATE REQUEST----- Please remember that country codes are 2 digit codes. For example United States = US, France = FR and United Kingdom = GB (Not UK) Please do not use your browser back button. To return to past pages click Back within the page body. Certificate customization is a powerful tool to ensure that new certificates ordered from the account can be customized to start or finish on a particular date. This allows for certificates to be synchronized with billing cycles and/or the expiry dates of other certificates already being used. Every certificate type has a Valid from and a Valid to date. The refund policy of the certificate will determine how close to the application date the Valid from date can be set. For example 3 days for a DomainSSL. Please note that the GAS system will automatically allow for a Leap year and provide a 366 day certificate if necessary GlobalSign Ltd. Page 7 of 23

8 10. DomainSSL:- The Purchase Process Approver page The challenge response will be sent to the contact you select from this page. Only approved domain administrator s can be used. GlobalSign will interrogate the whois record to ensure the correct s are made available. You must be able to reply to this address for the challenge response to succeed. Alternative methods of validation are possible if none of the s are suitable. Please contact GlobalSign. Approver page GlobalSign will verify the domain exists and present a set of standard administrator addresses, GlobalSign will also look at the Who-is record for the domain and present these as alternative options. Please ensure you will be able to respond to a challenge response for this domain. In order to proceed with your SSL certificate application you must select an appropriate Approver address. We will send an Approval to the address you select. The address selected must be capable of receiving the Approval . To make sure you receive the Approver quickly and trouble free: - Make sure you check spam filters in case the Approver is marked as spam - Make sure you select a live address that is capable of receiving renewaladmin@ administrator@ hostmaster@ postmaster@ etc Please do not use your browser back button. To return to past pages click Back within the page body. 11. DomainSSL:- The Purchase Process Application end user information DomainSSL application end user information entry Retrieve previous order details set from your registed user info Contact Information First Name Last Name Telephone (inc. region code) Address Organisation name Department Important Check this box if you wish to be the point of contact for alerts that the SSL certificate is due to expire; otherwise the Account Administrator will receive the alerts. (30 days before, 7 days before and 1 day before) Set Point of Contact Check here to set this user as the point of contact Set Address Check here to set this address as the recipient of all GlobalSign automated s Other Information and Special Instructions if you have any additional instructions please state them here Special Instructions Select Payment Method Important The initial purchase must be made by credit card. Once the account is set up other options will be made available. Payment Details Credit card Please do not use your browser back button. To return to past pages click Back within the page body GlobalSign Ltd. Page 8 of 23

9 12. DomainSSL:- The Purchase Process SAN Support GAS (Global Agent System) User Guide Retail Without SAN (Subject Alternative Name) support, an SSL certificate would only support a single IP address or FQDN (Fully Qualified Domain Name), however more recent browsers are able to use the SAN functionality to allow multiple servers to be secured. GlobalSign offers the ability for 3 alternative internal servers to be included. Set Point of Contact Check here to set this user as the point of contact Set Address Check here to set this address as the recipient of all GlobalSign automated s Other Information and Special Instructions if you have any additional instructions please state them here SubAltName1 SubAltName2 SubAltName3 If SAN support was selected during the initial certificate selection, you have the opportunity to add up to three alternative internal server names here. Examples of Internal Server names are: Server1 Special Instructions 13. DomainSSL:- The Purchase Process The Approver . A DomainSSL certificate offers a simple, quick and easy way to secure a FQDN (Fully Qualified Domain Name). The process involves replying to a challenge response to verify ownership of a domain. An approver will be sent to the address chosen in section 10. When the is received the recipient should verify all information in the especially the domain. Clicking on the link in the mail will direct you to a web page where an I APPROVE or I DO NOT APPROVE selection can be made. Selecting I APPROVE will provide a confirmation screen and the completed SSL certificate to the address of the applicant GlobalSign Ltd. Page 9 of 23

