Hi MOSIP team — I’ve onboarded as a Device Provider partner (organization: HYF) on the Collab environment (pmp.collab.mosip.net). To upload my CA-signed partner certificate, my Root CA and Intermediate (Sub) CA first need to be in the PMS Certificate Trust Store, but the Device Provider portal has no CA-upload option and I don’t have Partner Admin / Keycloak access.
Could you please grant my account the Partner Admin role on Collab so I can upload my Root + Sub CA to the trust store myself? (Same blocker as thread /t/partner-device-certificate-signing-for-sbi-compliance-testing-synergy-environment/2825.) If self-upload isn’t possible, I’m happy to instead attach my Root + Sub CA certs for your team to load. Chain: HYF Root CA → HYF Sub CA → HYF partner cert (X.509 v3, org=HYF).
The forum only allows image uploads, so I’m pasting the certificates inline instead — this is actually easier to action, since your admin can copy them straight into the trust store. Both are public certificates (no private keys).
Request: please load these into the PMS Certificate Trust Store on Collab (pmp.collab.mosip.net) and map them under the DEVICE domain for Device Provider partner HYF. Once they’re in the trust store, I’ll be able to upload my CA-signed partner certificate from my own dashboard.
Chain: HYF Root CA → HYF Sub CA → HYF partner cert (X.509 v3, O=HYF).
This is the same blocker reported in the two Synergy threads (2820 and 2825), both of which auto-closed unresolved — so a confirmation here would help other device providers too.
Thanks!
Thank you — the Root CA and Sub CA are loaded, and my partner certificate uploaded successfully (Device Provider, DEVICE domain). Onboarding is moving well.
Next blocker: I’ve added my SBI (version 1.0.0) under Device Provider Services, and it’s now “Pending For Approval.” The portal won’t let me add devices until a Partner Admin approves the SBI.
Could you please approve the pending SBI for Device Provider HYF (partner ID shahid) so I can proceed to add and register my devices? Happy to share any details you need.
SBI version 1.0.0 under Device Provider Services: Pending For Approval
Partner ID: shahid — Device Provider HYF
Two questions:
Who can approve the pending SBI, or is there something still required from my side? If approval sits with a different team, I’m happy to be pointed to the right place.
Separately — for verifying the JWS signatures on MOSIP’s responses (encryption certificate and device registration), could you share the response-signing certificate for the Collab environment? Our management server verifies every signed response against a configured trust anchor before using it, so we need that certificate before the first live call.
Once the SBI is approved, I can register devices and complete the integration test.
Following up again — thank you for loading our Root and Sub CA and confirming the partner certificate earlier. Onboarding is complete except for one step that needs a Partner Admin.
Our SBI (version 1.0.0) for Device Provider HYF (partner ID shahid) has been “Pending For Approval” since 16 July. The portal won’t let us add devices until it’s approved, so we’re fully blocked on this single action.
Could you approve it, or point me to the right Partner Admin? Happy to provide any details.
Separately, so I only ask once: to make MOSIP API calls (device registration, encryption certificate), we’ll need partner API credentials (clientId / secretKey / appId) for the Collab environment — could you advise how to obtain those?
@Varaniya1@mrudula@swethan1718,
Following up again. Your last response here was 15 days ago; we replied the next day and followed up again and again, without a response — and this thread is now set to auto‑close tomorrow, so I’m posting to keep it open. We remain fully blocked on a single action.
Thank you @Varaniya1 — really appreciate you picking this up. Please let me know if you need anything from my side to complete the approval, and I’ll send it right over. A rough ETA would help me line up the next steps. Standing by.
Hi @shahid ,
Can you please provide some more info on the points below?
Response-signing certificate - You can download the MOSIP signed certificate from the PMS portal directly. Is there anything else you are looking for?
Partner API credentials - Can you please elaborate on this point? Why is this required? Once the certificates are uploaded you should be able to authenticate using the partner credentials.
