Sub Certificate Authority PAdES Webtechnika

How to get access to CA

1. Get Access Token to Sub-CA PAdES

The Authorized Entity must send a POST request to the endpoint below to register and receive access to Sub-CA PAdES.

Endpoint

Body:

2. Download Access Token

Once your request is granted, you will receive an email with the URL to download the Access Token.

The download link expires after 24h or after the first use.

3. Use Access Token

Access Token should be added to the Request Header

---

How to get Certificate for PAdES LTA

1. Register End Entity

Send a POST request to the registration endpoint of the given End Entity to receive the Secret Token of the given End Entity

Endpoint

Header:

Body:

You will receive a Secret Token

2. Send End Entity's CSR

End Entity sends CSR to endpoint (POST):

Header:

Body:

CSR must be in PEM format

CSR Requirements – PAdES Profile:

Basic Constraints

• CA: Must be set to false
• Path Length: Not applicable (should be None)

Key Usage

The following key usages must be set:

• digitalSignature: true
• nonRepudiation / contentCommitment: true

The following key usages must not be set (i.e., must be false or omitted):

• Key Cert Sign
• CRL Sign
• Key Encipherment
• Data Encipherment
• Key Agreement
• Key Agreement
• Encipher Only
• Decipher Only

Subject DN Fields

The CSR must include the following Subject Distinguished Name (DN) fields (OIDs):

• commonName (2.5.4.3)
• countryName (2.5.4.6)
• stateOrProvinceName (2.5.4.8)
• localityName (2.5.4.7)
• emailAddress (1.2.840.113549.1.9.1)

Fields must be compatible with End Entity data

Extended Key Usage

• Not required (can be omitted)

Subject Alternative Name (SAN)

• The CSR must not require the presence of a Subject Alternative Name extension

3. Receive Certificate

If everything is in order, you will receive an End Entity Certificate in the form of a PEM in Respond

End Entity certificate is valid for 5 years

---

Certificate

---

Certificates Archive

---

CRL Distribution Point

---

Certificate Revocation List Archive