10 14. OrganizationSSL:- The Purchase Process Certificate Selection An OrganizationSSL certificate contains information on who owns the domain and web server hosting the SSL session. During the process there is a possibility that you will be required to submit business documentation. OrganizationSSL certfiiactes can take 2-3 business days to issue due to the extended vetting process. Please note that you will need a CSR during the application process (Certificate Signing Request). For more information on how to generate a CSR, please review the GlobalSign support web site for details. Certificate Selection Product OrganizationSSL SSL Certifiacte Type Standard SSL issued to a single Fully Qualified Domain Name only Wildcard SSL Please select the type of SSL Certificate issued to "*.domain.com" Standard SSL with SANs (Subject Alternative Names) Single Server, issued to a single Fully Qualified Domain Name and up to three internal server names e.g. Single IP "server1" Public IP address SSL Issued to a publically accessible IP address Number of Licences Our current promotion gives you 3 licenses per license block below, Single Server, e.g. selecting "1" gives you 3 licenses, "2" gives you 6 licenses Multiple IPs Certificate Validity Period & Customization of Start & End Date Wildcard SSL Check if you require the certificate to be valid from a specific date. Server Leave blank and the certificate will be valid upon completion of vetting. Year Price Six months XXX 1 year XXX 2 years XXX 3 years XXX 4 years XXX 5 years XXX Customization period XXX Is this order New or transfer Renewal Switching from a competitor Campaign Code Coupon Code It is possible to validate the ownership of a public IP address with an OrganizationSSL certificate. This will be done through verification of a web page change. The GlobalSign vetting team will provide instructions If you have a campaign code, please enter here Single Server, Single IP If you have a coupon code, please enter here Standard SSL Please note you will need one IP per SSL certificate Example domains Server Notes that can be hosted Single Server, Single IP Single Server, Single IP (Assume shared IP) secureserver payroll server Example domains that can be hosted secure.domain.com news.domain.com If a single IP address is allocated to this server, then only a single SSL certificate can be installed to secure ONE domain. If a single IP address is allocated to this server, then internal server names can be supported with the SAN option. If multiple IP addresses are allocated to this server, then a single SSL certificate per IP can be installed. Notes If a single IP address is allocated to this server, then all sub-domains can be secured with SSL Public IP address SSL (Not available under DomainSSL) Example domains Server Notes that can be hosted Again as with the standard SSL, if a single IP address is allocated to this server, then only a single SSL certificate can be installed to secure ONE Public IP Option Amount tax included XXX Setting the Customization Period will allow you to modify the issue date and expiry date of your SSL certificate. The rules for Please do not use your browser back button. To return to past pages click Back within the page body. Pressing CONTINUE moves to the Account set-up process. this are highlighted on the following page. Completing this form moves you on to the Account set-up process where the account administrator is set up. Full details of the OrganizationSSL product are located here: GlobalSign Ltd. Page 10 of 23

11 15. OrganizationSSL:- The Purchase Process Account Setup The Account is set-up by entering details about the organization, followed by details of the account administrator. A optional billing contact may be included. All items in RED are mandatory. Please enter the information carefully and accurately. Account Setup Summary - Organization Details Please verify your organization details. By ensuring the accuracy of the information you have provided to us in the summary below, you will experience the best service from your Global Agent System (GAS) SSL Managed Service account. Organization Name Business type VAT Number Street Address 1 Street Address 2 City State or County Zip Code / Postal Code Country Other address info Time zone Telephone (inc. region code) Fax (inc region code) DUNS (if available How did you hear about GlobalSign? e.g. GlobalSign Inc If no VAT number is entered and VAT is applicable in your country, you will be charged VAT. Although this can be entered later it is advised to ensure this is correct during the initial application. Important Tip: If you have a DUNS number, please enter it here. Doing so will speed the organizational vetting process and allow your certificatee to be issued in a shorter timeframe. These are the details of the Account administrator. Please use a strong password and ensure the e- mail address is correct. Certificate Application Details Please detail the person / company making the application. The button can be clicked to copy the organisation details from the section above Click if your Technical Contact details as the same as your Organization Details. User ID Password Confirm Password Department First Name Last name Job Title Address An optional billing contact can be added by leaving the check box of same as Application Details clear and entering new details Pressing presents a summary of the information entered, and also the GAS terms of service. You must select to continue. *Please check your address has been entered correctly etc Please do not use your browser back button. To return to past pages click Back within the page body GlobalSign Ltd. GAS (Global Agent System) User Guide Retail Certificate Issuance Page 11 of 23

