We are planning to test our Authentication SBI against the MOSIP CTK hosted in the synergy environment.
For this we need to register and upload certificates for device provider and ftm provider to MOSIP. We tried this using the PMS portal of synergy environment, but not able to upload the CA/SUBCA certificates due to admin restriction.
Could you please guide us on how to proceed.
Also, For test certificates creation we are using the certificate scripts, but that is mainly for device partner certificates. How can we create the certificates similarly for FTM testing.
Hi @manish_choudhary To test your Authentication SBI against the MOSIP CTK in the Synergy environment, you need to establish the complete certificate trust chain. Here is a breakdown of why you are running into administrative restrictions and how to proceed, along with how to generate the certificates for FTM testing.
Part 1: Resolving the CA/SubCA “Admin Restriction” on PMS
In the MOSIP ecosystem, the Partner Management System (PMS) portal separates duties based on your role.
The Cause: Uploading Root CA and Sub-CA certificates into the global Certificate Trust Store is strictly a Partner Admin capability. As a self-registered partner (Device Provider or FTM Provider), your permissions are limited to uploading your specific partner certificate that has already been signed by a trusted CA.
The Resolution: 1. You cannot upload Root/Sub-CA certificates using your regular partner account.
2. Provide them with your generated Root CA and Sub-CA certificates.
3. The Synergy admin will log in with the PARTNER_ADMIN role, navigate to the Certificate Trust Store, and map your Root/Sub-CA to the appropriate domain:
FTM domain for your FTM Provider chain.
Once the admin completes this step, you will immediately be able to log into your partner dashboard and successfully upload your individual CA-signed Partner Certificates.
Part 2: Creating Test Certificates for FTM Testing
The default MOSIP compliance/partner test script repository is often fine-tuned for Device Providers (AUTH domain). However, FTM testing requires a similar but separate certificate structure mapped to the FTM domain.
Step-by-Step FTM Certificate Generation
If you are modifying standard openssl scripts or using MOSIP onboarding tools, ensure your certificate profiles match these configurations:
1. Generate the FTM Root & Sub-CA
If the admin allows you to use a custom sandbox CA, generate your Root and Sub-CA just as you did for the device partner. No unique extensions are strictly required at the root level, but they must be explicitly provided to the Synergy Admin to be uploaded under the FTM Domain.
2. Generate the FTM Partner Certificate
When creating the FTM Partner certificate signed by your Sub-CA, modify your OpenSSL configuration file (ftm.cnf) to include specific MOSIP object identifiers (OIDs) if enforced by the version, or at least structure the Distinguished Name (DN) appropriately.
Root CA and Sub-CA for both domains(DEVICE and FTM) we need to share. To whom we need to share these to upload, can you tell the email id we can share these?
For the FTM provider certificate you said we need to modify the configuration, what specific changes we need to do as compared to the device provider certificate?
Also, this FTM provider certificate will be used to sign the individual FTM chip certificates right? For that to happen either the FTM provider certificate needs to be a CA to sign, or mosip returns mosip signed certificate(which is a CA) when we upload the FTM provider certificate to MOSIP. Please clarify this.
Root CA and Sub-CA for both domains(DEVICE and FTM) we need to share. To whom we need to share these to upload, can you tell the email id we can share these?
For the FTM provider certificate you said we need to modify the configuration, what specific changes we need to do as compared to the device provider certificate?
Also, this FTM provider certificate will be used to sign the individual FTM chip certificates right? For that to happen either the FTM provider certificate needs to be a CA to sign, or mosip returns mosip signed certificate(which is a CA) when we upload the FTM provider certificate to MOSIP.
Hi @manish_choudhary for this query - First Device/FTM user has to create a CA/Sub CA certificates and partner certificate Next the same CA/SubCA certificate has to be uploaded by partner admin and then partner can login to the portal and upload the partner certificate to procoeed.
The certificate chain is like below
CA → SUBCA → FTM-Provider → FTM-Chip
We register and upload FTM-Provider certificate to MOSIP. After that all the individual devices FTM-Chip will be signed by the FTM-Provider.
This is my understanding. what do you mean exactly when you say user has to upload ftm chip certificate. Do we need to upload all the individual devices chip certificates to MOSIP?
For every partner , there should be an partner admin to approve/reject . Partner admin is similar to partner creation but a partner admin role and policy admin role and policymanager role is required .[ roles can be added from keycloak]. NOTE: Partner admin can be created from keyclaok or create any partner from the PMP and can add roles
We want to upload certificates to synergy environment, we can’t create a partner with admin role in this environment. So we need to contact someone who is admin in the synergy environment.