.. _buyEnterpriseCertificate:

Buy enterprise certificates
***************************

As a sending organization, you must authenticate with an enterprise certificate (virksomhetssertifikat) issued by either Buypass or Commfides. You will need a test certificate and a production certificate. These must be in the RSA format.

.. IMPORTANT::
    The same certificate is used for all aspects of the API integration, both for establishing the mTLS connection, *as well as* for creating appropriate signatures for documents contained in requests. Further details for respectively Buypass and Commfides are available below.



Test environment
###########################

A test certificate must be used against our test environment. The test certificate will be used in the testing phase, and as soon as you are ready to deploy your integration to production, you will have to replace it with a production certificate.

.. NOTE::
   It is not possible to use a test certificate in production or the other way around.

.. tabs::

   .. group-tab:: Buypass

    A test certificate can be bought from Buypass, on either their `Norwegian <https://www.buypass.no>`__ or `English <https://www.buypass.com>`__ site. Look for "Virksomhetssertifikat" (no) or "Enterprise certificate" (en), and there should be options for both ordering new ones, or renewing previously bought certificates. If given a choice, please select *Standard sertifikat/Standard Certificate*.

    When buying an enterprise certificate from Buypass, you will receive two emails. You should only use the certificate from the email that includes the *private key*. This is the email that contains two *.p12* files. The two files have different serial numbers, and these refer to certificates used for authentication and encryption (*autentisering og kryptering*) and signature (*signering*). Only the certificate marked for authentication and encryption is applicable to use for integrating with the Posten signering API.

   .. group-tab:: Commfides

    A test certificates can be bought from Commfides, on either their `Norwegian <https://www.commfides.com/en/commfides-virksomhetssertifikat/>`__ or `English <https://www.commfides.com/en/commfides-virksomhetssertifikat/>`__ site. Please see *Bestill Testsertifikat/Order Test Certificate*.

    When buying an enterprise certificate from Commfides, you will receive an email containing three *.p12* files: *auth*, *enc* and *sign*. Only the one named *auth*, having :code:`Key Usage = Digital Signature`, is applicable for integrating with the API.



Production environment
###########################

.. DANGER::
   Both the production enterprise certificate and the password must be stored securely. Do not under any circumstances send the file or the password to anyone.

.. tabs::

   .. group-tab:: Buypass

    A production certificate can be bought from Buypass, on either their `Norwegian <https://www.buypass.no>`__ or `English <https://www.buypass.com>`__ site. Look for "Virksomhetssertifikat" (no) or "Enterprise certificate" (en), and there should be options for both ordering new ones, or renewing previously bought certificates. If given a choice, please select *Standard sertifikat/Standard Certificate*.

    When buying an enterprise certificate from Buypass, you will receive two emails. You should only use the certificate from the email that includes the *private key*. This is the email that contains two *.p12* files. The two files have different serial numbers, and these refer to certificates used for authentication and encryption (*autentisering og kryptering*) and signature (*signering*). Only the certificate marked for authentication and encryption is applicable to use for integrating with the Posten signering API.

   .. group-tab:: Commfides

    A production certificate can be bought from Commfides, on either their `Norwegian <https://www.commfides.com/en/commfides-virksomhetssertifikat/>`__ or `English <https://www.commfides.com/en/commfides-virksomhetssertifikat/>`__ site. Please see *Bestill Virksomhetssertifikat/Order Enterprise Certificate* for use in a production environment.

    When buying an enterprise certificate from Commfides, you will receive an email containing three *.p12* files: *auth*, *enc* and *sign*. Only the one named *auth*, having :code:`Key Usage = Digital Signature`, is applicable for integrating with the API.