12 16. OrganizationSSL:- The Purchase Process CSR Entry GAS (Global Agent System) User Guide Retail A CSR (certificate Signing Request) is one of the most important requirements in the SSL purchase process. The CSR forms the basis of the certificate that GlobalSign will eventually send back to you once the process is complete. Please ensure the CSR you submit in this section is created using the web server you intend to use the SSL certificate on so that the public and private keys match when you install the final certificate. The GAS system will parse the CSR and show you the information on the next confirmation screen OrganizationSSL application CSR entry If Customization Period was selected on the previous page, then the issue date and expiry date of the certificate can be customized. (Please see the rules below) Contract Period 3 years Customization Period Certificate Signing Request ( CSR ) Generating a CSR and paste into the form. Make sure that your CSR contains the complete header and footer "BEGIN" and "END" lines. For assistance on generating your CSR, please click here -----BEGIN CERTIFICATE REQUEST----- MIIB8jCCAVsCAQAwgbExCzAJBgNVBAYTAkdCMRMw EQYDVQQIEwpTb21lLVN0YXRlMRIwEAYDVQQHEwlT b21lienpdhkxidaebgnvbaotf0fuigv4yw1wbgug T3JnYW5pc2F0aW9uMRUwEwYDVQQLEwxBIGRlcGFy dg1lbnqxfzavbgnvbamtdnd3dy5kb21haw4uy29t MScwJQYJKoZIhvcNAQkBFhhleGFtcGxlLWVtYWls QGRvbWFpbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD gy0amigjaogbamstapbtlabejgojlq9ynmz5951c imt04kh+gs5dzpqclbsxuvgix5lyv/qy9be07w3/ FNSwQ+naT/9abKq+0WJxz7oTXJYGXjGEpbf9JYZm lhrunbub783dfajiiv6fra8edmqh4rtgkavg9uf8 t7iitqqxe+gxwgih5xb5dgyzagmbaaggadanbgkq hkig9w0baqufaaobgqbzbkt07vo50wakdrjfsxqh RWsZnXBLZSLQjc0K/PJCXeZ3eta4teNHOYy0XiVU g6i7/gassig1yqrkzuslvngydkoq9nw9hz0g3lqg CdvuhkXgwggawvBgnKrcl2oH84FQHZN/otaBm1sI CGmw5EEF2s31mmcs+ouX2ECGvNdWKA== -----END CERTIFICATE REQUEST----- Please remember that country codes are 2 digit codes. For example United States = US, France = FR and United Kingdom = GB (Not UK) Please do not use your browser back button. To return to past pages click Back within the page body. Certificate customization is a powerful tool to ensure that new certificates ordered from the account can be customized to start or finish on a particular date. This allows for certificates to be synchronized with billing cycles and/or the expiry dates of other certificates already being used. Every certificate type has a Valid from and a Valid to date. The refund policy of the certificate will determine how close to the application date the Valid from date can be set. For example 7 days for an OrganizationSSL. Please note that the GAS system will automatically allow for a Leap year and provide a 366 day certificate if necessary GlobalSign Ltd. Page 12 of 23

13 17. OrganizationSSL:- The Purchase Process Application end user information OrganizationSSL application end user information entry Retrieve previous order details set from your registered user info Contact Information First Name Last Name Telephone (inc. region code) Address Organisation name Department Important Check this box if you wish to be the point of contact for alerts that the SSL certificate is due to expire; otherwise the Account Administrator will receive the alerts. (30 days before, 7 days before and 1 day before) Set Point of Contact Check here to set this user as the point of contact Set Address Check here to set this address as the recipient of all GlobalSign automated s Other Information and Special Instructions if you have any additional instructions please state them here Special Instructions Important The initial purchase must be made by credit card. Once the account is set up other options will be made available. Select Payment Method Payment Details Credit card Please do not use your browser back button. To return to past pages click Back within the page body. 18. OrganizationSSL:- The Purchase Process SAN Support Without SAN (Subject Alternative Name) support, an SSL certificate would only support a single IP address or FQDN (Fully Qualified Domain Name), however more recent browsers are able to use the SAN functionality to allow multiple servers to be secured. GlobalSign offers the ability for 3 alternative internal servers to be included. Set Point of Contact Check here to set this user as the point of contact Set Address Check here to set this address as the recipient of all GlobalSign automated s Other Information and Special Instructions if you have any additional instructions please state them here SubAltName1 SubAltName2 SubAltName3 If SAN support was selected during the initial certificate selection, you have the opportunity to add up to three alternative internal server names here. Examples of Internal Server names are: Server1 Special Instructions 2007 GlobalSign Ltd. Page 13 of 23

