RA Ceremony

(Key Change Over)

RA Merger

RA Move

Ceremony

The physical meeting with all necessary participants.
This is when the new RA certificate is created in red zone.

Activation

When the new certificate is activated on BankID side.
This is usually done at another time than the ceremony.

Switchover

When the traffic is switched from the old CA to the new CA.
This is usually done within 24 hours from the activation, but can also be done separatelyOnly applicable when moving from one CA to another.

8) Pre RA ceremony check

BankID will greet the participants and check that all is OK for moving on with the ceremony.

• Participants need to sign in and out

• All necessary resources are in place

  • Key Custodian

  • PKI

  • App

• Key Custodian ID check is done by the SO

• USB virus scan is done manually before High secure room (USB stick that contains the RA XML Sign request)

• All required documentation is in place

  • Note that RA naming order forms are to be stored in the BankID High secure room. When the documentation is signed electronically, a copy of the document is to be stored

9) Perform RA ceremony

BankID is to perform the RA ceremony

BankID will guide the key custodian through issuing of the new RA XML/SSL certificate(s) on the new CA.

Key custodian will need to oversee that the changes made are according to the documentation.

10) Request activation

TSP/Bank need to send a request to BankID

TSP and Bank

• Write a request for activation of New RA XML Sign certificate(s) in BankID.

• The request needs to contain the following:

  • Time for the activation

  • Which originator(s) to activate

  • Which CA it concerns

• Create a ticket here

11) Activation and switchover coordination

BankID will coordinate the switchover with all stakeholders.

BankID will coordinate with the required resources.

If not already set, agree on the date and time for:

•  1. Activation of New RA XML Sign Certificate
•  2. Switchover 
•  3. Revoke RA XML (Optional)

Normally happens within the same 24h.

12) Activation

BankID is to activate the new certificates.

This is normally done during the same day as the Switchover.

Activate the new RA XML Sign certificate(s) in BankID. Normally done within 24 hours after the ceremony.

Performed by AO with PKI involved.

1311) Certificate check

Check that the certificate is working

TSP and Bank

TSP/Bank needs to check that the new activated certificate is working towards ODS. 

When moving from one CA to another:
Check that the new certificate have access to display the existing certificates on the old CA.

1412) Switchover and revoke

Plan and implement the switchover and revoke.

TSP, Bank and

TSP/Bank: Write a request for switchover issuing CA in BankID from old to New CA. Include the time wanted for this. Create a ticket here

1. BankID:

   1. Do the switchover

   2. Those who perform the switchover will inform the TSP/Bank by phone or email when it has been done

2. TSP/Bank: Run test case sets to verify

   1. TSP/Bank: If successful, move to the next step

   2. BankID: If unsuccessful, investigate and resolve then move to next step

   3. BankID: if unsuccessful, not possible to fix, do a rollback

      • Bank/TSP: When rollback is done, run test case sets to verify

3. (optional. If not done, the certificate will be active on the old CA until it expires) Bank/TSP: Send an order for revoke of old RA XML Sign certificate in BankID by creating a ticket here

(optional)

Order form templates can be found here: Misc forms for BankID Support

13) Revoke (optional)

Revoke the old certificate

BankID

BankID: Revoke the old certificate as decided in step 6.

Order form templates can be found here: Misc forms for BankID Support

1514) Renewals 

Renewals of end users, merchants etc.

As decided in step 1.

TSP and Bank

When moving from one CA to another:

1. Bank renew end user BankID certificates

2. Bank asks merchants to renew merchant BankID's using HAT

3. Possible change of OTP Service by adding a new and then removing the old

This is best done outside of peak hours to reduce the risk of latencies.