SCS component
|
Due to the SCS architecture, changes not related to Net iD Client that can block this functionality can happen at any time. The SCS functionality in Net iD Client is provided "as is", and Pointsharp expressly disclaims any warranties, including as regards fitness for purpose, freedom from errors and bugs, or that defects in the functionality will be corrected. For more information regarding SCS, please refer to the DVV documentation Signature Creation Service specification (external link that opens in new tab) |
The SCS service is an implementation of the Finnish standard Signature Creation Service. It starts a local web server that is accessed from the web browser. See Service SCS and scs CLI command for more information on how to configure and use the SCS service.
This component normally requires system service for Windows since it needs administrative privileges to start a web server. For Citrix Server, it runs as a user service because virtual loopback is implemented as user-specific. It can be run as both system and user service for Linux and macOS.
Most web browsers do not allow using SSL/TLS-sessions with non-SSL/TLS-sessions. Thus, use SSL/TLS from now on. The current implementation supports TLS 1.2 with a limited range of supported algorithms. More algorithms can be added in the future.
The SCS runs as a web server and the web server certificate is generated locally and signed by a local CA.
CA certificates and web certificates
Certificates have no reference to CRL or OCSP. Certificates are generated from certificate templates.
CA certificates are valid for ten years, for example 2020-01-01 until 2029-12-31. CA keypair is deleted after ten certificates are signed.
Web server certificates are valid for one year, for example 2020-01-01 until 2020-12-31. Ten certificates are generated, one for each year. All web server certificates use the same keypair.
The CA certificate and current web server certificate can be downloaded by any browser:
-
http://localhost:53291/ca.crt
-
http://localhost:53291/web.crt
SCS certificates
View SCS certificate
To see the SCS certificates, use the Command utility.
-
Select option [6] Utility.
-
Select option [3]/[4] View SCS certificate.
Delete SCS certificate
To delete the SCS certificates/keypair, use the Command utility when running as SYSTEM. The SCS certificates/keypair is regenerated at SCS startup when missing.
To get the necessary options for virtual tokens, the command utility must be run as administrator.
-
Start the command utility.
$ netid.exe -command
-
Select option [4] Token.
-
Select option [0] Initialize.
-
Select the option indicating virtual token.
| The certificates are identical, so OS/browsers can be confused. Only keypair and subject-key-id/authority-key-id are different. |