Recruiting and Training Departmental Certificate Administrators (DCAs)
Central Administrative Team
Who administers the program?
The Sectigo Certificate service is managed by UC Berkeley's CalNet team, which oversees Identity and Access Management services for our campus. Members of the CalNet team are granted Registration Authority Officer (RAO) level permissions. On-call staff process incoming certificate requests weekly.
How do customers submit requests?
Campus customers can submit a TLS Certificate Service Request via the IT Service Hub.
Detailed instructions for making these requests are included in our TLS Certificates Overview.
How are requests validated?
UC Berkeley utilizes a pre-established program for registering a Security Contact for all campus hosts. CalNet RAOs use the Security Contact Application to identify the responsible party for a given host. The RAO forwards the certificate request to the registered Security Contact for approval. Once approved, the CalNet team uses the Sectigo SCM application to review the CSR and issue the certificate.
Central vs. Delegated Administration
While the CalNet team handles direct requests, the program is designed for delegated administration. The goal is for the majority of requests to be managed by local Departmental Certificate Administrators (DCAs) who have direct knowledge of their unit's infrastructure.
Recruitment of Delegated Administrators
Initial DCA Appointments
DCA status was initially granted to a subset of central IT staff who manage hosts on behalf of multiple departments or campus-wide services. These staff hold permissions to approve certificates at the top-level .berkeley.edu domain.
Departmental DCA Appointments
CalNet works with high-level IT leadership in large campus units (e.g., EECS, Law, Haas) to appoint DCAs for specific subdomains. Approved departmental administrators must provide the specific subdomains or hosts they intend to manage.
The CalNet team maintains a master list of DCAs, sponsors, and approval dates, which is reviewed annually to ensure access is removed for staff who have departed the university.
Ad Hoc DCA Requests
Departments wishing to appoint a new DCA should contact calnet-admin@berkeley.edu. The request must include contact information for a high-level manager in the department who can authorize the appointment. The CalNet team verifies the manager’s standing via the campus directory before proceeding with recruitment.
Training DCAs
All new DCAs are required to participate in training. If an administrator is the first DCA for a new department, the CalNet team provides direct assistance; otherwise, training is coordinated with existing team members.
DCA Responsibilities
- Only approving certificates legitimately associated with your authorized department(s).
- Consulting with the CalNet team before issuing wildcard certificates due to potential security risks.
- Maintaining a complete audit trail of requests, approvals, and renewals (via email archive, ticketing system, etc.).
CSR Generation Tips
Refer to your specific operating system or application documentation for CSR generation. Additional guidance is available from the vendor: Sectigo: Choose Your Server Guide.
Using the Sectigo SCM Tool
- Review the TLS Certificate Self-Service Guide (KB0014615).
- Refer to the Sectigo SCM Administrator Guide for technical tool walkthroughs.
- Best Practice: Use a common institutional address for all delegated departments to ensure consistent Subject address information across campus certificates.