Knowledge | Global Trust

What are the costs of not going paperless?

Administrator — Wed, 02 Aug 2023 10:47:10 +0000

While digitization reached almost every aspect of daily work, the necessity for handwritten signatures in B2B environments preserves printing paper its crucial role – and incurs costs. However, by implementing e-signatures, businesses can reduce expenses, streamline processes, and contribute to a more sustainable approach. E-signatures offer a secure and legally binding alternative, making them a cost-efficient and eco-friendly choice for businesses.

Click here to place your order – get your Cloud QES now!

purchase now

Annual printing expenses: a significant impact

Every employee prints an average of 5,750 pages every single year. At an average cost of 6 cents per printed page, this results in an annual expense of 345€ per employee. In addition to the printing costs, there are often additional fees for postal delivery, further adding to the overall expenses. These fees vary depending on the size and weight of the document and the distance it needs to be delivered. Moreover, the need for physical archiving of paper documents – first of all contracts – requires dedicated storage space. Over time, as the number of paper accumulates, the demand for physical storage grows, leading to additional costs for businesses. This not only consumes valuable office space but also necessitates the implementation of proper archival systems to ensure easy access and retrieval of documents when needed.

Wet ink signatures – the last show stopper for digitization?

Despite the advancements in the digital world, printing documents remains a crucial aspect of daily work life. In many B2B environments, the only reason for not going fully paperless and still printing documents is the necessity for handwritten signatures. However, with the advancements in technology, this costly and time-consuming practice can easily be avoided by implementing electronic signatures, also known as e-signatures. E-signatures provide a secure and legally binding alternative to handwritten signatures, enabling businesses to streamline their processes, reduce paper usage, and eliminate the expenses associated with printing, scanning, and storing physical documents. By adopting e-signatures, enterprises can not only enhance efficiency but also contribute to a more environmentally friendly and sustainable business approach.

Substantial savings with e-signatures

The average contract in many industries may typically consist of around 20 pages, resulting in significant printing costs at the standard rate of 6 cents per page. For instance, a single contract would cost approximately €1.20 (€0.06 per page). However, the implementation of e-signatures can lead to substantial savings in this aspect. With e-signatures, the entire contract can be electronically signed and processed, significantly reducing the expenses to a mere €0.02 per full document no matter the number of pages.(as a basis for comparison, we have used our best-selling SME plan from TRUST2GO with up to 50 users.) By adopting e-signature solutions, businesses can achieve a cost reduction to a good fiftieth making the process highly attractive.

Paperless contracts: a crucial building block of modern process rationalization

Obviously, electronic documents also incur storage costs, and there are backup and restore and security issues to be governed. Again, there is a similar cost advantage compared to the analogue world.

Transitioning to the paperless office, particularly using e-signatures, can help mitigate these issues. In conclusion, e-signatures clearly outpace paper in terms of cost efficiency, convenience and quickness. The significant savings from reduced printing, postal fees, and physical storage make e-signatures the smarter and more sustainable choice for businesses. Their streamlined process and enhanced productivity further solidify their position as the clear winner in the race against paper-based methods.

Get your electronic signature in 3 steps

Apply: The easiest way to request individual accounts is here. In case of larger demand (10 signers or more), please contact us early to prepare a batch order.

Identify: You will be invited by mail to participate in a video identification via our German provider- qualified signatures can only be provided after an identity check to prevent misuse. You can complete the video call Monday through Sunday, 7:00 am to 10:00 pm Berlin Time without an appointment. Please have a valid passport or ID card ready and provide adequate lighting.

Activate: Following the successful identification, we will notify you about the activation. The solution is 100% cloud-based – so waiting for mail, bulky card readers, and compatibility issues don’t have to be a headache.

Click here to place your order – get your Cloud QES now!

purchase now

How can we get in touch with you?



Contact our team: +43 1 532 0 944

Our employees are available for an obligation-free consultation.

Availability: Mon-Fri 9:00-17:00

You could also like…

QES & Competition Law – European Commission to require electronic signatures from 1st September, 2023

11. July 2023

To further simplify merger control procedures and in line with its overall digital strategy, the European Commission has published a number of revised legal texts, including one that will make electronic transmission of electronically signed documents the default method from 1 September 2023. Read on to find out...

