Renewal of client certificate using soap web service of certificate service

This guide describes one example way to renew SSL client certificate that has been granted by

Finnish Tax Administration. Renewal process can be implemented to the client application based

on this guide.

Renewal process of test certificates in this guide can be also applied to renewal process of

production certificates. Real organizational information and production web service endpoints are

https://vero.fi/globalassets/tulorekisteri/kuvat/varmennepalvelu-rajapinta_v1.01.zip

◼ New key pair for certificate signing request (CSR)

◼ Current client certificate and related private key for signing the renewal xml message as pfx

file and password for the pfx file if pfx is protected

◼ Business id and name of the test company related to the current client certificate

Required tools

◼ OpenSSL: https://wiki.openssl.org/index.php/Binaries

◼ .NET Core 3.1 or later: https://dotnet.microsoft.com/download/dotnet/3.1

◼ Visual Studio Code: https://code.visualstudio.com/

More information:

• Instructions by Incomes register on renewing client certificates:

https://www.vero.fi/tulorekisteri/yritykset-ja-organisaatiot/suorituksen-

maksajat/varmenne/varmenteen-uusiminen/

• Documentation about certificate service by Incomes register:

https://vero.fi/tulorekisteri/ohjelmistokehitt%C3%A4j%C3%A4t/varmennepalvelu/dokumenta

atio/

• Documentation about certificate service test bench by Incomes register:

https://vero.fi/globalassets/tulorekisteri/dokumentaatio-2021/varmennepalvelu---

1. Create new private key for new certificate

Create new private key with OpenSSL using command line:

openssl genrsa -out newprivate.key 2048

New private key is created to a file called newprivate.key

2. Create new certificate signing request for renewal

Create new certificate signing request file (CSR) using the new private key created in step 1 with

OpenSSL:

openssl req -new -key newprivate.key -out certificaterequest.csr

Enter following information for OpenSSL from current client certificate that is being renewed:

Country Name = FI

Organization Name = Name of your test company name

Common Name = Business id of your test company

Use following template and fill needed information. Note! Remove all line breaks before signing the

message:

<cer:RenewCertificateRequest xmlns:cer="http://certificates.vero.fi/2017/10/certificateservices"

xmlns:xd="http://www.w3.org/2000/09/xmldsig#">

<Environment>TEST</Environment>

<CustomerId>Business id of your test company</CustomerId>

<CustomerName>Name of your test company</CustomerName>

<CertificateRequest>Certificate signing request content that was created at step 2 as

base64 string without --- begin certificate request -- and --- end certificate request ---

line breaks for signing.

requires the current client certificate and related private key as pfx file.

Example signing application is available here: https://www.vero.fi/globalassets/tietoa-

verohallinnosta/ohjelmistokehittajille/swaggerui/verohallinto_program.zip

.NET core 3.1 or later and Visual Studio Code are required to run the example. Visual Studio Code

is available here: https://code.visualstudio.com/

4.1 Create pfx file for the signing application using Open SSL

with which it was generated are exported to the file.

If the pfx file does not already exist, use the following command to build the pfx file and export the

private key and the current certificate (stored in the cert.cer file in base64 format):

openssl.exe pkcs12 -export -out test.pfx -inkey private.key -in cert.cer

The private key of the certificate currently in use is in the command input in the private.key file in

base64 format, unprotected, and the public part of the certificate (= signed public key) is in the

cert.cer file in base64 format.

SignNewCertificate_Private.key file, as well as the current certificate retrieved from the test bench,

which is stored in the cert.cer file in base64 format.

4.2 Run the signing program

Compile and run the signing program (SignXmlNew.exe), and as a command line parameter, enter

the xml message you created in step 3, the pfx file, and the password you created for it:

SignXmlNew.exe renew.xml test.pfx password

<cer:RenewCertificateRequest xmlns:cer="http://certificates.vero.fi/2017/10/certificateservices"

xmlns:xd="http://www.w3.org/2000/09/xmldsig#">

<Environment>TEST</Environment>

<CustomerId>0123456-7</CustomerId>

<CustomerName>Ab PKI Developer Company Oy</CustomerName>

<CertificateRequest>MIICjTCCAXUCAQAwSDELMAkGA1UEBhMCRkkxEzARBgNVBAgMClNvbWUtU3RhdGUx

