Certificates
Your security server needs two certificates from SK ID Solutions (SK):
| Certificate | What it does |
|---|---|
| Authentication certificate | Proves the identity of your security server to other security servers. |
| Signing certificate | Signs the messages of your organisation. |
Your server already made the keys and the certificate requests (CSRs). A CSR is the file you send to SK to get a certificate. The keys stay on your server.
This page covers steps 2, 3 and 4 of the guide.
Step 2: Order certificates
Section titled “Step 2: Order certificates”- Download the two files from the dashboard:
<label>-auth.pem. Order it as an authentication certificate.<label>-sign.pem. Order it as a signing certificate.
- Order both certificates in the SK portal.
- Press I have ordered.
SK checks your membership with RIA. Your organisation must be an X-tee member first. See X-Road membership.
SK sends the certificates by e-mail, usually within one day. You pay the certificate fees to SK.
Step 3: Upload certificates
Section titled “Step 3: Upload certificates”- Upload the authentication certificate on the Authentication certificate card.
- Upload the signing certificate on the Signing certificate card.
- When both are imported, press Continue.
Accepted files: .pem, .cer, .crt and .der. The file can be up to 64 KiB.
If the upload is refused:
| Message says | What to do |
|---|---|
| The certificate does not match the key | Check that you did not swap the authentication and signing files. |
| The file is not a certificate | Upload the certificate from SK, not the CSR. |
| The certificate has expired or is not yet valid | Check the dates. Order a new certificate if needed. |
| The file is too large | Upload only the certificate. |
Step 4: Register the auth certificate
Section titled “Step 4: Register the auth certificate”We send the registration to RIA for you.
- Check the certificate details: Subject, Serial, Fingerprint and Valid until.
- Press Register auth certificate.
RIA must approve the registration. In the test environment this is usually immediate.
If RIA refuses, the dashboard shows Registration refused and the reason from RIA. Fix the cause. Then press Try registering again.
When a certificate expires
Section titled “When a certificate expires”We send an e-mail 60, 30 and 7 days before a certificate expires.
When a certificate expires, your server stops taking traffic. Replace it before that date.
- Open the server in the dashboard. Press Replace certificate.
- Choose one:
- Keep the current key. Download the CSR.
- Make a new key. Press New key. Then download the new CSR.
- Order the new certificate from SK with that CSR.
- Upload the new certificate.
SK must issue the certificate for the CSR you downloaded. A certificate for another key is refused.
With New key, the current certificate keeps working until the new one is in use.
A new authentication certificate is registered with RIA again. It is in use when RIA approves it.