RA renewal

Planning

Planning

Key custodian

Other

Coordinator

PKI

App

Ceremony

The physical meeting with all necessary participants.
This is when the new RA certificate is created in red zone.

Activation

When the new certificate is activated on BankID side.
This is usually done at another time than the ceremony.

1) Send order forms to BankID

The respective TSP or Bank have to fill out required order forms and send it to BankID signed before or during the RA ceremony.

A copy must be sent before the RA ceremony.

TSP or Bank

• TSP/Bank fills out the required order form (.

• Send a copy before the RA ceremony by creating a ticket here.

Planning

Order form templates can be found here: Misc forms for BankID Support

2) Make sure that the prerequisites are in order

Primary CAO token "Dongle" is normally stored in a safe at the respective TSP (CA responsible).

The respective Key Custodian for the TSP is responsible to carry and bring the RA XML request and the Primary CAO token "dongle" to the RA ceremony.

Key custodian for TSP

• Create an RA XML request on the TSP system, for example through HAT tool.

• Make sure that the USB stick is new and unused

• Make sure that the Key Custodian have approved identification such as a passport or driver license (if the Key Custodian is a non-Norwegian citizen, they must bring their passport)

Planning

3) RA ceremony coordination

BankID will coordinate the ceremony and activation with all stakeholders.

BankID

All stakeholders align and agree on date and time for the following:

Planning

4) Invitations

BankID will send out a meeting invite for the ceremony

BankID

Create and send out the invitation to all stakeholders.

The invitation should contain, but not limited to:

• Purpose and description

• Date

• Time

• Duration

• Address

• Attendees and contact points

• Information on what to bring

Planning

5) Pre RA ceremony check

BankID will greet the participants and check that all is OK for moving on with the ceremony.

BankID

• Participants need to sign in and out

• All necessary resources are in place

  • Key Custodian

  • PKI

• Key Custodian ID check is done by the SO

• USB virus scan is done manually before High secure room (USB stick that contains the RA XML Sign request)

• All required documentation is in place

  • Note that RA order forms are to be stored in the BankID High secure room. When the documentation is signed electronically, a copy of the document is to be stored

Planning

6) Perform RA ceremony

BankID is to perform the RA ceremony

BankID

BankID will guide the key custodian through issuing of the new RA XML/SSL certificate(s).

Key custodian will need to oversee that everything is according to the documentation.

Planning

7) Activation/ Revocation (optional)

BankID is to activate the new certificates.

BankID

Activate the new RA certificate(s) in BankID. Normally done within 24 hours after the ceremony.

Optional: Revoke the old certificate. Date aggreed upon in step 3.

Performed by AO with PKI involved.

BankID will inform the TSP/Bank when this has been done.

Planning

8) Certificate check

Check that the certificate is working

TSP and Bank

TSP/Bank needs to check that the new activated certificate is working towards ODS.

Optional: Check that the revoked certificate is no longer working towards ODS.

Planning