8 Keystore and Certificate for UK Open Banking Directory

This section describes the steps to generate the ‘jks’ files and configure the same in OBDX for Open Banking Directory integration.

Steps to create ‘identity’ & ‘trust’ JKS files

  1. Create two different folders OBWAC and OBSEAL and perform the below steps in the respective folders.
    Description of ukopen3.png follows
    Description of the illustration ukopen3.png

  2. One should have the bank’s OBWAC and OBSEAL configuration files(.cnf) to proceed further. Copy the files in the respective folders created above.
  3. To generate CSR and key files for OBWAC and OBSEAL certificate with the help of .cnf file, execute below openssl commands

    OBWAC> openssl req -new -config obwac.cnf -out obwac.csr -keyout obwac.key

    OSEAL> openssl req -new -config obseal.cnf -out obseal.csr -keyout obseal.key

    Note:

    Enter the same pass phrase(pass1234 for example) for both obwac and obseal and make a note of it.

    Description of ukopen4.png follows
    Description of the illustration ukopen4.png


    Description of ukopen5.png follows
    Description of the illustration ukopen5.png

    .csr and .key files have been generated with the above commands


    Description of ukopen6.png follows
    Description of the illustration ukopen6.png


    Description of ukopen7.png follows
    Description of the illustration ukopen7.png

  4. Upload the above generated .csr files in Open Banking Directory Account to get OBWAC and OBSEAL pem files.

    Let’s assume, below output on uploading .csr files in the OB directory account

    Your OB WAC certificate xT-9_jWfAME1feTKZGaf8Dd_x1s was successfully created

    Your OB Seal certificate I6cfLYUSt91fOw13kdO0HYdlVTc was successfully created

    Below are the steps to generate the OB WAC and OB Seal certificates in the Open Banking Directory Account(Note: Below screenshots are from the Sandbox account, kindly use Production Open Banking Directory Account details for the production setup)

    1. Login with Open Banking Directory account credentials and select the desired Directory Participant(Your Organization).
      Description of ukopen8.png follows
      Description of the illustration ukopen8.png

    2. Go to ‘Certificates’ tab
      Description of ukopen9.png follows
      Description of the illustration ukopen9.png

    3. Click on ‘Add new Organisation Certificate’ button
      Description of ukopen10.png follows
      Description of the illustration ukopen10.png

    4. Select ‘Signing’ radio button to upload OB Seal .crs file
      Description of ukopen11.png follows
      Description of the illustration ukopen11.png

    5. Select and upload the OB Seal .csr file
      Description of ukopen12.png follows
      Description of the illustration ukopen12.png


      Description of ukopen14.png follows
      Description of the illustration ukopen14.png


      Description of ukopen13.png follows
      Description of the illustration ukopen13.png

    6. Clicking on the ‘Upload’ button will upload and display success popup
      Description of ukopen15.png follows
      Description of the illustration ukopen15.png

    7. Repeat the above steps for OB WAC certificate generation. Select the ‘Transport’ radio button for OB WAC.
      Description of ukopen16.png follows
      Description of the illustration ukopen16.png


      Description of ukopen17.png follows
      Description of the illustration ukopen17.png


      Description of ukopen18.png follows
      Description of the illustration ukopen18.png


      Description of ukopen19.png follows
      Description of the illustration ukopen19.png

    8. Generated certificates would be visible on the certificates listing page.

      Certificate .pem files can be downloaded with the help of ‘Get PEM’ button displayed next to the respective certificates
      Description of ukopen20.png follows
      Description of the illustration ukopen20.png

      Description of ukopen21.png follows
      Description of the illustration ukopen21.png

      Description of ukopen22.png follows
      Description of the illustration ukopen22.png

  5. Download the generated OBWAC and OBSEAL files and copy in the respective folders which have created locally. Change the extension from ‘.cer’ to ‘.pem’ of the downloaded files if required.
    Description of ukopen23.png follows
    Description of the illustration ukopen23.png


    Description of ukopen24.png follows
    Description of the illustration ukopen24.png

  6. Generate decrypted keys by executing below commands

    OBWAC> openssl rsa -in obwac.key -out obwac_dec.key

    OBSEAL> openssl rsa -in obseal.key -out obseal_dec.key

    Enter the pass phrase ‘pass1234’ when provided, which had been entered at the time of the .key files.


