Web Server Certificates
Previous page Web Server Configurations
Next pageSession Distribution
Web server certificates are used to establish a mutually trusted connectivity between the web server and Swift. This certificate is issued by the Swift CA, a dedicated certificate authority within the Swift network responsible for issuing and managing certificates used for identification and communications between trusted systems on the network. Follow the steps below to create web server certificates.
The web server certificate is registered by Swift and is visible under the Web certificates tab of the Online Operations Management (O2M) application accessible from MV-SIPN. After Swift has registered the web server, the security officer should set up the web server for certification. Follow the steps below.
1Login to O2M and click Certificate Management. 2Click Web Certs tab and find the DN node registered for you. 3Double-click the DN node in the tree view. 4Verify the DN information of the certificate and click Certify. 5Click OK in the pop-up to confirm. 6The Certificate Setup Request screen appears. Click Confirm to confirm again. 7Under Certificate Information, expand Activation Secrets. 8The Status of the certificate should be changed to Ready for Certification. 9Take note of the Reference Number and Authorisation Code to be used later.Obtain the Swift CA certificate from the Entrust Authority Enrollment Server for Web application. There are two different network options to access this application, which are outlined in the table below.
In order to access Entrust Authority Enrollment Server for Web over the Internet, you must authenticate over 2-way TLS with a certified personal tokenClick to learn more about how to obtain and use personal tokens..
Refer to your web server documentation for this certificate's import procedure for this certificate.
Authenticated connection for establishing HTTPS or custom protocol between two parties (client/server, of which at least one is SWIFT) must be established using at least one of the following security protocols:
| TLS version | Cipher Suites |
|---|---|
| 1.3 |
|
| 1.2 |
|
For compatibility with customer facing incoming and outgoing flows, ECDSA is allowed to be used as authentication algorithm.
Refer to your web server documentation for the procedure to generate a private key and certificate signing request (CSR). You may also follow the steps below if using either OpenSSL or Java Keytool. Use the values in the table below when creating them.
| Propertise | Descriptions | Examples |
|---|---|---|
| DN (Distinguished Name) | Use the Reference Number received from Step 1 in the DN when creating the certificate signing request (CSR). | Keytool: cn=51743732This is the Reference Number.,o=[your_bic],c=ww OpenSSL: /C=ww/O=[your_bic]/CN=51743732This is the Reference Number. |
| Key Type | The key type for a Certificate Signing Request (CSR) is typically RSA. | RSA |
| Key Length | The supported key sizes for RSA keys in CSRs are 2048 to 8192 bits. | 2048 |
| Request Type | The request should be formatted according to the PKCS #10 standard (RFC 2986). | PKCS#10 |
keytool -genkey \
-alias ${DN_alias} \
-dname ${DN} \
-keyalg RSA \
-keysize 2048 \
-keystore ${keystore_filename}.jks \keytool -certreq \
-alias ${DN_alias} \
-keystore ${keystore_filename}.jks \
-file ${certificate_request_filename}.csrRequest the channel certificate from the Entrust Authority Enrollment Server for Web application. There are two different network options to access this application, which are outlined in the table below.
In order to access Entrust Authority Enrollment Server for Web over the Internet, you must authenticate over 2-way TLS with a certified personal tokenClick to learn more about how to obtain and use personal tokens..
When double-clicking the certificate that has been generated, you should be able to see that your DN has been signed by the Swift CA.
Refer to your web server documentation for the procedure to import the downloaded certificate in your web server. If you use Java Keytool, then follow the steps below.
In some cases, the Swift CA certificate must be installed in both the keystore and trust store. In cases where this is required, but not performed, this may result in an SSL handshake error, as the web server is unable to complete the entire security chain. Please refer to your web server documentation.
keytool -import -trustcacerts \
-alias swiftca \
-file swiftca.cer \
-keystore ${keystore_filename}.jkskeytool -import \
-alias ${DN_alias} \
-file ${certificate_filename}.cer \
-keystore ${keystore_filename}.jks