Creating CVC CAs

When creating a CVC CA there are three CA Reference fields in the standard. In EJBCA, these are mapped to a DN structure to have common handling in EJBCA.

The mapping is:

• Country = C (ISO 3166-1 2 letter country code)

• Mnemonic = CN (ISO 8859-1 1-9 letter string)

• Sequence = certificate serial number (ISO 8859-1 5 letter alphanumeric string)

For example, when creating a Country Verifying Certificate Authority (CVCA), select type CVC in the Create CA page and enter a Subject DN like: C=SE,CN=TESTCVCA.

The sequence should be a pure numeric sequences of 5 characters (00001, 00002, etc), or country code + numeric (SE001, SE002, etc), or country code + alphanumeric (hex) (SEA01, SEB01, SEB0F, etc).

For the CVCA, select Signed by=Self Signed and Certificate Profile=ROOTCA.

To create a Document Verifier (DV), select Signed by=Name of CVCCA and Certificate Profile=SUBCA. For more information, see Document Verifiers (DV).

You can import a CVCA certificate from another country as an External CA using Edit Certificate Authorities > Import CA certificate. When a CA has been imported, this CA certificate can authenticate CVC requests from foreign DVs.

Importing CVC CAs

For test purposes, you may receive a private key and a CV certificate for the CVCA trust point used by the passport manufacturer when creating specimen passports.

To test your process and inspection systems, if you have a PKCS#8 private key and a CV certificate with the public key, you can import a CVCA (with soft keystore) in EJBCA:

Example import command using the given CV Certificate:

Example import command using the same private/public keys, but generating a new certificate:

Creating Document Verifiers (DVs)

Creating domestic Document Verifiers (DVs) is as straightforward as creating a SubCA to your CVCA, using a SubCA certificate profile.

You can sign foreign DVs by treating them as regular End Entities and create an end entity and choose SubCA certificate profiles when adding the end entity. You can then process the certificate requests received by the foreign DV as a regular end entity certificate request:

• Using the Public Web GUI

• Using the WS CLI clientToolBox CvcWsRaCli

• Using the WS-API cvcRequest method from your own client

You can also create foreign DVs as external SubCAs. Note however that an advantage of handling foreign DVs as end entities is that you can process and renew them using the same WS-API as you can use for inspection systems.

You can create a DV to be signed by a foreign CVCA by creating a new CA and selecting Signed By=External CA. You need the CVCA certificate of the foreign CVCA to create the request to be sent. When creating this CA a self-signed CV certificate request is created.

You can at any time create a CV certificate request from a DV by going into Edit Certificate Authorities and click Make Certificate Request. This generates a CSR created by the CAs keystore. When receiving the signed certificate back, you can feed that to your IS-system. There is no need (or way) to import it into EJBCA.

You can renew a DV by going into Edit Certificate Authorities and click Renew CA. By uploading the CA certificate supposed to sign the certificate, you can get a new CSR created. You can import the received certificate by clicking Receive Certificate Response. You only have to (or can) import one issued certificate to make your DV operational. If you get a DV signed by multiple CVCAs you can distribute the other than the main DV certificate to the IS's (or AT or ST) by other means.

By specifying the CA tokens password and enabling Renew Keys, the DV will generate new keys. This works for both soft CA tokens and PKCS#11 CA tokens. The renewal CSR is not signed with the old keys, but that can be done manually.

DVs have short validity periods and it can be useful to have them automatically renewed. You can use the EJBCA service Renew CA Service to automatically renew CAs. For more information, see Renew CA Service.

Importing DVs

You can also import DVs. Doing that you need a chain with the DV certificate first, and the CVCA certificate second.

Creating Authenticated Requests

To sign CV certificate requests by your Country Verifying CA (CVCA), go to Edit Certificate Authorities, select your CVCA and then click Create Authenticated Certificate Signing Request. You can upload the CV certificate request to the CVCA, and get an Authenticated request back. This is required when sending certificate requests from your DVs to other member states.

By renewing a Document Verifier (DV) and sending a request to another member state you can get the request automatically authenticated by signing the request with the DVs old keys. You can do this by creating a CSR for the new DV key, and making an authenticated request signed with the old key. After generating new keys on the Crypto Token, go to Certification Authorities, select the desired DV, and click Edit. Ensure that the sequence is updated, then select to generate a new CSR for the new key in the Externally signed CA creation/renewal section. If it is a renewal, an authenticated request, authenticated with the DVs current key, will be returned (the new key is not yet activated).

To view the authenticated DV request using the clientToolBox CLI tool, use the following:

To verify the authenticated DV request, you need the whole chain in case of ECDSA, since the EC curve parameters are only present in the CVCA certificate.

To automate renewing of DVCAs using the WS API, use the following:

For more information, see Web Service Interface.

Creating Link Certificates

Issuing a link certificate must be done when a CVCA is renewed. It can be used to switch CA completely, new keys, new algorithms, and new Country/Mnemonic.

When renewing a Country Verifying CA (CVCA) in the EJBCA Admin UI, a link certificate is automatically created. Requirements on link certificates are specified in Common Certificate Policy for the Extended Access Control Infrastructure for Travel and Residence Documents (BSI TR-03139). When renewing a CVCA, the signature algorithm can be changed. Note that the algorithm identifier in the link certificate itself is the new algorithm as the algorithm is tied to the public key, not to the certificate signature and the link certificate itself is signed by the old CVCA certificate, with the algorithm specified on the public key in the old CVCA certificate.

It is also possible to manually create link certificates using the clientToolBox CLI tool.

To create CVCA link certificates, the same approach is used. First renew the CVCA (generating new keys), which creates a new self-signed CVCA certificate internally. Download the new self-signed CVCA certificate (for example from Basic Functions). After this, you can create a link certificate by specifying the CVCAs name in the text field in Edit Certificate Authorities and clicking Sign Certificate Request. Upload the new CVCA certificate and select Use previous key and Create link certificate.

Command Line Interface Commands

The Command Line Client using the WS-API can be used for reference on how to use the WS-API.

The client has the following functions:

• cvcrequest: Adds a new user and requests a CV Certificate.

• cvcgetchain: Retrieves the last certificate chain for a user.

• cvcprint: Used to parse and print CV Certificate and requests.

Enter the command to retrieve usage information:

Workflow Example

This gives an overview of a full workflow example of how to create a DV and issue IS certificates.