    Description of ukopen25.png follows
    Description of the illustration ukopen25.png


    Description of ukopen26.png follows
    Description of the illustration ukopen26.png


    Description of ukopen27.png follows
    Description of the illustration ukopen27.png


    Description of ukopen28.png follows
    Description of the illustration ukopen28.png

  7. Download OB Root and Issuing Certificates from the Open Banking directory
    1. URL for sandbox certificates: https://openbanking.atlassian.net/wiki/spaces/DZ/pages/252018873/OB+Root+and+Issuing+Certificates+for+Sandbox
    2. URL for production certificates: https://openbanking.atlassian.net/wiki/spaces/DZ/pages/80544075/OB+Root+and+Issuing+Certificates+for+Production
  8. Create a copy of both the downloaded certificate files and change the extension from .cer to .pem and copy in the OBWAC folder. Keep the file names same
    1. OB_SandBox_PP_IssuingCA.cer to OB_SandBox_PP_IssuingCA.pem
    2. OB_SandBox_PP_RootCA.cer to OB_SandBox_PP_RootCA.pem

    Note:

    Remove the spaces from the pem file names if there are any.

    Description of ukopen29.png follows
    Description of the illustration ukopen29.png

  9. Use ‘cat’ command on linux or ‘type’ command in Windows machine to build the certificate chain from the above three .pem files
    1. cat xT-9_jWfAME1feTKZGaf8Dd_x1s.pem OB_SandBox_PP_IssuingCA.pem OB_SandBox_PP_RootCA.pem > chain.pem

      OR

    2. type xT-9_jWfAME1feTKZGaf8Dd_x1s.pem OB_SandBox_PP_IssuingCA.pem OB_SandBox_PP_RootCA.pem > chain.pem
      Description of ukopen30.png follows
      Description of the illustration ukopen30.png


      Description of ukopen31.png follows
      Description of the illustration ukopen31.png

  10. Creating Custom Keystore and importing chain

    WebLogic Server Java Utilities is used to create the custom keystore and importing private key & the certificates chains.

    Resource URL for reference: https://docs.oracle.com/cd/E13222_01/wls/docs81/admin_ref/utils20.html

    Execute the below command with files in the OBWAC directory

    java -cp /home/devops/Oracle/Middleware/Oracle_Home/wlserver/server/lib/weblogic.jar utils.ImportPrivateKey -certfile chain.pem -keyfile obwac_dec.key -keystore openbanking_custom_identity.jks -storepass pass1234 -alias openbanking_obtrans

    Note:

    “/home/devops/Oracle/Middleware/Oracle_Home/wlserver/server/lib/” this path is to locate the weblogic.jar file, this may differ as per the setup.

    Description of ukopen32.png follows
    Description of the illustration ukopen32.png

    A new .jks file with the filename ‘openbanking_custom_identity.jks’ is created.


    Description of ukopen33.png follows
    Description of the illustration ukopen33.png

  11. Creating Custom Identity Trust

    Execute below two commands.

    Enter ‘yes’ and press enter when prompted “Trust this certificate? [no]:”.

    Note:

    “/home/devops/jdk18/bin/” this path is to locate the java keytool, this may differ as per the setup.

    1. Description of ukopen34.png follows
      Description of the illustration ukopen34.png

    2. /home/devops/jdk18/bin/keytool -keystore openbanking_custom_trust.jks -importcert -file OB_SandBox_PP_IssuingCA.cer -alias openbanking_issueca -storepass pass1234
      Description of ukopen35.png follows
      Description of the illustration ukopen35.png

      Another .jks file with filename ‘openbanking_custom_trust.jks’ is created.


      Description of ukopen36.png follows
      Description of the illustration ukopen36.png


      Description of ukopen38.png follows
      Description of the illustration ukopen38.png

      Note:

      OpenSSL 1.1.1n 15 Mar 2022 is used to perform above steps.

      Description of ukopen39.png follows
      Description of the illustration ukopen39.png