creditkudos / eidas

:satellite: :wrench: Tools for reading and creating eIDAS certificate signing requests

eIDAS

Tools for reading and creating eIDAS certificate signing requests

Generating a Certificate Signing Request (CSR)

With Docker:

docker run -v $(pwd):/work --network none creditkudos/eidas \
  -country-code GB \
  -organization-name "Your Organization Limited" \
  -organization-id PSDGB-FCA-123456 \
  -common-name 0123456789abcdef

With go (requires go 1.11 or higher):

go get github.com/creditkudos/eidas/cmd/cli

go run github.com/creditkudos/eidas/cmd/cli \
  -country-code GB \
  -organization-name "Your Organization Limited" \
  -organization-id PSDGB-FCA-123456 \
  -common-name 0123456789abcdef

Open Banking Flags

• -common-name should be the same as the organisation_id field from your entry in the Open Banking Directory.
• -organization-id should be in the form of PSD<Regulator Country Code>-<Regulator>-<Unique ID>
• -organization-name should be your official company name.
• -country-code should be an ISO 3166-1 alpha-2 country code.

Other flags

You can see the available flags with

go run github.com/creditkudos/eidas/cmd/cli -help

By default this will generate two files: out.csr and out.key containing the CSR and the private key, respectively.

It will also print the SHA256 sum of the CSR to stdout.

To print out the details of the CSR for debugging, run:

openssl req -in out.csr -text -noout -nameopt multiline

Notes on CSR format

For both QWAC and QSEAL types the following attributes are required in the CSR:

Subject

• Must contain country code, organisation name and common name.
• Must also contain the organisation ID. Organisation ID (ITU-T X.520 10/2012 Section 6.4.4) isn't supported by most tools by default (including OpenSSL and go) but this can be added to the subject as a custom name with the ASN.1 OID of 2.5.4.97. Should be something like PSDGB-FCA-123456.
• It's not specified in the standards (AFAICT) but these should be in a defined order:
  1. Country Code (C=)
  2. Organization Name (O=)
  3. Organization ID (2.5.4.97=)
  4. Common Name (CN=)

Key Parameters

• Key should be 2048-bit RSA.
• Signature algorithm should be SHA256WithRSA.

Extensions

Key Usage

• X509v3 Key Usage extension should be marked as critical.

QWAC	QSEAL
Digital Signature	Digital Signature
Non Repudiation

Extended Key Usage

QWAC	QSEAL
TLS Web Server Authentication
TLS Web Client Authentication

Note: For QSEAL, a CSR is expected to not have an extended key usage section at all, rather than an empty one.

Subject Key Identifier

• Should be the 160-bit SHA1 sum of the PKCS1 public key.

qcStatements

This is an extension used by eIDAS as documented here ETSI TS 119 495 Annex A. The required parameters included in this are the Competent Authority's name and ID, e.g. "Financial Conduct Authority" and "GB-FCA", and the roles the TPP requires, e.g. "PSP_AI" (Account Information).

eidas's Issues

Created an online version

Morning,
Thanks for the inspiration. I have created an online version at https://eidascsr.darkedges.com/ for my learning and development.

Just thought I would share it with you.

Regards
Nicholas Irving

Change analysis - eIDAS profile 1.2.1 and 1.3

ETSI v1.2.1
ETSI v1.3

Could not upload OBWAC and OBSEAL in open banking

I am trying to generate a csr file using the config file for openbanking in openssl in windows10 .
In newer openssl version OID 2.5.4.97 is reserved for organizationIdentifier, so you can change your obwac.conf by removing the OID and it should work.
with OID we are unable to generate the csr file.so by removing the OID i m able to generate the csr file.But as OID is a mandatory in the CSR the openbanking is not accepting the certificate.Can some one help??

How to self sign csr preserving qcStatements

Hi,
first of all thank you for this project, which really helped me.
While csr generated with your tool contains qcStatements, when I try to generate from it a self-signed certificate those extensions are not copied into the certificate.
openssl x509 -req -days 3650 -in out.csr -signkey out.key -out out.crt
Is there a way to self-sign it preserving eidas extensions?

OBWAC and OBSeal support

Support open banking TEST eIDAS framework certificates and seals.

This must be done as an intermediary step before eIDAS rollout in September

QC Statements are not correct

QCStatements generated by the program is not correct:

For GB-FCA PSP_PI,PSP_AI it should be (According to OB "Issue: 2.2")

DER:306e3013060604008e4601063009060704008e4601060330570606040081982702304d302630110607040081982701020c065053505f504930110607040081982701030c065053505f41490c1b46696e616e6369616c20436f6e6475637420417574686f726974790c0647422d464341

But it is generating

DER:306c3013060604008e4601063009060704008e4601060330550606040081982702304b302430220607040081982701020c065053505f50490607040081982701030c065053505f41490c1b46696e616e6369616c20436f6e6475637420417574686f726974790c0647422d464341

I feel like all of the QC Statements are not correct. Practically speaking issue i have i am able to upload this certificate to open banking directory but unable to associate it to the statement. Could be something to do with this.

OpenSSL eIDAS PSD2 Certificate Signing Request Profiles Issue 2_2.pdf