On June 8th 2015, the White House issued policy that all publicly accessible government websites and web services only provide service through a secure connection by December 31, 2016. This policy applies to publicly accessible websites and web services that 'are maintained in whole or in part by the Federal Government and operated by an agency, contractor, or other organization on behalf of the agency.’ All web browsing should be conducted using https only, secured via Transport Layer Security (TLS) encryption. This requires use of TLS/SSL certificates for web sites and web services.
The use of HTTPS is encouraged on intranets, but is not explicitly required. Newly developed websites and services at all Federal agency domains or sub-domains must adhere to the White House issued policy.
Details can be found at https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-13.pdf (link is external)
Servers should be configured to support:
Detailed information can be found at http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r1.pdf (link is external).
Contractors are not issued an TLS/SSL certificate by NCI. Contractors can either request a free certificate from the NIH or obtain a certificate from a commercial vendor, but the latter option (commercial) is not free. While most contractors have had success getting a free certificate from NIH, some have reported issues such as substantial delays. If you choose to work with the NIH, read the OCIO TLS Digital certificate guidance process.
If you choose to obtain a certificate from a commercial vendor, NCI will approve certificate requests on the NCI domain names for legitimate and verified contractors. NCI contractors have had success obtaining commercially-provided TLS/SSL certificates on the nci.nih.gov and cancer.gov domains from the following vendors: Digicert, Godaddy, and Comodo. It is not a requirement to use a particular certificate vendor; we only listed those vendors with whom we have had recent experience.Contractors should allow sufficient lead time for certificate request validation and approval.
It may take weeks for the request to be validated and approved depending on the particular vendor's validation process.If you are requesting a certificate for an NCI domain site, notify nciirm@mail.nih.gov (link sends e-mail)
with your company name, company contact name, phone number and email address, the NCI contract project manager, the requested URL DNS name (e.g. ThisNewNCIwebsite.nci.nih.gov ) and the certificate provider you plan to use so we can notify the federal domain owner that a request is forthcoming.
If your provider has difficulty getting approval from the federal domain owner, email the NCI at nciirm@mail.nih.gov