Obtaining an EasyLink X.509 Certificate

As an alternative to providing an ID and password in the request, Web Services Security (WS-Security 1.1) mechanisms can be used to digitally sign SOAP requests and provide the requesting user's X.509 certificate. A recognized certificate identifies the user, and a valid signature authorizes the request.

The WS-Security specification defines many methods for representing security information. The Cloud Fax and Notifications API will only accept certain specific usages of these methods:

• The X.509 certificate itself must be provided in the request, and must be referred to via a "direct reference"
• An XML digital signature must be present that can be verified with the provided certificate, and which includes at least the SOAP Body element of the request.

XML encryption is not supported.

In order to use this method, users must either obtain an X.509 certificate from EasyLink or register a certificate obtained from a Certificate Authority known to EasyLink. Then the private key (from the key pair used to generate the certificate request) must be used in their application to prepare the request before it is sent to EasyLink. Users considering this should take into account the need to manage the deployment of their private key as well as the additional processing requirements. The ability of the development tools and deployment environment to correctly prepare requests (which have the potential to be quite large) should be considered as well.

An X.509 certificate can be obtained from EasyLink using a web browser and visiting https://messaging.easylink.com/certgen. (Customers wishing to use the "test2" system can obtain a certificate associated with that system from https://test2messaging.easylink.com/certgen.) These links show examples of creating and exporting the certificate and private key

• using Microsoft Internet Explorer 8
• using Firefox 4
• using Firefox 5

An X.509 certificate obtained from another Certificate Authority can be registered with EasyLink at https://messaging.easylink.com/certreg. Registration associates the certificate with an EasyLink user account, so a certificate can only be used for one user. (Certficates can be registered for the "test2" system at https://test2messaging.easylink.com/certreg.)This link shows an example of registering a certificate

• using Microsoft Internet Explorer 8