Certificates

Certificates for the security server that has been connected to the Data Exchange Layer are renewed in the security server's administration interface. It usually takes approximately one week to renew the certificates and therefore they must be renewed on time.

On general level certificates are renewed as follows:

1. Certificate requests are created in the security server’s administration interface.
2. The certificates are applied for in the Digital and Population Data Services Agency’s (DVV) online service. The stored signing and authentication certificate requests are attached to the certificate application either when submitting the application or later by the technical contact person.
3. The new certificates are added to the security server via administration interface at the side of the expiring certificates.

Please note, that specific instructions about renewing of the certificates are described in the separate support article.

You can verify the periods of validity of Data Exchange Layer certificates in three ways:

• This information can be found in the security server user interface on the Keys and Certificates tab. Select SIGN and AUTH keys and verify the periods of validity of the certificates under Expires.
• The API endpoint of the security server management interface allows you to retrieve the periods of validity for all Authentication and Signing Certificates. For more information, go hereOpens in a new window..
• The X-Road Toolkit command xrdsst cert list will list the certificates and their periods of validity. For more information, go hereOpens in a new window.. 

If the certificate is about to expire, you can renew it by following the instructions in the article Renewing soon-to-expire certificates on the security server.

Connecting to the Data Exchange Layer will require a signing certificate and an authentication certificate. The signing certificate is organisation-specific and the authentication certificate is security server specific. An internal TLS certificate, which is specific to the subsystem, will be required for the encryption of a connection between the security server and the client system.

Familiarise yourself with the phases of creating and accepting the certificates in separate instruction video (YouTube)Opens in a new window.. Videos are narrated in English and have Finnish, Swedish and English subtitles.

Read more about the Data Exchange Layer's certificates in different situations:

• A shared a security server of several organisations
• A security sever delivered by an extern operator

If a person who does not have an authority to sign in the organisation applies for a certificate, the person needs a mandate. The mandate can be e.g. following text: “We authorise the person X as behalf of the organisation Y to apply for the authentication certificate for the organisaatio.fi-domain from the Digital and Population Data Services Agency.” The mandate must be signed by a person that already has an authority to sign in the organisation.