Skip to main content

Identity Provider - Short-Term Certificates

For Short-Term Certificates, both the activation process and the signing process are required. A certificate must first be activated before it can be used to create one or more digital signatures.

The activation and signing workflow consists of the following steps:

  1. Identify the customer and create an identity record

    The Identity Provider (or the initiating system) performs the identification of the customer. Once the customer's identity has been verified, the relevant identification data is transmitted to the identity interface in the form of an identity record.

  2. Receive the activation URL

    The identity interface returns an activation URL. This URL is needed in the Short-Term Certificate activation process.-

  3. Complete the Short Term Cert activation

    The customer completes the Short-Term Certificate activation process. Once the activation has been completed successfully, the certificate is ready to be used for signing operations.

  4. Complete the Short Term Cert signing process

    After the certificate has been activated, the signing process can be invoked one or more times to digitally sign documents. Depending on the certificate validity period and application requirements, multiple documents may be signed without repeating the activation process, as long as the certificate remains valid.

Although the use of a trusted timestamp is optional, it is strongly recommended for signatures created with Short-Term Certificates.

Since the certificate has only a limited validity period, adding a trusted timestamp allows the signature to be proven as valid at the time it was created, even after the certificate has expired. To ensure long-term validation of the signed document, it is recommended to produce an LTV-enabled (Long-Term Validation) signature.1

Requried documentation and interfaces​

Before implementing the Short-Term Certificate workflow, ensure that your application integrates the required interfaces described below.

Identity interface and Identity record​

Refer to the Identity interface and Identity record documentation for details on creating an identity record and submitting it to the identity interface.

info

For Short-Term Certificates, the Response\Success and Response\Error parameters are mandatory

Short-Term Certificiate​

Refer to the Short-Term Certificates documentation for details on invoking the signing process, supported request parameters, and the available API endpoints.

Timestamp​

Refer to the Timestamp documentation for details on creating a timestamp for the signing process.

Footnotes​

  1. LTV-enabled (Long-Term Validation) signatures include a qualified electronic timestamp together with all required revocation information (such as OCSP responses and/or CRLs). This ensures that the signature can still be validated after the signing certificate has expired. One example is a PAdES-LTV signature: https://en.wikipedia.org/wiki/PAdES ↩