Articles in this section

See more

Study Abroad: SSL Certificate Follow

What is SSL?

Secure Sockets Layer (SSL) is how data is encrypted between your browser (Internet Explorer, Netscape, Safari, etc) and the server. It ensures that whatever you are putting into your browser stays private. 

 

Where is SSL used in Terra Dotta?

Whenever you are logged in, you are 'behind' SSL, meaning that your data in transit is encrypted, protected from being picked up and read. You will notice that there is an 's' after the http in the address bar. You should see that when you access the login page, the URL (site address) will change to https. You will also notice a padlock icon or other indication in your browser meaning that an SSL connection is active.


Public Site

When your hosted Terra Dotta Application is initially brought online, we provide a default host name on the appropriate product domain for your account (e.g., myuniversity.terradotta.com).  This host name remains active for as long as it is needed (or permanently if desired).
 
Your public site can have any host name (URL) that you want within your institutional domain.  For example, a study abroad site might be:
 
http://studyabroad.myuniversity.edu or http://www.mystudyabroad.myuniversity.edu (or others, like http://oip.myuniversity.edu, or any combination of multiple host names)
 
However, note that the following type of URL, where the site is a subdirectory of another site, is NOT supported for Terra Dotta Hosted or SaaS customers:
  • NOT VALID: http://www.myuniversity.edu/oip
  • NOT VALID: http://international.myuniversity.edu/studyabroad/

Shared Wildcard SSL
Our hosted customers are all protected by default (without charge or need to request) with a wildcard SSL certificate for your product domain (e.g., *.terradotta.com, *.i3s.com, *.applicationgateway.com, *.terradotta.com). The pre-configured host has automatic SSL protection under the wildcard certificate.  This certificate is managed by Terra Dotta at no additional cost to the customer.

Example using a proprietary host name for the public site but using a Terra Dotta host name through the shared wildcard SSL:
 
Public: http://studyabroad.myuniversity.edu/
Secure: https://myuniversity.terradotta.com/  (using *.terradotta.com wildcard SSL certificate)
 
What this means is that your users will see your proprietary domain name while they are looking at your public site (your site webpages, program listings, announcements, staff listings, application deadlines, etc), but the URL will change to the secured Terra Dotta host name as soon as they log in.
 
There will be no other visual changes in the layout or anywhere other than the URL.  So, for example, if the site visitor is looking at http://studyabroad.myuniversity.edu/ and finds a program that they want to apply to and clicks on the 'login' button, the site URL will change to https://myuniversity.terradotta.com/, but in other ways, they won't notice any change.

 


Custom SSL

If you prefer, you can provide an SSL certificate for your institutional domain/host, so that users will remain within the same host in the URL in both the public and secure areas of the site.
 
This allows the following:
 
Public: http://studyabroad.myuniversity.edu/
Secure: https://studyabroad.myuniversity.edu/
 
To do this, you will need to
  • Decide on the DNS name for your site.  See information above and the article titled "Hosted/SaaS: Configuring DNS host records to point to Terra Dotta servers" for more information.  It's listed in the Additional Resources tab of this article. 
  • Open a support case with Terra Dotta to request the SSL host configuration for your site.  In the case, request the CSR for your site certificate, providing the following information:
    • Common Name: [name of site; e.g. studyabroad.terradotta.edu]
    • Organization Name: [name of institution to appear on the certificate; e.g. Terra Dotta University]
    • Country: 
    • State/Province:
    • City:
    • Organization Unit: [name unit/department to appear on the certificate; e.g. Office of Study Abroad]
    • Key Size: 4096
  • Purchase/obtain the SSL certificate through your institutional network services.  You will be responsible for the ongoing costs and maintenance of the certificate, notifying Terra Dotta via support cases whenever an update to the certificate is required. Certificates generally have a renewal cycle of between 1 and 5 years.

 

SSL Cert Renewal (Hosted/SaaS clients):

We recommend that customers keep a calendar reminder of the date when certificates are set to expire.  At least 2 weeks* prior to the date of expiry, submit a support case to Terra Dotta requesting a new CSR (certificate signing request) for certificate renewal, noting the date when the certificate is set to expire.  Terra Dotta system administrators will attach the CSR to the case, which you must download and submit to your certificate authority to generate the new certificate.  Attach the certificate to the case, being sure to comment that the certificate file has been posted.  From that point, the certificate installation is usually performed within 24 hours.

 
(Note that even if your certificate does expire and the website presents a security warning, your site will continue to be secured with SSL encryption.  The warning simply means that the certificate of secure site assurance is no longer valid, so the certificate authority will not vouch for the site anymore.)
 
* Check with your internal IT support and/or certificate authority to find out how much time they require to process certificate renewal requests.

----

 

Enabling SSL for Terra Dotta (Installed Clients)

Note:  This document does not cover basic concepts of SSL, security certificates or web security configuration. Consult the documentation for your web server (IIS or Apache) for instructions on enabling SSL on your website. Make the SSL host availble on your website before configuring Terra Dotta Software for SSL. Terra Dotta software will operate properly under SSL before being configured.

For most implementations of Terra Dotta, the recommended approach is to provide site access on both a secure and a non-secure channel. The latter is advisable for the public site pages and program catalog, where no user identification is needed and performance can benefit from the unencrypted transfer of long text and binary content.
 
Terra Dotta comes equipped to support both a secure and a non-secure host, with built-in logic to route users properly in and out of the secure channel.  If an SSL host is provided, Terra Dotta sends users to that host at the point of login and also prevents the use of the non-secure host within the identity-protected sections of the site (the "portal").  For example, if a user tried to type the URL for the Administration Home using HTTP (non-secure), Terra Dotta redirects the user into HTTPS.

 


Public and Private Host Domains

Since Terra Dotta permits any combination of secure and non-secure hosts for the open and authorized sections of the interface, the terms Public and Private are used, rather than secure and non-secure.  While it is a virtual requirement that sites use SSL for their Private Host, Terra Dotta can operate without SSL, which can be helpful during initial site deployment and on staging servers.
 
During installation, you are prompted to provide the Public Host Domain. If this is the only host name provided, it cascades by default to the Private Host settings. To set a different Private Host, go to Maintenance > Environment Settings and set the appropriate values.  Each host definition, Public and Private, consists of the following settings:
 
Domain: The host name without protocol or path.  E.g. studyabroad.university.edu
 
Protocol: Either http or https (no colon or slashes).  This is the sole setting that determines whether SSL is enabled.
 
Relative Root: Any sub-site file path to the root of Terra Dotta within an IIS or Apache website.  Use / when Terra Dotta is in the site root.
 
Port: Leave blank to use default ports (80/443). 
  • Terra Dotta software can be configured to use any port for either the public, non-secure site or the private, secure (SSL-enabled) site. To change or set the port,go to Maintenance > Environment Settings and change the Private Host Port setting to the value desired, preceded by a colon (:). Example: :4343
  • The same can be done with the Public Host Port if desired, for example, using :8080.Also note that installations wishing to secure the entire site through SSL can mirror the settings for Public and Private Host, and place restrictions on the web server.
Note: For each of the above, Private Host inherits from Public are not provided.
In the current version, there is only partial support for Relative Roots that differ between Public and Private Hosts. Image paths in particular may be problematic.
 
Customers who have proprietary a SSL certificate installed on their site are responsible for ongoing maintenance of the certificate, keeping track of the expiration period and making payments for certificate renewal.  Terra Dotta is not responsible for certificates that expire due to non-renewal or other mishaps in handling of customer certificates.