Info! Please note that this translation has been provided at best effort, for your convenience. The English page remains the official version.

How to enrol for BPKI?

1) Introduction

A BPKI certificate, also known as a client X.509 certificate, is used to identify a user or a client. They are meant for authenticating a client to a server. In the case of AFRINIC, the client certificate delivered will hold your NIC-HANDLE as Common Name (CN). You must be an authorised contact of your organisation to obtain a BPKI certificate. A BPKI certificate is needed to access Resource Certification (RPKI) services.

  

2) How to request a BPKI certificate

To request a BPKI certificate,  connect to https://my.afrinic.net and navigate to "My Account > BPKI".

2.1. Administrative contact

If you are an administrative contact, you will have to send us your identification information:

  1. Full name
  2. E-mail address
  3. NIC-HANDLE
  4. Organisation's name
  5. Scanned copy of an official Government/State-issue ID, passport, driver's license or company'ID card.

Please send the above details to  This email address is being protected from spambots. You need JavaScript enabled to view it. along with the required documents.

1 admin_cert_request

 

2.2. Non-administrative contact

If you are a technical, billing, abuse or general contact, you will be asked to request a BPKI certificate by clicking on the "Request BPKI certificate" button.

2 request_bpki_button

 

Your request will be sent to all the Administrative contacts of your organisation. You need to follow up with them to know the status of your request.

 

3) Accepting or rejecting a BPKI request (for admin contacts only)

An email is sent to all admin contacts of an organisation when a non-admin contact makes a BPKI request. Below is an example of an email sent to administrative contacts.

2.2 non-admin_cert_request_email

 

To accept a BPKI request made by non-admin contacts of the organisation, navigate to "My Account -> BPKI". The system will grant you access to this section only and only if you (as admin-contact ) already have a valid BPKI certificate. If not go back to step 2.1.

2.3 accept_reject_interface

 You can then accept or reject a BPKI request of somebody from your organisation.

 

4. Invitation to request your BPKI certificate

Once your BPKI request has been approved either by the Hostmaster (for admin contacts) or by your organisation's administrative contact, you will receive an email like the one below:

3 bpki_invitation_to_retrieve

 

5. Enrol your BPKI certificate

To enrol your BPKI certificate you will have to connect to the External RA(Registration Authority) service. 

 

Create a certificate from a CSR (manual process)

To be able to generate a key pair, you need to have OpenSSL installed. *nix platforms are usually bundled with OpenSSL, for Windows please visit click here

Instructions:

  • Generate a new private key and Certificate Signing Request
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key

Please fill out the information requested for the CSR.

 

IMPORTANT

1) The Common Name (e.g. server FQDN or YOUR name) should be (i.e the username received in the invitation email)

2) You have just generated a private key for your BPKI certificate. Please keep it safe and back it up. In case the key is compromised, please send an email immediately to  This email address is being protected from spambots. You need JavaScript enabled to view it. , we shall revoke your certificate.

3) You should leave the challenge password blank otherwise the system will ask for the challenge password everytime the certificate is used.

5.1 enrolment csr

 

Make sure you select "PEM" and click on "Send Certificate Request". A certificate in pem format will be downloaded. Save it to the same folder as the CSR and private key generated under the name .pem.

Convert the PEM certificate into a PKCS#12 format (p12). To be able to do this, you will need to have the CA certificate of the client certificate. Copy and save the memberca certificate as "memberca.pem" under the same folder as above. And execute the following command:

 

openssl pkcs12 -export -out <NIC-HANDLE>.p12 -inkey privateKey.key -in <NIC-HANDLE>.pem -certfile memberca.pem


Output: your certificate in p12 format <NIC-HANDLE>.p12

 

  • Now you need to import the certificate in your keychain or browser certificate keystore. To import a certificate in your browser:
    • For Firefox:
      • Linux: open Edit -> Preferences -> Advanced -> Encryption -> View Certificates 
        Windows: open Tools -> Options -> Advanced -> Certificates -> Manage Certificates 
        MAC: open Firefox -> Preferences -> Advanced -> Encryption->View Certificates
      • click import and enter the filename (mycert.p12 or mycert.pfx on a MAC)
    • For Chrome:
      • Go to preferences
      • Select "Show advanced settings" and under HTTPS/SSL click "manage certificate".
      • Import the certificate into your login keychain.
    • For MAC Safari open a Terminal

 

'open' mycert.pfx

 

Open recognizes either the .pfx or .p12 extension and will open the keychain so you can import the certificate.

Import the certificate into your login keychain.

 

IMPORTANT 
Even though you can import your certificate to a series of different browsers, the only currently supported browsers to access BPKI-restricted sections of MyAFRINIC are Chrome and Firefox.

 

Bravo! You now have a BPKI certificate installed in your browser and you can now securely authenticate yourself to MyAFRINIC.

 

on Friday December 14 by duksh
Was this helpful?