Skip to content

Latest commit

 

History

History
53 lines (32 loc) · 2.02 KB

keystore.adoc

File metadata and controls

53 lines (32 loc) · 2.02 KB
Raw

Certificates, keys and key stores in Oxalis

The purpose of this document is to guide you in how to set up your PEPPOL certificates in order to make Oxalis "tick".

What are certificates used for?

PEPPOL has defined a PKI structure which allows for prudent governance of the access points, the SMP’s and so on.

Every low level message passed between access points and between the access point and the SMP, are signed with digital certificates.

There is a "test" and "production" hierarchy of certificates.

When your certificate is issued by PEPPOL, it will be signed with the intermediate AP certificate.

How are they used in Oxalis?

Oxalis validates your certificate as part of startup, and configures your installation accordingly.

You need only to supply your own key store, holding the private key and the corresponding PEPPOL certificate with your public key embedded.

How do I obtain a PEPPOL certificate for my Access point?

  1. Request PKI certificate in the OpenPEPPOL Service Desk (OpenPEPPOL members only).

  2. Follow instruction on the PKI issuing information page or updated link provided by OpenPEPPOL Support Team.

  3. Copy the generated JKS or PKCS#12 keystore to your $OXALIS_HOME directory.

  4. Update the configuration entry in oxalis.conf (Key store part).

  5. Start Oxalis.

Example configuration

oxalis.keystore: {
    path: my-keystore.p12 (1)
    password: "1uHGTjM7kHi7!CG" (2)

    key: {
        alias: "pno000001-s openpeppol aisbl id" (3)
        password: "@1F6m53NVJBOp!n" (4)
    }
}

  1. Key store filename.

  2. Password of key store provided during export from browser.

  3. Key alias found during inspection of key store.

  4. Password of key, normally the same as password for key store unless manually changed.