RSA Signature Keys

RSA signature key pairs are used in the following cases:

  • Certain processes in the system may need to write files to or read files from Oracle Cloud Object Storage. Cloud object storage has its own method for encrypting files, and products using the framework application do not need to define additional configuration for that. However, when communicating with cloud object storage, the application is required to provide a signature key.

    Refer to External File Storage for more information about configuring the system to connect to cloud object storage.

  • Customers may need the ability to authorize a customer service representative (CSR) to view the customer's account information in a customer facing portal. A signature key is required to support secure communication with the endpoint.

    Refer to User Redirection for more information about configuring the system to enable this type of redirection.

  • Signature keys are used for outbound messages when using the OAuth JWT assertion grant type. The key is used to sign the assertion.

The product provides an RSA Signature Key Pair business object that supports the following functions:

  • Generating a key pair, public and private. The private key is stored in an appropriate "secret store" and the public key is available to copy and share with a third party.

  • Viewing the public key, allowing a user to copy it to register it with cloud object storage.

  • Activating the new key pair (to be done after registering the new public key).

  • Inactivating an expired key.

  • Key rotation. For increased security, a new key pair should be generated periodically.

  • Deactivating all keys for the key ring.

  • Requesting a Certificate Signing Request

Parent topic: Understanding Key Rings

Certificate Signing Request

If a certificate signing request is required for any use case, the following steps should be followed.

  • Navigate to the signature key ring that requires a certificate.

  • In the Keys zone, identify the pending or active key that requires a certificate. Click Generate CSR.

  • You are prompted to provide appropriate distinguished name parameter values and set the duration.

    Note:

    The distinguished name parameters are defined in the F1-DistinguishedNameParameter extendable lookup. The visible parameters are those that marked as 'default in grid'. Additional parameter names are available, if needed.

  • Optionally check the Self Signed Certificate switch, for example in a development or test environment.

  • Click Save

If you didn't check the self signed switch, copy the returned Certificate Signing Request text to a .pem file and use a certificate authority to provide the certificate. Otherwise, use the returned Self Signed Certificate.

Once you have the certificate, provide it to the relevant external party, according to the use case.

Parent topic: RSA Signature Keys