14 19. OrganizationSSL:- The Purchase Process Seal profile information entry An OrganizationSSL certificate features the option to display a clickable Site Seal. The primary function of a site seal is to show visitors you are a secure site. The GlobalSign Site seal is a sign of trust on the Internet. It shows your customers you have been authenticated and you use the strongest SSL possible to secure your transactions. Displaying the GlobalSign Site Seal will help visitors trust your web site, and then help convert general visitors to paying customers. For more information on displaying the site seal, please review the information on this page :- The data which appears on your site seal is input during the next section of the application process. Certain information within this screen will be fixed. (indicated as XXXX in the diagram below. This information will be validated by GlobalSign during the vetting process. OrganizationSSL application seal profile information entry Retrieve previous order details set from your Corporate info Seal Information The below details will be shown in your Web Site Profile presented to your web site visitors click on the Secured by GlobalSign Secure Site Seal. Some information on this page cannot be edited this information is taken from your Certificate Signing Request (CSR). To maximize trust in your site, please ensure this information is as complete and accurate as possible. Organization Name XXXXXXXXXXXXXXX Street Address 1 * If you have provided the information in the 'City' entry ( This is extracted from the CSR ) you do not need to fill this. e.g. 6 Kings Row Street Address 2 City * If you have provided the information in the 'City' entry ( This is extracted from the CSR ) you do not need to fill this. State or County Post/Zip code / Postal Code Country Other address info Telephone(inc, region code) Fax(inc, region code) Authentication information DUNS (if available) Select Payment Method Payment Details e.g. Armstrong Road XXXX XXXX e.g. Marketing XX e.g. +44 ( 0) e.g. +44 ( 0) Credit card Important Tip: If you have a DUNS number, please enter it here. Doing so will speed the organizational vetting process and allow your certificate to be issued in a shorter timeframe. Once the credit card information has been entered and the terms and conditions have been accepted, GlobalSign will send a confirmation to the account administrator. The final confirmation screen will show a username for the account and a confirmation of the order number for the certificate. The status of the order can be monitored in the Certificate Application History menu item. To view this menu you will need to log in to the account. The Account functions and menu items are discussed in more detail on the following pages GlobalSign Ltd. Page 14 of 23

15 20. Retail Account Configuration :- The Account Administrator Menu:- When you first log in to the system you will be presented with the main Administration Menu, which by default for an Account Administrator will include all the areas highlighted below. For delegated administrators some of the menus will be disabled. For example Managers and Members of Staff cannot Amend Company Details. The login page for all userss is Menu Certificate Management New Certificate Application Certificate Application History Pending Certificate Approvals Deposit Management Create Bulk Order Add Deposit SSL Managed Service Create SSL Managed Service Bulk Order Add SSL Managed Servicee Deposit Accounting & Billing View/Request Invoices Account Management Amend Company Details Manage Users Change Administrator Change Billing Manager history View Account Snapshot Sign out These menu items allow the Account Administrator to apply for new certificate types. The approval capabilities can also be delegated to other users in the account. (See the Managing Users) Welcome to the GlobalSign partner Global Agent System (GAS). GAS is your dashboard portal to managing all your Certificate and account requirements. Please use the links on the left to make addd credit to your account, make new Certificate These menu items allow the Account Administrator to add credit to applications and manage existing applications, download invoices, and keep your company details up to date. the account either for a specific number of certificates using the Bulk Order wizard, or to simply add a Deposit amount (for example, Keep checking back to if total the GAS future as certificat we'll shote rtly requirements be adding News, are unknown). Offers, Partner Marketing Resources and Sales Guides and of course General Hints and Tips to making the most out of being a GlobalSign partner. IMPORTANT - Add funds via this menu item instead and the account will be changed to a ManagedSSL account. The Accounting & Billing function presents a summary of the account activity. The Account Administrator can correct or amend company details and manage the permissions of other users on the account. The Account Administrator can relinquish the role to another user within the account (i.e. either Manager or Staff). The optional Billing contact can also be changed here. Please do not use your browser back button. To return to past pages click Back within the page body. These last three menu items allow you to view the history in the account, view a snapshot of the account (Funds and critical expiry dates) and the sign out of the system. The Manager Menu: The menu for managers will vary depending upon the permissions set by the Account Administrator. It will be a subset of the menu items shown above. The Staff in Charge Menu: The menu for Stafff members will vary depending upon the permissions set by the Account Administrator. It will be a subset of the menu items shown above. The remaining pages of this user guide discuss each menu item and highlight what actions need to be taken to order/approve/cancel certificates and also to addd additional funds to the account. Please note that there may small changes in functionality. This is due to GlobalSign s need to continually improve the GAS system based on customer feedback and our own ongoing improvement plans GlobalSign Ltd. GAS (Global Agent System) User Guide Retail Certificate Issuance Page 15 of 23

