TLS requirements

Owned by Jia Wen Li
Last updated: Sept 10, 2024 by Mike Patterson
1 min read

Scope

These requirements apply to all University of Waterloo servers that offer services using the TLS protocol.

Requirements

  1. TLS servers must score a B or higher on the Qualys SSL Labs test or equivalent. The TestSSL shell script may be used instead in situations where the SSL Labs site cannot reach the server (RFC1918 address space, non-webservers). A service where there is the transmission of information classified as Restricted or higher must score at least an A.

  2. Sites accepting University of Waterloo credentials directly must score at least an A.

  3. The Common Name (CN) on the certificate should match the DNS name (or a CNAME) of the server hosting the service. The CN must be for a name which is resolvable by the intended audience. That is, Waterloo-internal names (.private, .nexus, and others) must not appear in the CN, or Subject Alternative Name (SAN), if the service is intended to be accessible by unmanaged computers, including the general public.

  4. TLS servers on the campus network must be registered with IST with information including Policy 46 confidentiality classification and contact address of the server’s systems administrator(s). The current authoritative source for this information is IST’s IPAM service.

  5. For TLS certificates issued by IST, it is strongly recommended that the contact for the issued certificate be a generic email address, rather than the address of an individual. Reminders will be sent solely to that address, and IST does not monitor for upcoming expirations. Any questions about IST-issued TLS certificates should be sent to ist-ca@uwaterloo.ca.

Related links