/
How to use customer certificates

How to use customer certificates

There are 2 different certificates used by the device. One is for the HTTPs encryption and the other for the signature. By default the Pad comes with both certificates, but you can upload your own certificates. The HTTPs certificate should have as common name the hostname of the device, otherwise the browser will show you an error message. Also the certificate must be created for usage with a webserver.

The certificate for the digital signature needs to be created with Digital Signature option, as common name you can use what ever you like. Additional to the certificate it self you can also upload the certificate chain to the device. In that case we adding both as part of the signature to the PDF.

Format and Upload

Signature Certificate:

  • DER encoded certificate file

  • PEM encoded private key file

  • CA-Certificate chain as crt, or .p7b format

SSL Playground for creating ROOT and Pad Certificate

You can download a playground which creates a root and the pad certificate which can be uploaded for HTTPS and the digital signature.

Download:

The configuration for the Root and the Pad certificate is inside the config subfolder.

PadSSLCertificate_Playground\config\rootconfig.cnf

Inside the config for the root you need to change the root_ca_distinguished_name section with your own company settings.

rootconfig.png

PadSSLCertificate_Playground\config\padconfig.cnf

Inside the pad_distinguished_name section you can define the common name for the certificate. If you want to use it for HTTPs you need to use here the hostname of your device. With the alternate_names you can create a HTTPS certificate for multiple devices, so you don´t need to have for each Device a own HTTPS certificate.

padconfig.png

Generate new root and certificate

  • "...\PadSSLCertificate_Playground\1GenerateCA.bat"

  • "...\PadSSLCertificate_Playground\2TestGenerateCaSignedCert.bat"

If you want to clear the playground you need to use the "...\PadSSLCertificate_Playground\start _clear_playground.bat"

After generation of the certificate you have to use the following files

SSL

"...\PadSSLCertificate_Playground\pad\certificate.pem"

"...\PadSSLCertificate_Playground\pad\private.pem"

Digitale-Signatur

"...\PadSSLCertificate_Playground\pad\public.der"

"...\PadSSLCertificate_Playground\pad\private.pem"

"...\PadSSLCertificate_Playground\root-ca\public.pem"  (in our case the chain contains only the root, therefor we can use the public.pem directly. If you have also intermediate certificate check out the next captital. Right now the chain can only be uploaded with the RESTAPI Endpoint directly)

Upload

The Upload can be done with the webinterface → section certificate.

image-20260422-092132.png

Or you can upload the certificates with the POST REST-API endpoints /keys/ssl/customer and /keys/pad/customer

image-20260422-092410.png

 

Creating the Chain file

we can represent the ca-chain in two different ways:

1: ca-chain.txt: as concatenated text-file of all the necessary certificates (root-ca, intermediate-ca-1 , intermediate-ca-2, ….)

command to Creating Certificate Chain:
cat intermediateCA.crt rootCA.crt > ca-chain.crt

 

  1. ca-chain.p7b: as a pkcs7 container holding the chain (root-ca, intermediate-ca-1 , intermediate-ca-2, ….) in an envelope

command to Creating Certificate Chain:
openssl crl2pkcs7 -certfile intermediateCA.crt -certfile rootCA.crt -out ca_chain.p7b -nocrl

To verify the contents of the PKCS#7 file, you can use the following command:
openssl pkcs7 -in ca_chain.p7b -print_certs -noout