Channel certificates
Previous page Business Certificates
Next pageAPI Entitlements
Channel certificates are encrypted, disk-based profiles. This option is only available if your institution is subscribed to the swift.channel technical service. Contact Swift provisioning to become a subscriber. You can use channel certificate to consume APIs in MV-SIPN through VPN registered for your organisation. You can use the existing network interface such as the one for Swift Alliance Gateway (SAG) or provision new Swift Local Link (SLL) for new VMs intended to consume APIs.
Steps below should be completed by a security officerClick to learn more about SWIFTNet PKI Security Officer registration in the Knowledge Centre..
Refer to your web server documentation for the procedure for the generation of private key and certificate signing request (CSR) or follow the steps below if using either Java Keytool or OpenSSL. Use the values in the table below when creating them.
| Propertise | Descriptions | Examples |
|---|---|---|
| DN (Distinguished Name) | Use the Reference Number received from Step 1 in the DN when creating the certificate signing request (CSR). | Keytool: cn=51743732This is the Reference Number.,o=swift OpenSSL: /O=swift/CN=51743732This is the Reference Number. |
| Key Type | The key type for a Certificate Signing Request (CSR) is typically RSA. | RSA |
| Key Length | The supported key sizes for RSA keys in CSRs are 2048 to 8192 bits. | 2048 |
| Request Type | The request should be formatted according to the PKCS #10 standard (RFC 2986). | PKCS#10 |
keytool -genkey \
-alias ${DN_alias} \
-dname ${DN} \
-keyalg RSA \
-keysize 2048 \
-keystore ${keystore_filename}.jks keytool -certreq \
-alias ${DN_alias} \
-keystore ${keystore_filename}.jks \
-file ${certificate_request_filename}.csrSwift Certificate Authority(Swift CA) is a dedicated certificate authority within the Swift network responsible for issuing and managing certificates used for identification and communications among trusted systems on the network. Obtain the Swift CA certificate from the Entrust Authority Enrollment Server for Web application. There are two different network options to access this application, which are outlined in the table below.
In order to access Entrust Authority Enrollment Server for Web over the Internet, you must authenticate over 2-way TLS with a certified personal tokenClick to learn more about how to obtain and use personal tokens..
Request the channel certificate from the Entrust Authority Enrollment Server for Web application. There are two different network options to access this application, which are outlined in the table below.
In order to access Entrust Authority Enrollment Server for Web over the Internet, you must authenticate over 2-way TLS with a certified personal tokenClick to learn more about how to obtain and use personal tokens..
When double-clicking the certificate that has been generated, you should be able to see that your DN has been signed by the Swift CA.
Import Swift CA certificate
keytool -import -trustcacerts \
-alias swiftca \
-file swiftcacert.cer \
-keystore ${keystore_filename}.jksImport Channel Certificate
keytool -import \
-alias ${DN_alias} \
-file ${certificate_filename}.cer \
-keystore ${keystore_filename}.jksChannel certificate will expire, to avoid service interruptions due to expired certificate, we recommand setting up certificate report in O2M to receive timely notifications prior to the certificate expiry date.
Steps below should be completed by a security officerClick to learn more about SWIFTNet PKI Security Officer registration in the Knowledge Centre.. The set-up for recovery action may require 4-eyes authorisations if configured. Give the 4-eyes token code generated to another security officer. The other security officer must perform the 4-eyes authorisation of the recovery before midnight GMT of the next calendar day.