search

open-eid / SiGa

Signature Gateway
European Union Public License 1.2
17 stars 12 forks source link

Missing error description from Wiki #12

Closed Konservin closed 2 years ago

Konservin commented 2 years ago

What can be the reason for 400 in test environment upon signature finalization GET /hashcodecontainers/{containerId}/smartidsigning/{generatedSignatureId}/status "errorCode":"SIGNATURE_CREATION_EXCEPTION","errorMessage":"Unable to finalize signature. Certificate status is revoked"?

Documentation does not mention this error: https://github.com/open-eid/SiGa/wiki/Hashcode-API-description#request-smart-id-signing-status

Konservin commented 2 years ago

GET https://dsig-demo.eesti.ee/hashcodecontainers/748edf01-9dc1-4954-ae6d-96637083c39a/smartidsigning/d90c24a7-2aa9-4172-9ad2-7db18ded157a/status

naare commented 2 years ago

This means that the certificate used for signing is revoked in ocsp service.

All certificate statuses returned by SK demo OCSP service can be changed in https://demo.sk.ee/upload_cert/ Lately somebody has changed the status of automatic test numbers certificates to revoked status several times. This results the given error. In essence the status should not be changed for the predefined DEMO numbers as it results failure for all Smart-ID demo users as you are experiencing now. You could change the certificate status back to good by the link above or use some other suitable test number as a workaraound.

Konservin commented 2 years ago

Thank you for speedy reply. With test numbers signing works perfectly. I use testflight ( referenced in https://github.com/SK-EID/smart-id-documentation/wiki/Smart-ID-demo, with account level "Smart-ID Qualified Electronic Signature") in order to get truthful experience. After uploading my certificate again the result was the same, Certificate status is revoked.

naare commented 2 years ago

Be sure to upload correct certificate. Smart-ID (same as ID-Card and Mobile-ID) uses two different certificates for authentication and signing. Signing certificate has non-repudiation set as key usage.