Skip to main content

Full Service - Short-Term Certificates

The activation process consists of the following steps:

  1. Obtain an activation token

    The partner requests an activation token from the Token API for a specific Identification Provider. The returned token can either be communicated to the end customer or used directly as part of a redirect URL to initiate the activation flow.

  2. Complete the identification process

    The end customer starts the identification process using the provided token. During this process, the customer is redirected to the configured Identification Provider, where their identity is verified.

  3. Start the activation

    After the identification has been completed successfully, the partner receives the activation URL. The partner then redirects the end customer to this URL to start the Short-Term Certificate activation process, including any required parameters.

  4. Start the signature process

    Once the activation process has been completed successfully, the partner may initiate one or more signing operations using the activated Short-Term Certificate. The certificate can be used to sign documents until it expires.

Although the use of a trusted timestamp is optional, it is strongly recommended for signatures created with Short-Term Certificates.

Since the certificate has only a limited validity period, adding a trusted timestamp allows the signature to be proven as valid at the time it was created, even after the certificate has expired. To ensure long-term validation of the signed document, it is recommended to produce an LTV-enabled (Long-Term Validation) signature.1

Requried documentation and interfaces​

Token API​

To initiate the activation process, the partner must first obtain an activation token using the Token API. When requesting the token, the partner selects the Identification Provider that will be used to perform the customer's identity verification.

The returned activation token can either be communicated to the end customer or embedded in a redirect URL.

Short-Term Certificiate​

Refer to the Short-Term Certificates documentation for details on starting the activation and signing processes. The documentation describes the available API endpoints, supported request parameters, request and response formats, and the complete signing workflow.

Timestamp​

Refer to the Timestamp documentation for details on creating a timestamp for the signing process.

Footnotes​

  1. LTV-enabled (Long-Term Validation) signatures include a qualified electronic timestamp together with all required revocation information (such as OCSP responses and/or CRLs). This ensures that the signature can still be validated after the signing certificate has expired. One example is a PAdES-LTV signature: https://en.wikipedia.org/wiki/PAdES ↩