Versions Compared

Version Old Version 3 New Version 4
Changes made by

David Plews

David Plews

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Cert Name

Description

Issuer

Private Key held by

CSR generated by

Certificate Generated by

Actions required by LFI

C1

Identifies the TPP to OFPAPI Hub

OFTF

TPP

TPP

TPP

None

S2

Identifies non mtls OFP API Hub endpoints to TPP

Lets Encrypt

OzoneAPI Hub

NA
(uses ACME protocol)

OzoneAPI Hub

None

S1

Identifies mtls OFP API Hub endpoints to TPP

OFTF Ozone

API Hub

OzoneAPI Hub

LFI

Yes

Ozone API Hub will provide a CSR and the LFI should use the OFTF to produce the certificate

C4

Identifies OFP API Hub to LFI’s Ozone API Hub Connect endpoint

OFTFOzone

API Hub

OzoneAPI HubOzone

API Hub

None

S3

Identifies cm and hh endpoints to LFI

OFTFOzone

API Hub

OzoneAPI Hub

LFI

Yes

Ozone API Hub will provide a CSR and the LFI should use the OFTF to produce the certificate

S4

Identifies LFI’s Ozone API Hub Connect endpoint to OzoneAPI Hub

OFTF

LFI

LFI

LFI

Yes

Scripts are available in the OFTF to assist with CSR generation if requested

The subject of the C3 certificate should be provided to OzoneAPI Hub.

Ozone API Hub will limit access to certificates issued by OFTF AND having that specific subject

C3

Identifies LFI to the cm and hh endpoints

OFTF

LFI

LFI

LFI

Yes

Drawio
mVer2
zoom1
simple0
inComment0
custContentId146309209
pageId134938814
lbox1
diagramDisplayNameUntitled Diagram-1720473409295.drawio
contentVer1
revision2
baseUrlhttps://openfinanceuae.atlassian.net/wiki
diagramNameUntitled Diagram-1720473409295.drawio
pCenter0
width941
links
tbstyle
height579.5

Item

Description

Issuer

Private Key Held By

CSR Generated by

Certificate Generated by

Action required by LFI

JWKS

Sig1

Used by the TPP to sign requests sent to the OFPAPI Hub

(e.g. for signing the private-key-jwt, par request object etc)

OFP API Hub will use the public key in the OFTF JWKS to verify the signature

OFTF

TPP

TPP

TPP

None

TPP’s JWKS identified by the jwks_url for the client.

Hosted in OFTF

Sig2

Used by the OFP API Hub to sign responses sent to the TPP

This includes signed messages from the resource server and the signature on the id_token.

The TPP will use the public key in the JWKS to verify the signature

OFTFOzone

API Hub

OzoneAPI Hub

LFI

Yes

LFI’s JWKS identified by the jwks_url in the OFP’s API Hub’s well-known endpoint.

Hosted in OFTF

Sig3

Used by the OFP API Hub to sign requests sent to the the LFI

OFP API Hub will use the public key in the JWKS to verify the signature

OFTFOzone

API Hub

OzoneAPI HubOzone

API Hub

None

API Hub’s JWKS hosted in OFTF

Only required if one of these conditions is true:

  • The LFI requires JWT Auth for Application Layer Authentication to Ozone API Hub Connect

  • The LFI uses Client Credentials Grant for Application Layer Authentication to Ozone API Hub Connect and client authentication is set to private_key_jwt

Sig4

Used by the LFI to sign requests sent to OFPAPI Hub

LFI will use the public key in the JWKS to verify the signature

OFTF

LFI

Ozone API Hub (to assist LFI)

LFI

Yes

LFI’s JWKS hosted in OFTF

Only required if the LFI requires JWT Auth for Application Layer Authentication to CM and HH

...

Item

Description

Issuer

Private Key Held By

CSR Generated by

Certificate Generated by

Action required by LFI

JWKS

Enc1

Used by the TPP to encrypt PII sent to the OFP API Hub that can only be read by the LFI

The PII payloads are encrypted using the LFI’s public key in the JWKS

The LFI decrypts them using their private key

OFTF

LFI

LFI

LFI

Yes

LFI’s JWKS identified by the jwks_url in the OFP’s API Hub’s well-known endpoint

Hosted in LFI’s JWKS on OFTF

Ozone API Hub can provide scripts to generate the CSR if requested by the LFI

...

These steps are repeated for S1 S3 Sig2 - where the private keys is held by the API Hub

  1. Ozone API Hub to generate private keys for the certificates

  2. Ozone API Hub to generate CSRs and hand over to LFI

  3. LFI to generate certificates on the OFTF directory*

  4. LFI to provide JWKS URL and KID

...

These steps are repeated for Sig3 and C4-where the private keys is held by the API Hub

  1. Ozone API Hub to generate private keys for the certificates

  2. Ozone API Hub to generate CSRs

  3. Ozone API Hub to generate certificates on OFTF directory*

  4. Ozoneto provide JWKS URL and KID to the LFIAPI Hubto provide JWKS URL and KID to the LFI

Environment Considerations

  • OFTF Sandbox is used to issue certificates in the pre-production environment.

  • OFTF Production is used to issue certificates in the production environment.

Certificate Generation for S1 & Sig2 (Private Key Held by API Hub)

These certificates are used for communications between TPPs and the API Hub and should be created at the Organisation level.

  1. API Hub generates private keys for the certificates.

  2. API Hub generates Certificate Signing Requests (CSRs) and provides them to the LFI.

    1. S1 will contain the appropriate Subject Alternative Names (SANs) used for domain validation.

  3. LFI uses the appropriate OFTF directory (Sandbox or Prod) to generate the certificates under the Organisation Certificates section.

  4. LFI provides the JWKS URL and KID. The JWKS and KID is managed by the OFTF and will be automatically created when the certificates are signed.

Certificate Generation for C3, S4 & Sig4 (Private Key Held by LFI)

These certificates are used by the LFI for communication to the API Hub

  1. LFI generates the private key for the certificate.

  2. LFI generates the CSR.

  3. LFI generates the certificate using the OFTF directory.

  4. LFI provides the JWKS URL and KID.

*The OFTF Sandbox is used for signing certificates for the pre-production environment and the OFTF Production is used for signing certificates for the Production environment.