16 21. General Principles: :- Delegated Administration:- It is important to determine the structure and the permission levels you wish to create as a Account Administrator before you begin to create a delegated administration hierarchy within the GAS system. Although it is possible to edit the permissions for users in the future it always pays to remember the motto measuree twice, cut once. Below are three examples of Delegated Administration architectures that GAS is capable of supporting. Menu Manage Users Certificate Management New Certificate Application Certificate Application History Pending Certificate Approvals Deposit Management Create Bulk Order Add Deposit SSL Managed Service Create SSL Managed Service Bulk Order Add SSL Managed Service Deposit Accounting & Billing Once new users have been created, the edit button View/Request Invoices allows the properties and details for each user to be amended. Any user can edit either it s own details Account Management or that of userss below it. Amend Company Details Manage Users Change Administrator Change Billing Manager history View Account Snapshot Sign out Edit User ID x Full name x x x x x Department name x x x Official position x Zip code x x x Address x x x x x TEL address User permissions Administrator Manager Staff in Charge To add new users click on the button and completee the web form as shown on the next page. Please do not use your browser back button. To return to past pages click Back within the page body GlobalSign Ltd. GAS (Global Agent System) User Guide Retail Certificate Issuance Page 16 of 23

17 Menu Certificate Management New Certificate Application Certificate Application History Pending Certificate Approvals Deposit Management Create Bulk Order Add Deposit SSL Managed Service Create SSL Managed Service Bulk Order Add SSL Managed Servicee Deposit Accounting & Billing View/Request Invoices Account Management Amend Company Details Manage Users Change Administrator Change Billing Manager history View Account Snapshot Sign out New user registration page User ID Password Password(confirmation) Organization Name Department First Name Last Name Job Title Street Address 1 Street Address 2 City State or County Zip Code / Postal Code Other address info Telephone (inc. region code) All usernames for this account will be prefixed with the account ID. XXXXXX_ Users are created as managers or as staff. Managers have the ability to create additional members of staff. The Deposit Purchase Authority and certificate Approval Permissions are allocated with the final section of the web form. So for example to create a Manager with both permissions:- Select:- User permissions Certifiacte Approval true false Permission Fax (inc. region code) Address true false User permissions a User Guide? Certifiacte Approval Permission Deposit Purchase Authority true true false false Back Please do not use your browser back button. To return to past pages click Back within the page body. 22. Certificate Management New Certificate Application For all users, clicking on the New Certificate Application link from the Main Menu will allow either a DomainSSL or OrganizationSSL to be purchased from the account. The process for each certificate was covered in Section GlobalSign Ltd. GAS (Global Agent System) User Guide Retail Certificate Issuance Page 17 of 23