JDAiBgNVBAoMG0FiIFBLSSBEZXZlbG9wZXIgQ29tcGFueSBPeTCCASIwDQYJKoZI

hvcNAQEBBQADggEPADCCAQoCggEBAJkBP88eLdbxbJfPluDI/rNP0EUpluRohxgx

c+NSnevgakWZXXMWKOJStsDHsOPnwfaIvlmFLWRkAsqxt2dIGgWMzFh9NaX0Anwm

CbiUruot9C8zguP7Y/67AFSeageNYrHmgIBHoZyNIe+tPR4Y5DxcQBl/6HtyzJ/q

Nej5mp2zSlW5P1QoEkS3MU8Gm0mpCBylyAvCzeYHOop6caZMQctVCmPto+0PYx0T

qEmO15vGj/rIN4btjEKSYfjNj56MMN8lsIc/6vqdikKKmMwTLRXjq73liOYyJ11s

9433VK1J/UMvay3y2jYKVDUUw567HD8C3lsT+A+ifkCo</CertificateRequest>

<Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod

Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-

sha256" /><Reference URI=""><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"

/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"

/><DigestValue>i13a6CV9yr+uqy/qx4yhvyysDvcKnoiNIjUdj7Arr1A=</DigestValue></Reference></SignedInfo><SignatureValue>VEja4

dmVsb3BlciBDb21wYW55IE95MQswCQYDVQQGEwJGSTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMrf+WUx2nu

YBOeG3PxqzIeMmMVRwlqmBTH/jdW0AmRZ34cuh+Do/T6U0mqg9G4lVsj8WaM8fmh7tdCQ3xcCPnqpQrkeGuWQV4nIhok74kDnQb1

2FrOKCsLIOMONHS2+9E8HKwS8giFXzKP8UUnJK8PmptJQo+E6jlEy+vzSsHouf0UMCgp9MutN9RlAtjqS6lyHtqp8BLn2hdEM1srIqCX

BRigkAH5w1mqbBSiVkgsCaYJ+I5AY201ZTUlb138SY/bYk9gfLS1aY1gEF+667Bmys0aJk4JRLHujMqfkEuHrfRWo1ps739H+8UPqkRm

JfNybGFUPoJEwcfGIkXdYGPUCAwEAAaOCAWswggFnMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUT1PJe8BCr9h+uQE8W6

CNC7/QfeYwUwYIKwYBBQUHAQEERzBFMEMGCCsGAQUFBzAChjdodHRwOi8vY3JsLXRlc3RpLnZlcm8uZmkvY2EvUEtJU2VydmljZ

URldmVsb3BlckNBdjEuY3J0MBMGA1UdJQQMMAoGCCsGAQUFBwMCMIGcBgNVHR8EgZQwgZEwgY6gPKA6hjhodHRwOi8vY3JsL

XRlc3RpLnZlcm8uZmkvY3JsL1BLSVNlcnZpY2VEZXZlbG9wZXJDQXYxLmNybKJOpEwwSjEkMCIGA1UEAwwbUEtJIFNlcnZpY2UgRG

V2ZWxvcGVyIENBIHYxMRUwEwYDVQQKDAxWZXJvaGFsbGludG8xCzAJBgNVBAYTAkZJMB0GA1UdDgQWBBQwtQwXI5AZJVyZf4

DEemCYLnw+mzAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQELBQADggIBADZkkj4T+rVlAe9a53/9zrWLuJqe+WePxIoEk5ozX

mzqSrSBoBKX5Sn9+jOF39fxE6LNCmJBiZz49WhSOTSLjX/kL8B0T4NBCtz6EdhQk0lz1JC5GvNuVVnmKeZYElt3qLvx4ktc6QxlH2zZ48

BR+m/cXycvyLzy2fgyAlW</X509Certificate></X509Data></KeyInfo></Signature></cer:RenewCertificateRequest>

You will notice that the signing program has added a Signature block to the end of the

RenewCertificateRequest block.

Importantly, the contents of the file must not be altered in any way before it is sent to the certificate

service interface, so as not to change the signed content. The change is also caused by line

breaks or other formatting, in which case the signature is no longer valid and the certificate service

https://pkiws-testi.vero.fi/2017/10/CertificateServices

In SoapUI, you can use the templates of the message structures based on the WSDL description.

Download the certificate service interface package

(https://vero.fi/globalassets/tulorekisteri/kuvat/varmennepalvelu-rajapinta_v1.01.zip) and open the

WSDL file with SoapUI.

Generate the outgoing message so that the signed content is unchanged inside the body element

of the soap envelope. Do not format the signed content in any way.