Getting started with the new MARWAN-TCS with Harica

How member institutions get started with MARWAN-TCS on the HARICA platform: account access, creating certificates and CA chains.

Updated 2026-11-12Sami Ait Ali Oulahcen

This document is aimed at administrators of MARWAN-TCS (Trusted Certificate Service).

MARWAN contracted GEANT TCS service back in 2018. From 2018 to 2020 the vendor was Digicert, then from 2020 to 2024 it was Sectigo. Now starting 2025, the service vendor is Harica, a certification authority made by a groupment of Greek universities.

1. First access to the platform#

To access the platform for generating certificates, you need to provide the following:

Create a user on the platform https://cm.harica.gr, or if you have an IdP login via "Academic Login" then send us the username
Enable 2FA from your profile settings
Information about 2 or 3 people who are gonna be in charge of issuing certificates: name + email
Official document for the creation of your institution (Dahir or official journal or equivalent)

Please send us this information by email to tcs@marwan.ma.

2. Creating certificates#

Login to the platform https://cm.harica.gr with the username created above, then select one of the following from the left panel, certificate request tab:

Server: for SSL server certificates
Email: for personal S/MIME mail certificates

Then proceed with the steps.

You don't need a CSR, you can generate it on the platform.

The platform will ask for a keyphrase for the private key, you can remove the keyphrase after creation by using openssl.

For RSA keys:

openssl rsa -in old-encrypted-key.pem -out new-key.pem

For ECDSA keys:

openssl ec -in old-encrypted-key.pem -out new-key.pem

3. Harica CA chain#

There are multiple Harica Certification Authority chains depending on the type of certificate issued. Check the issuer from the following command:

openssl x509 -in your_certificate.crt -noout -text | grep -E "Issuer:"

For DV certificates, the chain is:#

Hellenic Academic and Research Institutions RootCA 2015 + HARICA TLS RSA Root CA 2021 + GEANT TLS RSA 1

Download GEANT TLS RSA 1 CA chain

For OV certificates, the chain is:#

Hellenic Academic and Research Institutions ECC RootCA 2015 + HARICA TLS ECC Root CA 2021 + GEANT TLS ECC 1

Download GEANT TLS ECC 1 CA chain