Certificates

The Open Insurance Brazil ecosystem uses certificate chains and TLS protocol to guarantee the confidentiality, authentication and integrity of the communication channel used by the APIs of the participating institutions, as well as the clients of each participant. In addition, the certificate is required to:

To make an mTLS connection, you need 3 certificates. They are:

The certificates must be issued by a Certification Authority approved by ICP-Brasil. Here are some of those that can be contacted:

In order to register BrCAC and BrSEAL certificates, you must have created a Software Statement for your organization. To do this, follow the steps:
1. In the Directory, access your organization;
2. Go to Declarações de Software and click on Declarações de novo software;
3. On this screen, fill in the form fields as specified on page 3 of Software Statement Creation Guide (in Portuguese).

The certificates have the option to register for Sandbox and Production environments. Choose which one you wish to register and follow the steps:

Sandbox
1. In the Directory, go to the menu Organização;
2. Go to Declarações de Software and select the statement you want;
3. Go to Certificados > Novo Certificado;

4. Select the BRCAC_2022 option and click Continuar;
5. In the next step, select Geração automática de configuração;
6. Finish filling in the fields and download the files brcac.cnf and brcac.sh. Check the definition of the attributes in section 5.2.2.1 of the Developer Portal (in Portuguese);
7. Edit the brcac.cnf file with information identical to the Directory information on the Organization Details page. Here is an example using OpenSSL:

8. Edit the brcac.sh file so that it references the path of the brcac.cnf file;
9. Run the brcac.sh file through the command prompt to generate the CSR and KEY pair;
10. In the Directory, select the Carregar CSR/PEM option, locate the generated brcac.csr and click Continuar;
11. Wait for the file to load and click Feito.

Production
1. In the Directory, go to the Organização menu;
2. Go to Declarações de Software and select the desired declaration;
3. Go to Certificados > Novo Certificado;
4. Select the EXTERNAL BRCAC option and click Continuar;
5. In the Gerar CSR option, click Continuar. The EXTERNAL BRCAC is issued by the certification authority, so there is no certificate generation process.
6. Select the Carregar CSR/PEM option and locate the CSR or PEM file issued by the certificate authority;
7. Click Continuar;
8. Wait for the file to load and click Feito.

Sandbox
1. In the Directory, go to the menu Organização;
2. Go to Certificados de Organização > Novo Certificado;
3. Go to Certificados > Novo Certificado;
image:new-certificate.png
4. In the window that opens, select BRSEAL in the Select Certificate Type field;
5. In the next step, select Geração automática de configuração;
6. Finish filling in the fields and download the files brseal.cnf and brseal.sh. Check the definition of the attributes in section 5.2.3.1 of the Developer Portal (in Portuguese);
7. Edit the brcac.cnf file with information identical to the Directory information on the Organization Details page. Here is an example using OpenSSL:
image:openssl.png
8. Edit the brcac.sh file so that it references the path of the brcac.cnf file;
9. Run the brcac.sh file through the command prompt to generate the CSR and KEY pair;
10. In the Directory, select the Carregar CSR/PEM option, locate the generated brcac.csr and click Continuar;
11. Wait for the file to load and click Feito.

Production
1. In the Directory, go to the Organização menu;
2. Go to Certificados de Organização > Novo Certificado;
3. Select the EXTERNAL BRCAC option and click Continuar;
4. In the Gerar CSR option, click Continuar. The BRSEAL EXTERNAL is issued by the certification authority, so there is no certificate generation process.
5. Select the Carregar CSR/PEM option and locate the CSR or PEM file issued by the certificate authority;
6. Click Continuar;
7. Wait for the file to load and click Feito.

When you register the BrSEAL certificate in the Participant Directory, the unique key ID (KID) will be returned automatically.

The Open Insurance Brazil Certificate Standard (in Portuguese) specifies the chains for each type of certificate, being:

Go to Security > Certificates and follow the steps:

3.After filling the fields, click Save. You will be redirected to the screen where the registered certificates are listed.