The generateKeypair operation generates an asymmetric key-pair for one of three (3) use-cases:
- RSA 2048-bit KEK Transport Authentication key-pair to sign the encrypted KEK when transmitted to Apple TTPoP
- ECDSA 256-bit Payment Card Reader Token (PCR) Signing key-pair to sign JWTs for Apple TTPoP service
- TLS ClientAuthentication (ClientAuth) aka mutual TLS (mTLS) key-pair for PSP application(s) to connect to Apple TTPoP service.
This webservice in the TR31 module produces a hex-encoded Public Key, and a self-signed certificate (which includes the Public Key, as well as a certificate signing request (CSR) if an external certificate authority (CA) signed certificate is desired for any reason).
The privacy-enhanced mail (“PEM”) encoded public key should be copied and submitted to Apple in their Business Register. If Apple accepts the submission, it will assign a unique key identifier (“keyid”) to the signing keypair for the environment for which it was generated (non-production or production).
The generateKeypair web service requires eleven (11) parameters:
|
did |
The unique encryption domain identifier. |
|
svccred |
The username (service credential) within the encryption domain with the authorization to call this web service. The credential requires the ENC, KMO, and KMA privileges. |
|
password |
The password of the username to authenticate the credential of the requester. |
|
environment |
The environment in which this keypair will be used. Accepted values: |
|
keyType |
The keypair type to be generated by the module. Accepted values: |
|
keyUsage |
The usage of the new keypair. Accepted values: |
|
cn |
Common name (CN) component that will be used in the self-signed certificate’s distinguished name (DN). The string must be enclosed in double-quotes – do not use equal signs (=), commas (,) and other special characters within the values of DN components |
|
ou |
[Optional] Organization unit (OU) component of the DN. We recommend using this string to clearly identify the environment in which this keypair will be used; the PRODUCTION keypair can skip this if desired. |
|
o |
Organization (O) component of the DN to identify the company. You are welcome to change this as necessary, keeping the special character constraint in mind. |
| c | [Optional] Country (C) component of the DN. |
| notes | [Optional] notes that you can provide to store information about the keypair being generated |