Sign MS-Office documents using a UPC token

30. May 2023

User instructions for signing MS-Office documents using our UPC token (Summer release) through the AATL certificate. Status: May 05, 2023 1 Basics 1.1 Goals of this document A step-by-step guide to signing MS Office documents. By signing an MS-Office document, other users can no longer edit the final document....

Sign and encrypt with the UPC token in Outlook

11. May 2023

User guide for signing and encrypting emails using the GLOBALTRUST UPC token V2.0 (issued from May 15, 2023) in Microsoft Outlook.As of May 9, 2023 1 Basics 1.1 Goals of this document A step-by-step guide on how to add the certificate in Microsoft Outlook to sign and/or encrypt emails.These instructions were created...

GLOBALTRUST QUALIFIED TIMESTAMP – qualified time stamp according to eIDAS-VO for audit-proof document management

Admin Admin — Fri, 14 Apr 2023 08:18:30 +0000

GLOBALTRUST QUALIFIED TIMESTAMP assigns a time stamp to any document and thereby guarantees the existence of this document at this point in time. The document itself is not transferred, data protection is preserved – internationally recognized standard RFC 3161 and EU-wide legal basis guarantee interoperability. GLOBALTRUST archives issued time stamps at no additional cost.

Why GLOBALTRUST QUALIFIED TIMESTAMP?

In many cases it is important to know when a document was created, when it was submitted or when it was published – or more abstractly: when an electronic process took place. Just think of the financial market, which would no longer function at all without unfalsifiable and millisecond-precise time information.

On the one hand, the local computer time is far too imprecise, and on the other hand, it can also be manipulated at will. The Internet does not know reliable time information, so special services are required. A time confirmation from a trustworthy third party therefore has high probative and confirmatory power.

The qualified timestamp links an electronic document to the “official time”. This guarantees the existence of the document at this point in time. In addition, it is proven that the document has not been changed since this point in time (integrity).

Electronic time stamp services are gaining in importance. They serve to preserve evidence that also withstands long-term regulatory requirements: be it for audit-proof archiving, proof of the priority of intellectual property, prevention of fraud, documentation of submission and receipt dates or in electronic procurement procedures. Our customers use them for numerous other functions as part of automated document management.

A reliable indication of the time is of the utmost importance, particularly in connection with the publication of information, the existence of a specific website, UWG issues, copyright infringement, e-tendering issues or issues relating to the use of names and terms. Other common application scenarios are time stamps embedded in electronic signatures on contracts, protocols in the e-health sector, and non-disclosure agreements (NDAs).

As a trust service provider according to eIDAS and SVG, the timestamp service GLOBALTRUST QUALIFIED TIMESTAMP is provided under the supervision of the Telekom-Control-Commission/RTR GmbH. In 2018, GLOBALTRUST was the first provider in Austria to play a key role in shaping the development.

What can’t a timestamp do?

As a “time signature”, a timestamp proves the exact point in time at which a document was available. An intact time signature is also proof that the document has not been changed after it was attached (integrity).

However, it makes no statement as to where or by whom a document originates (authenticity) and also does not express approval of the document content (“content commitment”). These functions can only be covered using (qualified) electronic signatures and seals. Here we have created a short overview.

Internationally recognized standard

GLOBALTRUST uses the internationally recognized and widely used standard RFC 3161 (Internet X.509 Public Key Infrastructure Timestamp Protocol, TSP). This ensures global interoperability, regardless of the file format or document management system used.

How does the qualified timestamp work?

A unique, non-forgeable hash code is automatically generated from a document. This hash code is uniquely associated with a specific document. However, the content of the document cannot be inferred from the hash code. Any (electronic) data can be used as a hashable and therefore time-stampable “document”. XML, PDF and JSON documents are popular.

This hash code is transmitted to the GLOBALTRUST TIMESTAMP server in encrypted form (TIMESTAMP request), where it is provided with the exact time and electronically signed by the TIMESTAMP server.

GLOBALTRUST QUALIFIED TIMESTAMP obtains the exact time directly from the Frankfurt atomic clock and guarantees an accuracy of one second (internal analyses yielded an accuracy of better than 10 milliseconds). The time stamp is either transmitted as a separate file to the requester, who keeps this file together with the original document. However, numerous systems also have integrated time stamp functions and embed, e.g. B. insert the timestamp in a signed or unsigned PDF. In addition, the time stamp is kept by GLOBALTRUST for 35 years for later questions on the preservation of evidence.

This procedure guarantees 100% confidentiality of your valuable documents. The content of the confidential documents is never transmitted to GLOBALTRUST. Since the hash code is also transmitted in encrypted form, it is not possible for attackers to identify who is actually making requests.

GLOBALTRUST archives issued time stamps

In addition, each time stamp (not the document!) is archived for evidence purposes and can be made available at a later date. Even if the customer loses their timestamp, presenting the hash value of a document is sufficient to check the validity at a specific point in time. GLOBALTRUST archives all assigned time stamps for up to 35 years.

Conditions

Time stamps can be requested in different annual quotas. The minimum amount is 100 time stamps, which must be used within one year. A change to the next higher quota size is possible at any time and must be announced by the user.

100 time stamps/year: 20 euros
1,000 time stamps/year: 185.00

Conditions for special contingents, higher scales or for resellers on request. Users of a GLOBALTRUST certificate receive a basic quota free of charge.

Users receive a reminder email about current consumption and order information when their quota is running out. This ensures that the service is always available.

Accuracy of GLOBALTRUST QUALIFIED TIMESTAMP

GLOBALTRUST QUALIFIED TIMESTAMP guarantees a time accuracy of +/- one second. The time refers to UTC (Universal Time Zone). If the time guarantee can no longer be guaranteed, the timestamp service will be temporarily deactivated and the applicant will receive a corresponding warning.

Internal tests have shown that the accuracy is 100 times higher and the deviations are typically less than 10 milliseconds.

“As a collecting society for the copyrights of more than 27,000 members, we have to deal with tens of thousands of administration contracts every year. We only sign them electronically – advanced, fully automated, completely legally secure and including a qualified time stamp.”

DI Roman Oslansky, Head of IT Division, AKM

Who can use GLOBALTRUST QUALIFIED TIMESTAMP?

An order from GLOBALTRUST is required for use. Holders of certain valid GLOBALTRUST Certificates are entitled to up to 100 free timestamps.

What do you need to use it?

Adobe Acrobat also allows a time stamp to be included when signing a PDF document, which is retrieved automatically. No additional software is required. Installation see https://www.globaltrust.eu/static/support-adobe-acrobat-dc-wi….

Numerous providers of ECM, DMS and ERP systems have already integrated GLOBALTRUST QUALIFIED TIMESTMAP into their products.

These Solution Partners support the implementation of your qualified time stamp project.

Automated timestamp services and bulk timestamps

Of course, the automated assignment of time stamps or the provision of large quantities of documents with time stamps is also possible. This requires special archive programs. On request, GLOBALTRUST provides interested developers with the necessary specifications for integrating the time stamp functions into their products.

Which hash algorithms are supported?

GLOBALTRUST QUALIFIED TIMESTAMP supports the algorithms SHA-256, SHA-512 and RIPEMD-160, which are considered to be secure.

“We have been offering tailor-made e-tendering solutions for private companies and public clients for two decades. Especially for public companies that are subject to the Federal Procurement Act, a legally secure handling of procurement procedures is the essential criterion. In order to be able to guarantee this legal certainty, we use a qualified time stamp from GLOBALTRUST. The integration into our systems was done quickly and easily. We – and therefore also our customers – will continue to rely on this service for the next twenty years!”

Ing. Christian Stecker, General manager, vemap Einkaufsmanagement GmbH

Which usage variants are supported?

Issue TIMESTAMP using TCP/IP port: timestamp.globaltrust.eu port 10318

Timestamp assignment according to Timestamp Protocol (TSP) according to RFC 3161(+ Update RFC 5816)
Usage: TLS client authentication with certificate required (certificate must be issued by GLOBALTRUST)
Timestamp contains complete certificate chain with timestamp certificate, intermediate certificate and root certificate
TLS encryption

Issue TIMESTAMP using HTTPS (Port 443 + 11080)

Suitable for Adobe Acrobat from version 10 and Reader DC
https://timestamp.globaltrust.eu
https://timestamp.globaltrust.eu:11080
Use: two alternative variants (A, B) possible
Variant A: Authentication with username/password (assigned by GLOBALTRUST)
Variant B: TLS client authentication with certificate (certificate must be issued by GLOBALTRUST)
Timestamp contains only Timestamp certificate

The step-by-step instructions for using GLOBALTRUST QUALIFIED TIMESTAMP for Adobe Acrobat DC can be found at https://www.globaltrust.eu/static/support-adobe-acrobat-dc-wi….

Issue TIMESTAMP using HTTPS (Port 10080)

Not suitable for Adobe Acrobat
https://timestamp.globaltrust.eu:10080
Use: two alternative variants (A, B) possible
Variant A: Authentication with username/password (assigned by GLOBALTRUST)
Variant B: TLS client authentication with certificate (certificate must be issued by GLOBALTRUST)
Timestamp contains complete certificate chain with timestamp certificate, intermediate certificate and root certificate

Issue TIMESTAMP using HTTPS (port 13080)

For Adobe Acrobat from version 10 and Reader DC: https://timestamp.globaltrust.eu:13080

Usage: Authentication with username/password required (assigned by GLOBALTRUST)
Timestamp contains complete certificate chain with timestamp certificate, intermediate certificate and root certificate
Product: e.g. Adobe Acrobat Version 10, Adobe Acrobat Reader DC

Developer information

TCP/IP access to GLOBALTRUST QUALIFIED TIMESTAMP Server

Basic process

A hash is formed from the document to be provided with a time stamp. The hash algorithms SHA-1, SHA-256, SHA-512 and RIPEMD-160 are supported.
This hash is sent to the GLOBALTRUST QUALIFIED TIMESTAMP server in the form of a timestamp request specified in RFC3161.
The GLOBALTRUST QUALIFIED TIMESTAMP server returns the timestamp in the form of a timestamp reply.

Access to GLOBALTRUST QUALIFIED TIMESTAMP Server with TCP/IP

The GLOBALTRUST QUALIFIED TIMESTAMP Server implements the “Socket Based Protocol” (RFC 3161 3.3) with the addition that TLS encrypted sockets are used. For user authentication, a client certificate must be presented to the server during the TLS handshake (all non-expired and non-revoked personal GLOBALTRUST certificates are entitled to collect time stamps, but a time stamp quota must be agreed).

The GLOBALTRUST QUALIFIED TIMESTAMP server can be reached via the DNS name timestamp.globaltrust.eu, port 10318.

Basically, solutions can be used in any programming environment, the following support must be given:

TLS support
Use of client certificates in the TLS handshake must be supported
Ability to create and interpret a “Socket Based Protocol” header (RFC 3161 3.3)
Ability to create a timestamp request according to RFC 3161 (SHA-1, SHA-256, SHA-512 and RIPEMD-160 are supported)
Ability to interpret a timestamp response according to RFC 3161

A Java client application might look something like this if the request.tsq file is a valid Timestamp Request (TSQ). The TSQ itself was generated using OpenSSL or the BouncyCastle library.

Please note that the sample code provided is only a first orientation and no guarantee is given for the correct form, content or syntax. The code is intended to make it easier for Java programmers to get started with the timestamp problem.

Users of other programming languages (C, C++, etc.) may need RFC3161-compliant extensions or function libraries. In this regard, contact your supplier for your development environment. GLOBALTRUST cannot provide any support for this.

package eu.globaltrust.test;

import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.URL;

import javax.net.ssl.HttpsURLConnection;

import org.bouncycastle.util.encoders.Base64;

public final class TSAHTTPClientWithHTTPAuth {

    private TSAHTTPClientWithHTTPAuth() {
    }

    public static void main(final String[] args) {
        // Truststore setzen; Truststore enthält GLOBALTRUST root
        // Zertifikat - notwendig, da der Client dem TLS Serverzertifikat
        // sonst nicht traut - siehe
        // http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#CreateKeystore
        System.setProperty("javax.net.ssl.trustStore", "truststore-client");

        // Username und Passwort für HTTP Authentifikation setzen
        String username = "USERNAME";
        String password = "PASSWORT";

        try {
            // Laden des Timestamp request
            File fReq = new File("request.tsq");
            byte[] req = new byte[(int) fReq.length()];
            try {
                new FileInputStream(fReq).read(req);
            } catch (Exception e) {
                System.err.println("Error reading from file");
                return;
            }

            // öffnen der Netzwerkverbindung
            HttpsURLConnection conn = (HttpsURLConnection) new URL("https://timestamp.globaltrust.eu:10080")
                    .openConnection();

            // Setzen der HTTP Parameter
            conn.setDoInput(true);
            conn.setDoOutput(true);
            conn.setRequestMethod("POST");
            conn.setRequestProperty("Content-Type", "application/timestamp-query");
            conn.setRequestProperty("Content-Length", Integer.toString(req.length));

            // Erstellen der Authorization-Information lt. RFC 2617
            // Base64("Username:Password")
            ByteArrayOutputStream bout = new ByteArrayOutputStream();
            Base64.encode((username + ":" + password).getBytes(), bout);
            String base64Auth = bout.toString("8859_1");
            conn.setRequestProperty("Authorization", "Basic " + base64Auth);

            // Senden des Requests
            OutputStream os = conn.getOutputStream();
            os.write(req);
            conn.connect();
            os.close();
            System.out.println("Request sent.");

            // Empfangen der Response
            InputStream is = conn.getInputStream();

            byte[] resp = new byte[conn.getContentLength()];
            is.read(resp);
            is.close();
            FileOutputStream osResp = new FileOutputStream("tsatestresp.der");
            osResp.writpackage eu.globaltrust.test;

import org.bouncycastle.tsp.TimeStampResponse;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.math.BigInteger;

import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;

/**
 * This class contains a main method that connects to a timestamping server
 * using the TCP protocol specified in RFC3161 with an additional SSL layer. It
 * should only be used for reference purposes.
 * @author DW
 *
 */
public final class TSATCPClient {

    private TSATCPClient() {
    }

    public static void main(final String[] args) {
        // Client Zertifikat bei SSL Handshake "vorweisen"
        System.setProperty("javax.net.ssl.keyStore", "zertifikat.p12");
        System.setProperty("javax.net.ssl.keyStorePassword", "PASSWORT");
        System.setProperty("javax.net.ssl.keyStoreType", "PKCS12");

        // Truststore setzen; Truststore enthält GLOBALTRUST root
        // Zertifikat - notwendig, da der Client dem TLS Serverzertifikat
        // sonst nicht traut - siehe
        // http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#CreateKeystore
        System.setProperty("javax.net.ssl.trustStore", "truststore-client");

        try {
            // Timestamp Request einlesen
            File fReq = new File("request.tsq");
            FileInputStream fis = new FileInputStream(fReq);
            byte[] request = new byte[(int) fReq.length()];
            fis.read(request);
            fis.close();

            // Header für direct TCP-based TSA message vorbereiten
            // length-Header Feld
            int len = request.length + 1;
            byte[] blength = new BigInteger(Integer.toString(len)).toByteArray();
            byte[] length = new byte[4];

            // Falls Länge weniger bytes verbraucht, als vorgesehen ist,
            // wird der Rest mit 0-Bytes aufgefüllt.
            for (int i = 3; i > 3 - blength.length; i--) {
                length[i] = blength[(blength.length - 1) + (i - 3)];
            }
            for (int i = 0; i < 4 - blength.length; i++) {
                length[i] = 0;
            }

