User certificate setup

Access protection using mTLS

The instance of Ontoserver that is hosted through the SU-TermServ is protected using Mutual TLS. This means that with every access to the endpoint, a mutual certificate exchange takes place, so you need to set up a corresponding certificate on your side and present it with every connection establishment:

As a basis for the setup, of course, a corresponding certificate has to be requested. For this purpose, please refer to the corresponding FAQ entry.

---

The installation of the certificate in the browser depends on the browser used on the one hand and on the operating system on the other. The user certificate in PKCS#12 format (file extension .p12) is always required.

Mozilla Firefox

Firefox manages certificates itself. The process here is therefore identical for all operating systems.

1. Open the Firefox settings.
2. Navigate to Privacy & Security.
3. Scroll down to Certificates in the Security section. You will find this in the lower third of the page.
4. Click on ‘Show certificates’.
5. Select the tab ‘Your certificates’.
6. Click on Import....
7. Select the certificate file and enter the password.

The certificate now appears in the list and you can use it. To test it, call up https://terminology-highmed.medic.medfak.uni-koeln.de/fhir/CodeSystem. A dialogue box will appear requesting which certificate should be used. The default setting ‘Remember this decision’ should be ticked so that you are not asked again each time you access the site:

Google Chrome and related browsers

The following steps must be followed to import a certificate into Chrome and derived browsers like Edge, Opera, Brave, etc., which use the Chromium engine:

1. Open the Chrome settings.
2. Naviagate to Privacy and security.
3. Scroll down to Security.
4. Scroll down to Manage certificates in the Advanced section.
5. A window opens in which you click on the ‘Import’ button to integrate the certificate.
6. You will be navigated through the certificate settings. Among other things, the certificate file is selected here and your password must be entered. Unless otherwise desired, the default settings can be used.
7. Certificate has been successfully imported.

To test, go to https://terminology-highmed.medic.medfak.uni-koeln.de/fhir/CodeSystem. A dialogue box appears asking which certificate should be used:

Postman

In addition to adding a certificate in various browsers, it is also possible to integrate the certificate in Postman. The following steps are necessary for this:

1. Open the Postman settings.
2. Navigate to Certificates.
3. Click on the Add Certificate... button in the Client certificates section.
4. Enter the following URL as the host: https://terminology-highmed.medic.medfak.uni-koeln.de/fhir/CodeSystem. The port remains empty.
5. Upload your certificate. This is a PFX file. The other two upload functions remain empty.
6. Enter your password in the Passphrase input field.
7. After you have clicked the Add button, your certificate should be successfully imported into Postman.

To test, call https://terminology-highmed.medic.medfak.uni-koeln.de/fhir/CodeSystem. Postman automatically accesses the stored certificate, so executing the previous URL should immediately return a bundle with CodeSystems: