Certificates in Identity Broker
This section outlines the process for attaining and managing certificates in order to use Signicat Identity Broker.
In order to set up your Broker environment, Signicat requires a subdomain reserved through DNS for the use of the Signicat Identity Broker. This will enable you to make use of the different identity providers.
To purchase a certificate, the first thing you will need is a Certificate Signing Request (CSR). This must be provided to you by Signicat.
In order for Signicat to generate a CSR for you, the following information is required:
- 1.The desired subdomain name you want to host the MySignicat environment (Signicat Identity Broker) on.
- 2.Company information (OIN or Chamber of Commerce number).
The Signicat Technical Support team will generate a CSR for you based on the information you have provided. Once you have received the CSR, you will now be able to purchase PKIoverheid certificates which are mandatory for DigiD and eHerkenning. The PKIo certificate type you require is "Private Services CA G1".
It is important to remember that self-signed certificates, Let's Encrypt certificates, and the likes, are not allowed. We require PKIo certificates and the level of assurance they provide. There are two certificate providers that sell PKIo certificates:
You will require a certificate for both the production and the pre-production environments. The number of certificates you must purchase in total, however, depends on the eID method being used. DigiD, which is more strict than most, requires certificates for:
- the (sub)domain that is used to host the application on your end, and,
- the subdomain that is used to host the Identity Broker on our end.
Once you have received the certificates from the certificate provider, send the public part of the certificates (which will have the .pem or .cer file extension) to Signicat Technical Support <[email protected]>.
Once your Signicat Identity Broker environment has been set up, you will receive a notification from our Technical Support team and an invitation to start configuring your MySignicat account.
You will now be able to start connecting to the Signicat Identity Broker!