            // Verbindung aufbauen
            SSLSocket s = (SSLSocket) SSLSocketFactory.getDefault().createSocket("timestamp.globaltrust.eu", 10318);
            // length-Header Feld schicken
            s.getOutputStream().write(length);
            // flag-Header Feld vorbereiten und schicken
            byte[] flag = new byte[1];
            flag[0] = 0;
            s.getOutputStream().write(flag);
            // timestamp request schicken
            s.getOutputStream().write(request);

            // Antwort lesen
            InputStream is = s.getInputStream();
            // Length-Header Feld lesen
            blength = new byte[4];
            int readlen;
            if ((readlen = is.read(blength, 0, 4)) < 4) {
                System.out.println("Couldn't read length");
                System.out.println("only read " + readlen + " bytes");
                return;
            }
            int ilength = new BigInteger(blength).intValue();

            // Flag-Header Feld lesen
            flag = new byte[1];
            if (is.read(flag, 0, 1) != 1) {
                System.out.println("flag not read");
            }
            // Timestamp Response lesen
            byte[] value = new byte[ilength - 1];
            if ((readlen = is.read(value, 0, ilength - 1)) != ilength - 1) {
                System.out.println("could not read message");
                System.out.println("only read " + readlen + " bytes");
                return;
            }
            // Timestamp Response abspeichern
            FileOutputStream reply = new FileOutputStream("reply.tsr");
            reply.write(value);
            reply.close();

            // Timestamp Response interpretieren
            TimeStampResponse resp = new TimeStampResponse(value);
            System.out.println("Response Status: " + resp.getStatus());
            System.out.println("Timestamp at: " + resp.getTimeStampToken().getTimeStampInfo().getGenTime());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Creation of a timestamp request in Java

Written in Java using the BouncyCastle libraries, the following program creates a timestamp request in the request.tsq file for the doc.txt file:

package eu.globaltrust.test;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;

import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.tsp.TimeStampRequest;
import org.bouncycastle.tsp.TimeStampRequestGenerator;

public final class TSQCreator {

    private TSQCreator() {
    }

    public static void main(final String[] args) {
        // Die OID des Hash Algorithmus muss bekannt sein
        String sha1Oid = "1.3.14.3.2.26";
        // Wir wollen ein Timestamp Request für doc.txt erstellen
        File doc = new File("doc.txt");
        byte[] bytes = new byte[(int) doc.length()];
        try {
            new FileInputStream(doc).read(bytes);
        } catch (Exception e) {
            System.err.println("Error reading from file");
            return;
        }
        byte[] digest;
        try {
            digest = MessageDigest.getInstance("SHA1").digest(bytes);
        } catch (NoSuchAlgorithmException e) {
            System.out.println("SHA-1 algorithm not available.");
            return;
        }
        TimeStampRequestGenerator gen = new TimeStampRequestGenerator();
        try {
            TimeStampRequest tsq = gen.generate(new ASN1ObjectIdentifier(sha1Oid), digest, new BigInteger(64,
                    SecureRandom.getInstance("SHA1PRNG")));
            try {
                new FileOutputStream("request.tsq").write(tsq.getEncoded());
            } catch (Exception e) {
                System.out.println("Error writing request.");
                return;
            }
        } catch (NoSuchAlgorithmException e) {
            System.out.println("No such algorithm: " + e.getMessage());
        }
    }
}

What are the costs of not going paperless?

02. August 2023

While digitization reached almost every aspect of daily work, the necessity for handwritten signatures in B2B environments preserves printing paper its crucial role – and incurs costs. However, by implementing e-signatures, businesses can reduce expenses, streamline processes, and contribute to a more sustainable...

QES & Competition Law – European Commission to require electronic signatures from 1st September, 2023

11. July 2023

Sign and encrypt emails using an Apple iPhone

12. May 2023

User guide for signing and encrypting emails with the GLOBALTRUST CLIENT certificate on your Apple iPhoneAs of May 10, 2023 1 Basic 1.1 Goals of this document A step-by-step guide on how to add the certificate to your iPhone to then sign and/or encrypt emails. This guide was created for an Apple iPhone (iOS version:...

Creation of a PKCS12 file from a certificate with or without a key

Admin Admin — Thu, 13 Apr 2023 10:53:09 +0000

Create PKCS12 file from private key and new certificate

If you want to assemble a new PKCS12 file (extension .p12 or .pfx) from an existing key and a new certificate, you can use the open source tool XCA.

