====== Issuing a Personal TCS Certificate ======

The process of issuing a Personal TCS Certificate is fully self-served. In order to access this service, the following criteria must be met:

  * your home organization must be a [[https://www.eduid.cz/en/members|member of eduID.cz]], acknowledged as an **Identity Provider**
  * your home organization must grant you the permission to request a Personal TCS Certificate

===== Supported web browsers =====

All web browsers with a functional JavaScript interpreter and the W3C DOM standard are supported. Since the code for native certificate generation has disappeared from most browsers and it is difficult to maintain support for the remaining ones, we have prepared an alternative method in which the request is also generated by the browser, but unlike native generation, the certificate and its private key are stored as encrypted file to the user's computer disk.

In some cases, it may happen that the certificate cannot be issued due to its settings due to its settings. If this happens, use a different browser or consult computer support in your workplace.

===== The process of issuing a new Personal TCS Certificate =====

The keys required for the certificate are securely generated on the user's computer, using custom code created by the CESNET CA development team, which is part of the TCS portal. After the certificate is issued, the private key and the certificate itself are stored on the user's disk as an encrypted PKCS12 file, which can be imported into almost any mail client or web browser.

No other initial steps are required for alternative certificate generation, the browser without its own code for generation is automatically recognized. So start on the tcs.cesnet.cz portal by selecting Personal certificate in the left menu. In this case, you must first verify your identity by logging in to start generating.

<WRAP picture>{{:cs:tcs-p-alt1.png|}}\\
//Úvodní stránka generování osobního certifikátu (Chromium)//
</WRAP>\\

After the generation starts, the keys are created and sent to the external certification authority that issues the certificate. The user is then prompted to enter a password to encrypt the resulting file. Choose a password ** secure ** (character combination, length) and memorable at the same time. Without his knowledge, the file cannot be decrypted. Conversely, with a simple password or a password already used for other purposes, you can make the certificate available to a potential attacker.


<WRAP picture>{{:cs:tcs-p-alt2.png|}}\\
//Průběh alternativního generování klíčů a zadání hesla k výslednému šifrovanému souboru (Chromium)//
</WRAP>\\

After entering the password, the certificate is usually saved in the file ** usercert.p12 ** in the folder for ** downloaded files ** on your computer. The file may exceptionally be named ** otherwise **, depending on the specific browser.

<WRAP picture>{{:cs:tcs-p-alt3.png|}}\\
//Dokončení generování certifikátu a jeho uložení do souboru na disk (Chromium)//
</WRAP>\\

In case of problems, please do not contact the CESNET TCS-RA team, but ** computer support at your workplace **, who will be happy to advise you on their removal.