Manual SSL Certificate Processes

Create Manual SSL Certificate Processes

Overview

These processes are for any Ministry of Justice users (or suppliers) requiring an SSL Certificate.

There are 3 categories of certificate we use at Ministry of Justice:

AWS Certificate Manager (ACM)/Let’s Encrypt - automated certificate management for modern cloud native software and infrastructure
Gandi.net - where automated certificate management is not possible

Where at all practicable we should be looking to utilise automated certificate management. The MOJ Hosting Service is looking at strategies to move consumers to modern certificate management solutions.

This process specifically relates to certificates issued through [Gandi.net]

Tips and Need-to-knows

We are not responsible for any HMCTS owned certificates. These are typically domains in the format <application>.<environment>.hmcts.net or <application>.<environment>.cjscp.org.uk. For these no action is required. The contact for these certificates is the HMCTS Domains Team. That Team has access to all the shared mailboxes and gets all the same notifications for renewals.

Other teams have their own AWS Route53 accounts. These are HMCTS (hmcts.net + cjscp.org.uk) at DTSOpsConfMan@Justice.gov.uk, LAA (legalservices.gov.uk), OPG, more to be confirmed. Either the other team or our team will renew the Gandi certificate. If we do, send the CNAME validation details to the relevant team. If the other team does it they have their own Gandi process or use AWS ACM auto renewal process.

**To confirm if we manage a domain, check whether the subdomain record exists in AWS as a delegation i.e. a Nameserver(NS) type record. If one exists there is a high likelihood that the management of the domain is managed by another team. For example if it states Azure that is definitely another team.

In Gandi the SSL certs that are "No longer valid - To reissue" require a Gandi support request to remove them.

Pre-requisites

Before you begin, there are a few prerequisites:

A user account for Gandi.net
Access to the Certificates Teams Group
Access to DNS

Please contact your administrator to set these up.

Requesting a new certificate via Gandi.net

Requester needs send their request and Certificate Signing Request (CSR) (and an authority email approval if not an MOJ employee e.g. 3rd party supplier) to certificates-gg@justice.gov.uk.
Check to see if the certificate already exists in the Gandi.net portal. Sometimes requesters mix up new certs and renewals. If this is a renewal see the renewal steps in this runbook.
Check to see if the domain associated with the request is managed in Route53 in DNS repo. If not, the validation step in the process will need to be carried out by the team that manages the domain. You will need to check with the requester how the 3rd party wants to carry out validation.
Login to Gandi.net.
Click on "Got to My Products" to view the list of certificates we own.
To start the process of buying a new certificate click on the "Buy" button.
Select "DigiCert" as the Certificate Authority
For the question What type of certificate do you want? select Standard.

Note - We only offer "Standard" type certificates as part of our service.

For the question What do you want to protect? select the appropriate option for the request, then click "Next". Generally we select Single address type unless multiple SAN names are provided within the CSR, if so pick Multi address type. Occassionaly a request will be for a full domain or wildcard, if so pick the Full domain type.
Paste the CSR text into the CSR box. Then click "Next".

Remember to copy the entire contents of the .csr file, including the lines containing -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST-----. If there are any issues with the validity of the CSR file you will be notified at this stage. These will need to be rectified before you can proceed. Abandon the process and start again with a new CSR.

If SSL certificate is a Multi address type, after copying in the CSR contents, you have to manually add the SAN names from the request form into Gandi, it does not automatically extract the information from the CSR.

Complete the checkout process. Ensure that when you get to the payment options section that you select Pre-paid account for the payment method.
If creation has been successful two emails will be sent to the Certificate Teams Group. An invoice (which can be ignored), and a Validation email. Click on the link in the validation email to obtain CNAME details.
Create the CNAME record in DNS repository. Post the PR in the #hosting-networking Slack channel for review and approval. Gandi.net will automatically try to pick up this CNAME to confirm that we have ownership of the domain.

Note - Any preceding "_" or trailing "." characters in the CNAME values are extremely important for validation. Missing characters will mean that validation will not be successful.

If SSL certificate is a Multi address type, then multiple CNAME's will be provided and need to be added to AWS

When validation is complete an email will be sent to the Certificate Teams Group. Click on the link in the email to visit Gandi.net and download the new certificate and intermediate.
Email the certificate to the requester along with details of the expiry date, and the Gandi.net intermediate certificate (which is required for all new certificates issued after 23rd August 2023). All certificates are valid for 199 days.

Renewing an expiring certificate via Gandi.net

We will review the list of Gandi.net certificates and identify any that require renewal 4 weeks prior to expiry (we also get a notification to Certificate Alerts 29 and 14 days prior to expiry).

The renewal process is almost exactly the same as the new certificate request process i.e. all the email notifications and validation steps are the same.
When validation is complete an email will be sent to the Certificate Teams Group. Click on the link in the email to visit Gandi.net and download the renewed certificate.
Email the certificate to the requester along with details of the new expiry date, and the Gandi.net intermediate certificate (which is required for all new certificates issued after 23rd August 2023). All certificates are valid for 199 days.

Revoking Gandi.net certificates

Certificates will expire automatically if not renewed. If a certificate doesn’t require renewal you can leave the certificate to expire and no further action is required. You’ll receive a notification email confirming expiry.

If a certificate needs to be revoked before the expiry date then this can be done via Gandi.net.

Note that once a certificate has expired or been revoked it cannot be reinstated. If a certificate is required the process to request a new certificate should be followed. If the certificate is being allowed to expire or revoked, it may also mean that the domain can be decommissioned in line with our domain decommissioning process (TBD).

Regenerating Certificates

There may be times when we need to regenerate a certificate due to an issue with the original CSRs that were sent over (for example, if the CSRs were sent over with the wrong level of encryption).

Note that this is a different process from renewing a certificate.

To regenerate a certificate:

Request new CSRs from the users who fulfilled the original request.
On Gandi, select the domain name we need to regenerate the certificate for and select the option to 'Regenerate'.
Once confirmed, an email will be sent to certificates-gg@justice.gov.uk. Click the link in the email to open up the Certificate Overview (or navigate to this page via Gandi).
Next, edit the authentication method and change it from 'Email Authentication' to 'DNS Authentication'.
From here you will have to repeat the original authentication method by creating the CNAMEs DNS, or by forwarding the information onto the team that owns the respective Hostedzone.
Once activated, you'll be able to download and forward the certificates to the user as per the usual process.

Costs/Funding information

The costs for Gandi.net certificates are met centrally by Platforms & Architecture. There is no cross charge.

MOJ has a prepaid account with Gandi.net for paying for certificates.

If the account runs low a notification is sent to the mailbox. If that happens speak to the Product Manager who will engage with the Demand Team to arrange additional funds.

Last reviewed: 16 September 2026Review status: ✓ Up to dateOwner: #operations-engineering-alertsSource: View source on GitHub

Was this page useful?