How to secure open banking directory digital certificates

The Bottom Line

To interact with UK financial institutions, you must obtain two specific digital certificates from the Open Banking Directory: OBWAC (for secure transport) and OBSeal (for digital signatures). These certificates act as your 'digital passport,' proving to banks that you are an authorised entity and ensuring that the data you exchange remains encrypted and untampered with.

Understanding the Certificates

Before you begin the technical process, it is helpful to understand what you are actually installing:

• OBWAC (Open Banking Website Authentication Certificate): This handles 'Transport.' It establishes a secure tunnel between your servers and the bank’s servers, ensuring no one can eavesdrop on the conversation.
• OBSeal (Open Banking Signing Certificate): This handles 'Signing.' It is used to digitally sign the actual data or instructions you send (like a payment request), proving that the message really came from you and hasn't been altered in transit.

Step-by-Step Guide to Securing Your Certificates

1. Enrol in the Open Banking Directory: Log in to the Open Banking Directory using the credentials provided during your business registration. You will need your FCA (Financial Conduct Authority) reference number or your specific registration status ready.
2. Create a Software Statement: Within the directory, you must create a 'Software Statement.' This is a record that describes the application or platform you have built. Once created, the directory will provide a Software Statement Assertion (SSA)—a long string of text that you will use to request your certificates.
3. Generate Certificate Signing Requests (CSRs): Using a tool like OpenSSL or your cloud provider's key management service, you must generate two CSRs. This process creates a 'Private Key' (which stays on your server) and a 'Public Key' (which you send to the Directory).

   Tip: Never share your Private Keys with anyone, including the Open Banking implementation entity. If these are compromised, your security is void.

4. Submit and Download: Upload your CSRs and the SSA to the Open Banking Directory. The Directory will then issue your official OBWAC and OBSeal certificates. Download these in the required format (usually .pem or .crt).
5. Install in Your Production Environment: Upload the certificates to your production server or API gateway. You will need to configure your software to present the OBWAC during the 'handshake' with a bank and use the OBSeal to sign outgoing data packets.

Best Practices for Managing Certificates

Digital certificates are not 'set and forget' tools. To maintain a professional and reliable service, keep the following in mind:

• Monitor Expiry Dates: These certificates usually expire after one or two years. Set calendar reminders well in advance to renew them; if they expire, your connection to all banks will instantly break.
• Automated Rotation: If your technical team has the capacity, use automated scripts to manage certificate renewal and deployment to avoid manual errors.
• Secure Storage: Use a dedicated 'Key Vault' or 'Secrets Manager' (like those provided by AWS, Azure, or Google Cloud) to store your certificates and private keys rather than keeping them in your codebase.