18 23. Certificate Management Certificate Application History For all users, clicking on the Certificate Application History link from the Main Menu will present details of all certificates issued or applied for through the Account. This menu allows the lifecycle of each certificate to be managed in detail. The certificates can be re-issued, revoked or cancelled part way through the application process from within this menu. Issued certificates can also be downloaded in.cer or.pkcs#7 format (PKCS#7 format also includes the intermediate certificates in the chain to the GlobalSign Root CA certificates) Menu Certificate Management New Certificate Application Certificate Application History Pending Certificate Approvals Deposit Management Create Bulk Order Add Deposit SSL Managed Service Create SSL Managed Service Bulk Order Add SSL Managed Service Deposit Accounting & Billing View/Request Invoices Account Management Amend Company Details Manage Users Change Administrator Change Billing Manager history View Account Snapshot Sign out Certificate Application History page Welcome to the SSL Managed Search Service for Control orders Center. here Us via e alternative the Control Cen search ter to criteria, view the or vet s tting imply status of requested domains, make new applications for certificates on approved domains, and select All certificates to highlight all records. approve outstanding orders. Order Number name Certificate name Corporate ID Common Name Order date e.g. 07/30/2007 Issue date e.g. 07/30/2007 (2 Among cases 1~ 2) Edit Renewal Clicking allows the contact details for a specific order to ~ be altered (For example, alerts for expiring certificates) Order number ~ Product Certificate Type New/transfer/ renew CE OrganizationSSL non New (PV) CE Clicking the 7 order Organizatio numbonssl er displays non the full details New of the order, including (PV) the ability to re-issue, revoke, or download the certificate as a PKCS# #7 file. (See the following pages for details) Validity Period 1 years 1 years Number of licenses 2 1 Common name Corporate ID Company name PAR00509 ABC Inc. PAR00509 ABC Inc. Order Status Date of Order Issue completed 08/26/2007(G MT+00:00) Application 08/24/2007(G completed MT+00:00) Issue dat 08/ /26/200 GMT+00:0 Date of Cancellation Payment Status Status of Refund Serial Number a3b186bb Serial numbers for issued certificates are listed here. Please do not use your browser back button. To return to past pages click Back within the page body. As the number of certificates increases it is possible to output all informationn to a CSV (Comma Separated Values) file and then to edit and manipulate via a spreadsheet program such as Excel GlobalSign Ltd. GAS (Global Agent System) User Guide Retail Certificate Issuance Page 18 of 23

19 24. Certificate Application History Edit Certificate Details Contact details can be modified here for renewal notifications. Certificate Order Details The order summary screen (seen by clicking on the order number from the previous page) and the Edit certificate details screen, seen by clicking the button both present highly detailed summary of the information about each individual order. The important areas of this summary are highlighted in the diagram on the left:- Certificate Order details The ability to amend contact details The CSR used to process the order The issued certificate in CER format The issued certificate in PKCS#7 format Details of the optional Billing Contact Certificate Lifecycle Management tools. CSR details are given here Certificate Details The Certificate Lifecycle Management tools have the following functions Cancel the order within a specified number of days and the refund policy will allow the funds to be added back to the account. The certificate in pkcs#7 format is given here The certificate in.cer format is given here Certificates that need to be revoked can be revoked here. Please ensure that your internal processes and procedures are followed for revocation. If for some reason you lose or destroy the private key for the certificate, then pressing this button initiates a process to enter a new CSR (Generated on your web server with a new private key) which can be used to reissue the certificate. All fields (O/L/S/CN etc) will remain the same as the previously issued certificate. This button is similar to the cancellation request above, with the exception that it initiates the purchase process and prepopulates the fields with the previous data for speed. Please note that the same refund policy period applies. The billing contact details are given here GlobalSign Ltd. Page 19 of 23

20 25. Certificate Management Pending Certificate Approvals For the account administrator and all users with certificate approval permissions, clicking on the Pending Certificate Approvals link from the Main Menu will present a list of orders pending approval. Please note that only orders raised by users without certificate approval permissions will appear here. If all users have approval permissions then no orders will need secondary approval. The relevant orders together with a summary of the order are displayed. Menu Pending for approval Certificate Management New Certificate Application Certificate Application History Pending Certificate Approvals Order number CEx Application name x Product DomainSSL Certificate Type x New/transfer/renew New Number Validity of Period licenses 1 Year 1 Common name x Certificate amount Deposit Management Create Bulk Order Add Deposit CEx CEx x x Organization SSL DomainSSL x x New New 1 Year 1 1 Year 1 x x SSL Managed Service Create SSL Managed Service Bulk Order Add SSL Managed Service Deposit CEx x Organization SSL x New To Cancellation Menu 1 Year 1 x Accounting & Billing View/Request Invoices Click this button in combination with the tick boxes on the left hand menu Account to approve Management several orders at once. Amend Company Details Manage Users Change Administrator Change Billing Manager history View Account Snapshot Sign out The alternative cancellation menu can be reached by selecting this link. This allows several orders to be denied at the same time. To Approval Menu Please do not use your browser back button. To return to past pages click Back within the page body. 26. Upgrading to an SSL Managed Servicee Account) To upgrade your account to a ManagedSSL account, you simply need to place a deposit via the SSL Managed Service menu. SSL Managed Service Create SSL Managed Service Bulk Order Add SSL Managed Service Deposit The account will then be converted to a Managed SSL account with the advantage of pre vetting which supports accelerated issuance of OrganizationSSL certificates. The full user guide is located here: GlobalSign Ltd. GAS (Global Agent System) User Guide Retail Certificate Issuance Page 20 of 23

