Certificates Management
- Ivo Rocha
- Antonio Filho
- Fernando Vicente
Sign’Stash requires that a remote certificate is properly configured before being able to use it for document signing.
The backoffice service enables registered certificates listing through the visualization of a certificates table with filtering and paging capabilities, data consulting and editing of details and status, and certificate authority access renewal.
These functionalities are only available for Issuer operators.
How to consult registered certificates
Once you have accessed the backoffice service with your operator account, navigate to the “Certificates” option in the left side menu.
Filtering the certificates list
The certificates list displayed can be filtered by alias and registration date. To do this, you need to enter the required input and press the “Search” button, next the result of the requested query will be displayed on the table. It is also possible to clear all filters with the “Clear filters“ hyperlink below the “Search” button.
How to check registered certificate details
While consulting the registered certificates list, it is possible to check the detail of a specific certificate. To do this, you need to press the eye icon on the “Actions” column of the target certificate.
You will automatically navigate to the certificate details page, where two groups of details are displayed:
General certificate information.
Access details of the Certificate Authority (CA) from which the certificate was registered.
Follow below a short description of the fields:
Certificate Details:
Thumbprint | Unique certificate identification. |
|---|---|
Alias | Alias for the certificate (must be unique for the issuer). By default get some information of the certificate, but it can be edited. |
Wallet | Represents the Multicert certificate account relationship. This is used to aggregate the client certificates of an account. |
Validity Date | Validity date of the certificate. |
Creation date | The certificate registry date in the system. |
Maximum Batch Size | Maximum size of the batch of signatures that can be processed in a single request. |
Certificate access expiration date | This corresponds to the expiration date of certificate access, calculated based on a 60-day period following the last renewal. This timeframe is mandated by Portuguese law, which limits certificate access to a maximum of 60 days. |
Number of signatures available | Number of signatures available. |
Status | Current status of this certificate |
Certificate Authority Access:
Certificate Authority Id | Unique certificate authority identification. |
|---|---|
Certificate Authority Name | Name of the certificate authority. |
Credential Id in Certificate Authority | Unique certificate identification in the certificate authority. |
Certificate Authority access expiration date | This refers to the expiry date of the certification authority's access, which is determined by the validity period of the update token. When this date is reached, a new authentication process will be required to renew access to the certification authority. |
The Sign’Stash service requires your explicit permission to use your certificate (as described with more detail in https://must.atlassian.net/wiki/spaces/SIGNSTASH/pages/688129.
By regulatory reasons, this access needs to be rewed periodically in order for the Sign’Stash to continue to access the certificate for signing documents. This access expiration date can be consulted in the “Certificate Authority Access” section of the certificate detail.
Important notes:
Issuer company operators will be notified by e-mail when the certificate access granted to Sign’Stash is about to expire. For more information please consult https://must.atlassian.net/wiki/spaces/SIGNSTASH/pages/3440813/Renew+CA+Access.
If the credential access expiration date expires, all the client services using the certificate will fail when signing documents.
Once access to the certificate expires, client services that were using that certificate are automatically suspended. This behavior protects our service from receiving API calls that couldn't be processed. Please confirm that all client services are active after you have renewed the certificate access.
For further details consult: https://must.atlassian.net/wiki/spaces/SIGNSTASH/pages/3440958/Change+Client+Service+Data#Change-client-service-status