Certificate Change Denmark

This article describes the steps to be taken when an OCES3 certificate, which is used for document signing in Denmark, expires and needs to be replaced.

The procedure differs for systems that were initialized with a client version prior to 1.11.23 and for those that have already used version 1.11.23 or higher as part of the initialization process.

Certificate change for systems < 1.11.23

Initial situation:

• fiscal client has been initialized using a version < 1.11.23
• OCES3 certificate needs to be updated (because validity is about to expire)

Prerequisits:

• new OCES3 certificate
• local installation of the Fiscalisation Service

Process to change the certificate:

1. the new OCES3 certificate must be uploaded to the RetailForce Cloud Portal (see Upload fiscalization certificates)
   1. for the new certificate the name 'DKSignCertificate' must be entered in field 'Certificate Name'.
   2. The old 'Default' certificate should be left as it is (do not delete it), you should not be able to delete it, as it was set to read-only.
   3. In case no new certificate is available yet but version 1.11.23 or higher was already installed, upload the old (expiring) certificate a second time with the name 'DKSignCertificate'. How to exchange certificates in versions 1.11.23 or higher is described below.
2. Update the Fiscalisation Service to a newer version (1.11.23 or higher) on the cash register
3. As soon as the respective client establishes a connection to the RetailForce Cloud (POST /api/v1/management/cloud/connect), the client's IoT-Service automatically downloads the new certificate.
   1. both, the old 'Default' as well as the new 'DKSignCertificate' should now be present in the client directory (e.g. Windows: C:\ProgramData\RetailForce\Fiscal Webservice\{ClientId}\certificates).
   2. If the certificate was not downloaded automatically, please check firewall settings – the Port 8883 for the services' IoT-Service must be open. For further information refer to Necesary ports and addresses
4. After the certificate has been successfully downloaded by the client, normal cash register operation can continue.

Certificate change for systems 1.11.23 or higher

Initial situation:

• fiscal client has been initialized using a version 1.11.23 or higher OR
• fiscal client was originally initialized using a version < 1.11.23 but already updated to 1.11.23 (>) and is still using an old certificate (however, certificate name is already set to 'DKSignCertificate')
• OCES3 certificate needs to be updated (because validity is about to expire)

Prerequisits:

• new OCES3 certificate
• local installation of the Fiscalisation Service

Process to change the certificate:

1. Delete the OLD (expiring) certificate with the certificate name 'DKSignCertificate' in the cloud portal,
2. upload the new certificate and also set the name to 'DKSignCertificate',
3. establish connection between client and RetailForce Cloud (POST /api/v1/management/cloud/connect),
4. certificate should automatically be updated in the local client.

Using Cloud fiscalisation service

Manually updating the certificate

In case that the automatic change of the certificate was not successful, you can also trigger an update of the certificate from the local client.

For this purpose the endpoint PUT /api/v1/management/clients/{clientId}/certificate can be used.

Please note that the parameter 'certificateName' of the endpoint must match the 'Certificate Name' entered in the RetailForce Cloud Portal ('DKSignCertificate').