21 27. Deposit Management - Create Bulk Order & Add Deposit Once an account has been created the Deposit Management tools can be used to top up the account. The Create Bulk Order is best if you know the number of Certificates you wish to purchase. Important Note. Please be aware, that if you wish to add additional domains to your account then this is the method you will need to follow as domains can only be added when additional funds are deposited. Important Note. The Rank (Discount Level) of the account will be preserved when topping up the account, so long as the expiry date for the funds has not been exceeded. This can be viewed in the Account Snapshot section of the main menu. Create Bulk Order. Use the tool on this page to create a custom Bulk Order to meet your exact certificate requirements. You can add exact deposit to be spent on both DomainSSL and OrganizationSSL Certificates. For SSL Managed Service users, ensure you select OrganizationSSL as the Certificate type when creating your Bulk Order. Your discount levels are determined by the total deposit amount. To help, please view the discount table below. Your discount will automatically be calculated as you create your Bulk Order. Alternatively, if you would prefer to deposit a lump sum click Add Deposit Rank PAYG pricing Bulk purchase pricing Discount off PAYG pricing 1 XXXX XXXX XX% 2 XXXX XXXX XX% 3 XXXX XXXX XX% 4 XXXX XXXX XX% 5 XXXX XXXX Your existing Rank is highlighted XX% here, based on the amount of credit you currently have in the account. Validity Edit Delete Product Certificate Type Order Type Period Use this table to determine the Rank you would like to achieve with your total purchase. PAYG (Pay As You Go) highlights the pricing you would achieve in buying single certificates. As you add certificates types you will see the Rank Summary change and additional discounts being achieved. Note at this stage you are NOT purchasing anything, this is merely a calculation tool to allow you to work out want certificates you need. If you simply want to add a fixed size of deposit, click on the Add Deposit link above. Number of Licenses Set Custom start/end Extend Renewal Fixed Price Discount Amount DomainSSL Wildcard Renewal 2 years 8 XXX XXX OrganizationSSL SubjectAltName Switch from Competitor 4 years 2 XXX XXX XXX XXX Rank 3 Total XXX XXX Please do not use your browser back button. To return Select to past the pages attributes click Back of the within certificates the page you body. wish to purchase such validity period, or number of Licences. And Click on Add. Once you have finished click on Purchase to follow the process of paying by credit card and adding domains. Please note that if you change the Organisation details for the account GlobalSign will need to revalidate the existing domains and the new information Direct purchase of deposit. Account Balance XXX : 13,455 Deposit amount Enter the amount and click purchase to continue GlobalSign Ltd. Page 21 of 23

22 28. Additional information:- The final section of this guide provides some useful background information on SSL certificates. For specific troubleshooting information on particular web servers, please refer to the GlobalSign Support web site which is constantly being updated with useful tips and guidance GlobalSign Root Certificates:- As the GlobalSign (Top) Root CA is included in all mainstream browser software and operating systems:- It is unnecessary to install the Root certificate on to your web server or web hosting control panel, however good security practice dictates that GlobalSign provides an intermediate certificate from which it signs end entity certificates. The intermediate certificate will be delivered along with the end entity certificate, so it is vital that both certificates are installed onto the web server. Again more specific details can be found on:- Why is it necessary to install the intermediate? This is the basic principle of PKI (Public Key Infrastructure). By having a cryptographically secured certificate chain back to a trusted Root certificate, users can rely that the certificate they are viewing actually does belong to the entity which provided it. Examples of certificates which are not trusted because they do not chain up to a trusted root are highlighted on the following pages GlobalSign Ltd. Page 22 of 23

23 Microsoft s IE7 (Available on Windows XP Service pack 2 systems and on Windows Vista ) rather than presenting a small warning to users, which previously was sometimes ignored, now clears the entire web page and presents a very visible message with clear instructions not to proceed, so it is vital that you correctly install your GlobalSign SSL certificate and the associated intermediate certificates. Users who choose to ignore the warning are presented with an address bar where the background turns red and the Security Status window indicates a certificate error, which is very damaging to the perception of your product or service in the eyes of a customer GlobalSign Ltd. Page 23 of 23