Creating Self-Signed Certificates

  1. Locate the CreateKeys.bat or CreateKeys.sh file in the EFTLink installation directory.

  2. Review the self-signed certificate parameters in the table.

    Table 2-4 Self-Signed Certificate Parameters

    Parameter Description Supported Value

    <algorithm>

    Algorithm used for TLS keys encryption.

    EC,DSA,RSA

    <bitlength>

    Number of bits - higher values equate to a higher level of encryption.

    256 (when using EC),

    1024,2048 (when using DSA),

    1024,2048,3072,4096,7680,8192,15360 (when using RSA)

    <signAlgorithm>

    Signature Algorithm used.

    SHA256withECDSA, SHA384withECDSA, SHA512withECDSA (when using EC), SHA256withDSA (when using DSA), SHA256withRSA, SHA384withRSA, SHA512withRSA (when using RSA)

    <daysValidity>

    Number of days after creation that the certificate will remain valid.

    100 to 750 days

    [-dname]

    Prompt for POS and Eftlink keystores certificate Distinguished Name information.

  3. From a terminal, run the appropriate script file with the -e switch and required parameters.

    CreateKeys.bat -e <algorithm> <bitlength> <signAlgorithm> <daysValidity> [-dname]

    CreateKeys.sh -e <algorithm> <bitlength> <signAlgorithm> <daysValidity> [-dname]

    For example: CreateKeys.bat-e RSA 4096 SHA256withRSA 750 -dname

  4. The file produced is dependent on EFTLink configuration. If EFTLink is configure for websocket communication, three files are generated. If it is configured for TCP socket communication, five files are generated. In both cases, the files are store in the keys folder, and the following actions must be completed.
    Mode File Description
    WebSocket eftlink.client.p12 This keystore contains the EFTLink client certificate used by the POS application for secure TLS communication. Move this file to the POS and remove it from the current EFTLink system.
    eftlink.keystore.properties Copy this configuration file to the POS. Both EFTLink and the POS application require this file.
    eftlink.server.p12 Retain this file on the EFTLink server side. This keystore contains the server certificate used to authenticate EFTLink connections.
    TCP Socket comms.keystore.properties Copy this configuration file to the POS. Both EFTLink and the POS application require this file.
    eftlink.private.jks This keystore contains the server certificate used to authenticate EFTLink connections. Retain this file on the EFTLink server side.
    eftlink.public.jks This keystore contains the EFTLink client certificate used by the POS application for secure TLS communication. Move this file to the POS and remove it from the current EFTLink system.
    pos.private.jks This keystore contains the EFTLink client certificate used by the POS application for secure TLS communication. Move this file to the POS and remove it from the current EFTLink system.
    pos.public.jks This keystore contains the server certificate used to authenticate EFTLink connections. Retain this file on the EFTLink server side.

  5. Remove the appropriate files from the EFTLink server once they have been transferred to their target systems. This ensures that TLS keys are present only where required, reducing the likelihood of key compromise and the potential for traffic between POS and EFTLink server to be monitored or intercepted.

    These instructions are repeated by the CreateKeys script file when keys are generated.

    Note:

    From V20 onwards, expiry of TLS certificates is enforced by default. Self-signed certificates will be valid for a maximum of 750 days.
  6. Clear warnings will be placed in log files when certificates are due to expire. Expired certificates will not result in loss of communication between POS and EFTLink.