How do I securely share my eIDAS certificates with TrueLayer?

As discussed in our FAQ, TrueLayer clients who are regulated in their own right for the provision of account information services and payment initiation services in Europe, need to obtain eIDAS certificates (namely a PSD2 Qualified Web Authentication Certificate (QWAC) and Qualified eSeal Certificate (QSealC)).

Once a client has their eIDAS certificates, TrueLayer will be able to manage the rest of the process of connection using these certificates. To do this, the certificates must be shared with TrueLayer. 

As a technical service provider, TrueLayer connects to bank APIs on behalf of clients. In order to do this, we need to identify towards the bank with the relevant identification certificates.

This is for Non-UK Open Banking access - we will need your eIDAS certificates to use directly with European banks.

Using a MAC: 

1. Keep QWAC and QsealC files in separate directories called qwac and qseal
2. Inside each of these directories there should be two files (a keypair): a private key generated by you and a public certificate issued by your QTSP. The public certificate is strictly associated with the private key you used to generate the CSR for your QTSP
3. Zip these two directories in a file called eidas.zip
4. Add TrueLayer’s public key to your GPG key store 
   

   gpg --auto-key-locate clear,wkd,local --locate-keys engineering@truelayer.com

   ​
5.  Encrypt the zip file containing your certificates
   gpg --output encrypted.gpg --encrypt --recipient engineering@truelayer.com eidas.zip
6. Send the encrypted file to TrueLayer’s technical contacts via email to eidas@truelayer.com

TrueLayer uses public-key encryption to receive your eIDAS keypairs securely. Public key encryption protects your important files in transit and at rest, preventing anyone other than TrueLayer from reading the contents, even if these files are misplaced or intercepted. When we receive your files, we decrypt them and store the content securely in our database. Access to these assets is strictly controlled and monitored.