2.3.4. Managing “Local Machine Certificate Store”
Syscob applications employ the “Local Machine Certificate Store” to access the four [4] Digital Certificates used by the SEDI protocol (see the Digital Certificates topic for the three [3] Customs “public” plus the one [1] “site certificate” [normally a Type 3] needed). That store is required because the Customs Gatekeeper TYPE 3 CA certificate must be accessible at the “local machine” [device] level and, for almost all exporters, the “site certificate” is a Gatekeeper TYPE 3 CA that has this same constraint.
Be aware that “public” certificates are located in the store by their type and organization name (e.g. the Type 3 for Customs), but the “site certificate” (which contains a “private key”) is identified by its embedded email address! This means that there must never be more than one DC in the store with the dedicated EDI email address (i.e. the “old” certificate must be removed when it expires to prevent its use; even with the “new” certificate inserted into the store the “old” one would be found first and used).
Although there are a number of tools, depending on the Windows® version in use, which could import the certificates into this store Syscob supplies a simple utility to manage this store for SEDI communications.
ExpCertM is the
This utility can be found in the “” subfolder of the Syscob application “local” or “server” folder for the computer on which a user logon, the “SEDI user”, will run SEDI. It is named “” and can be started via the “” button of the “Digital Certificates” tab of the SEDI_exp configuration settings window, via a shortcut in the “” subfolder of the “” folder on the user Desktop or the Start button programs menu or by just running the “” executable.
The main window of the utility (reduced image at right) has an upper pane that shows the contents of the “Local Machine Certificate Store”, a central button bar and a lower pane where the session log can be seen. When all imports and removals are completed the upper pane should contain the four [4] Digital Certificates described in the Digital Certificates topic. There is an exception when a new “site certificate” (with a “private key”) is imported. Since, by default, Windows® sees this as a “protected item” it will not appear in the upper pane after import. But on exit from the Export-It Certificate Manager then subsequent execution will show it (since this forces evaluation rather than relying on an assumption).
When a certificate is selected, by clicking on it in the upper pane, it will be highlighted and the buttons in the central bar that would affect it would become enabled. For example, the “” button would open a Certificate Details window (example at right) which shows the selected certificate properties (including whether it is expired or revoked and its embedded email address).
However, initially the upper pane will be empty and the four [4] needed Digital Certificates must be imported. These will be imported from four [4] files which, when Syscob recommendations are observed, should all be found in the “” subfolder of the “” subfolder in the application “server” folder and also the “local” folder of a “SEDI machine”. The latest Customs certificate files can always be downloaded from the Tools Repository on the Syscob web site. The four [4] required certificate files which need to be in the store are:
- “” contains the Gatekeeper Root CA: eSign Australia, Gatekeeper Root CA [no email] certificate that is part of the verification chain.
- “” holds the Gatekeeper Root CA: VeriSign Australia, Gatekeeper TYPE 3 CA [no email] that is also part of the verification chain.
- “” (as this expires every two years the “YYYYMMDD” value will vary) is the file with Gatekeeper TYPE 3 CA: Australian Customs Service, CCF E-mail Gateway (cargo@ccf.customs.gov.au) certificate, the currently valid Type 3 certificate for Customs used to encrypt EDI interchanges.
- The “” file produced by the Exporting Type 3 procedure that contains the exporter's Type 3 (or “standard” Type 2) “site certificate” with a private key. This certificate must have the Export-It dedicated EDI email address embedded within it.
The same procedure is used to import all four certificate files, except that the “” file will require that the password (assigned when the certificate was exported) be entered. If the password is not known it cannot be “recovered” (due to 128 bit encryption) and the certificate cannot be imported from the file (meaning that file is useless). Since the three “” files do not contain a private key (only a public key) they do not require a password for import. To import each certificate from its file follow these instructions:
- Press the “”
button for a dialog to choose one of the four files listed above. Select one of
the files and press the “” button of the
dialog:
- For a “” file a confirmation dialog will appear. To import the certificate press the “” button (or press the “” button to cancel the import).
- For a “” file a confirmation dialog requesting the file password will appear. To import the certificate enter the password assigned at time of export and press the “” button (or press the “” button to cancel the import).
- If the import is successful then the lower log pane will record the import. If the password was requested and is not correct then this will also be seen in the log pane. Or if the certificate already existed in the store then the log will say “Certificate already exists in store, no need to add.” to indicate that the import was not performed.
- For each “” file the certificate will appear in the upper pane. But a “” file is assumed to be a “protected item” so it will not immediately appear (to see it you must exit from, and then re-enter, the Export-It Certificate Manager program).
Repeat the steps above for each of the four (4) certificate files. When all four [4] Digital Certificates, and only those four (4) certificates, are resident in the “Local Machine Certificate Store” then SEDI communications will be able to use them for EDI interchanges with Customs.
Every two [2] years the “site certificate” and the Customs Type 3 certificate will need to be renewed and replaced in the store. Illustrated step-by-step instructions for this procedure can be found in the Changing Site Certificate guide. The latest Customs certificates can always be downloaded from the Tools Repository on the Syscob web site.
These Digital Certificates need only exist in the “Local Machine Certificate Store” Registry store of any computer that can act in the “SEDI machine” role (which acts as the SEDI protocol “control point” and which performs SEDI communications for the entire topology). They do not need to be imported into the store of any other computer which may run the application, but never assumes the “SEDI machine” role.