Thanks — that helps, and I think we’re aligned. To be specific:
2. Partner API credentials. I believe by “partner credentials” you mean the clientId / secretKey our partner account authenticates with — and that’s exactly what our management server uses: it calls POST /v1/authmanager/authenticate/clientidsecretkey to get a token before calling /v1/masterdata/registereddevices. So to confirm, for our partner shahid in Collab: what secretKey and appId should we use (with clientId = our partner ID)? Is the secretKey available in the PMS/Keycloak, or can you share it?
1. Response-signing certificate. To clarify — not our own partner certificate. Our server verifies the JWS signature on MOSIP’s responses (the registered-devices and encryption-certificate responses) against a trusted anchor before using them. For that we need MOSIP’s response-signing certificate for Collab — the public cert MOSIP signs its responses with. Is that published, or available from a keymanager endpoint?
Thanks for the detailed context, happy to clarify both points.
1. Response-signing certificate
This is what’s referred to as the MOSIP Signed Certificate. It becomes available once your partner certificate has been uploaded and signed by MOSIP. You can find it in the PMS UI portal, under the “Upload Certificate” section — the MOSIP Signed Certificate (MOSIP’s public cert used to sign responses) can be downloaded directly from there.
2. Partner API credentials
If the goal is to fetch the list of registered devices for your partner, you don’t need the clientId/secretKey flow via /v1/authmanager/authenticate/clientidsecretkey at all — that endpoint is intended for internal use.
Instead, the correct endpoint for partners is:
GET /securebiometricinterface/{sbiId}/devices
Once you’re logged into the PMS portal with your partner credentials, you can call this endpoint directly to retrieve the device list for your SBI. The above endpoint only required a SBI ID.
Thank you for responding. After going through the 1.2.0 docs, two clarifications:
1. Certificate — I think we’re referring to different certs. The “MOSIP Signed Certificate” in the PMS Upload Certificate section has subject = our partner (HYF Device Provider), issuer = MOSIP — i.e. it’s our identity cert for signing our requests. What we need is MOSIP’s own response-signing certificate (MOSIP’s public cert) to verify the JWS on MOSIP’s responses. Is that available from the keymanager getCertificate endpoint on Collab, or published somewhere?
2. Scope correction on our side — the 1.2.0 MDS spec removed the masterdata/registereddevices register/de-register flow (device validation is now cryptographic), so we’re dropping that path. Our only remaining MOSIP-facing call is the encryption certificate: POST /v1/masterdata/device/encryptioncertficates. For that on Collab, could you share the base URL and a clientId/secretKey (with the role that endpoint needs) for our management server — or confirm the auth it expects?
Closing the loop on this, in case it helps other device providers.
Root cause of our confusion: we had implemented device registration against the 1.1.5POST /v1/masterdata/registereddevices flow. That flow was removed in 1.2.x — per the 1.2.0 MDS spec changelog (04-Apr-2022): “Register and De-register of devices have been removed from MOSIP. Device validation in MOSIP will be done via cryptography. Here onwards, registering a device will mean a device obtaining a certificate from the management server.” So our management server never needed to call MOSIP to register devices, which made most of our original question moot. We’ve realigned our implementation accordingly.
On the certificates — a distinction that tripped us up, noting it for others:
The MOSIP Signed Certificate in the PMS Upload Certificate section has subject = our partner, issuer = MOSIP. It’s our identity certificate, and (per the MDS Keys section) the issuing anchor for our device certificates.
The encryption certificate (what devices wrap bioValue to) is a different one, downloaded from the CTK project page (“Encryption Key”) for an Auth-purpose SBI project.
One thing worth flagging in the docs: the 1.2.0 MDS spec’s Management Server section still lists “Register the genuine device with the MOSIP device server” as an objective, which contradicts the changelog and glossary. That line is what kept us on the wrong path for a while.
We’re proceeding to CTK certification. Thanks for the pointers.
