Cloud certificate services - PKI Express
PKI Express supports signatures with cloud digital certificates, provided by cloud service providers that follow the specifications of ITI (Instituto Nacional de Tecnologia da Informação, the ICP-Brasil authority).
Preconfigured services
The following services are preconfigured by default:
- BirdID (SOLUTI)
- NeoID (SERPRO)
- RemoteID (CERTISIGN)
- SafeID (SAFEWEB)
- VIDaaS (VALID)
To use one of these preconfigured services, you only need to set its clientId and clientSecret:
pkie config --set trustServices:<service>:clientId=<value>
pkie config --set trustServices:<service>:clientSecret=<value>
For instance:
pkie config --set trustServices:BirdID:clientId="00000000000000"
pkie config --set trustServices:BirdID:clientSecret="xxx00xxXXXXxx0x"
Other services
To use a service that is not preconfigured, you must also set the service endpoint:
pkie config --set trustServices:<service>:endpoint=<value>
pkie config --set trustServices:<service>:clientId=<value>
pkie config --set trustServices:<service>:clientSecret=<value>
For instance:
pkie config --set trustServices:birdIdHml:endpoint="https://apihom.birdid.com.br/"
pkie config --set trustServices:birdIdHml:clientId="00000000000000"
pkie config --set trustServices:birdIdHml:clientSecret="xxx00xxXXXXxx0x"
Services that are not preconfigured also accept the following optional settings:
-
The service provider:
pkie config --set trustServices:<service>:provider=<value> -
The URL of the service logo:
pkie config --set trustServices:<service>:badgeUrl=<URL> -
The error handling strategy, taken from one of the preconfigured services:
pkie config --set trustServices:<service>:protocolVariant=<service>
Timeout
To set the timeout for discovering certificates on the providers, use the command below:
pkie config --set trustServicesDiscoveryTimeout=<value>