The certificates are signed with a SOAP-API. The the individual institutions do not have the keys for the sub-CAs. The DFN will change this praxis while migrat

The certificates are signed with a SOAP-API. The the individual institutions do not have the keys for the sub-CAs. The DFN will change this praxis while migrating to a new root certificate from "Deutsche Telekom" until 2019, but the staff at my university has major headaches. It's far more easier to document, that the members of the university should only trust (e.g. enter their password on) sites with a certificate signed by a CA with the same name as the university.