✓ You can find an overview of all products here

Process:

Download XCA
Run the setup and install the tool.
From the File menu, choose New Database and enter any filename.
Select the “Private Keys” tab and click on “Import”. Specify the private key file.
Select the “Certificates” tab and click on “Import”. Specify file with the new certificate.
Select the imported certificate and click “Export”.
Select “PKCS#12 with certificate chain” as the export format and specify a target path.
Enter an export password
The database file created in point 3 is deleted again.

Create certificate without private key in PKCS12 format

Generation using openssl:

(The prompted password must remain blank, as the private key is not used)

openssl pkcs12 -nokeys -in [certificate-file-old].pem -export -out [certificate-file-new].p12

Content control:

openssl pkcs12 -info -in [certificate-file-new].p12

What are the costs of not going paperless?

02. August 2023

QES & Competition Law – European Commission to require electronic signatures from 1st September, 2023

11. July 2023

Sign and encrypt emails using an Apple iPhone

12. May 2023

Digital signature for XML documents (XML signature) including XaDES

Admin Admin — Thu, 13 Apr 2023 08:38:28 +0000

XML – DSig – XaDES

XML default information

XML is a so-called markup language and is used to structure data. XML schemas can be used to specify certain XML-based data formats (e.g. web interface for XML invoices).
A special feature of XML is that one and the same XML document can have multiple physical (=byte) representations. An example:

test1.xml:

Hello World!

test2.xml:

Hello World!

Although test1.xml and test2.xml have different file sizes, from an XML perspective they are one and the same file. If you simply signed test1.xml as a file, the signature for test2.xml would no longer be valid. While this doesn’t seem like a big problem looking at these 2 files, when you consider that XML is designed to be passed from machine to machine and evaluated in between, the problem becomes apparent. If a machine reads the ISO-8859-15 encoded file, evaluates it, and then outputs it again UTF-8 encoded in order to hand it over to the next processing application, the signature becomes invalid. Although only XML transformations have taken place that affect the content of the document Don’t change.

This issue can be compared with ASN.1, where DER was introduced for this reason – semantically identical data is mapped in the same way at the byte level.

With XML there is also a technology that creates the same physical representation from semantically the same XML documents: Canonical XML (C14n).

“DSig” is the W3C XML default signature

After the so-called canonicalization, an XML document is ready to be signed. Again, this could theoretically happen in a number of ways, but the most obvious is to use the W3C’s flexible “XML-Signature Syntax and Processing” standard (DSig).

This standard is so flexible that it is not only possible to sign XML documents with it, but any documents. The main point of the standard is actually that the signature is stored in XML format – no matter what type of data is signed with it.

There are 3 different ways to sign with DSig: Enveloping, Enveloped and Detached. Enveloping and enveloped signatures are primarily applied to XML documents, with the signature coexisting with the XML data in the same XML file. All document types can be signed with a detached signature; the signature is saved in a separate XML file. In principle, any number of documents can be signed at once with XML DSig – they only have to be integrated with the ds:Reference tag.

Sign the following XML file (/home/gast/test2.xml):

Daniel
Weller

Enveloped Signature:

Daniel
Weller

YHkJTgkmev7VDyv1/Iiqm6RMRYk=

C377H6bQoX39eNFxcdB0GQ/CMMxstEsErhK91CHCnsYnLr+9DZd6Wv+KwdlyINtiYWInBGJJzjPg
W2dp7acCbZYO1lt60qYlnZYTvoCpC1JW9KQhkLg0h5AiRegBJqPj7h+gz6lYrZ1g3kWxg0ZzUEmB
dT0yUjwhp9SqKRoiUXQ=

MIIFCzCCA/OgAwIBAgICAPAwDQYJKoZIhvcNAQEFBQAwgcwxCzAJBgNVBAYTAkFUMRAwDgYDVQQI
EwdBdXN0cmlhMQ8wDQYDVQQHEwZWaWVubmExOjA4BgNVBAoTMUFSR0UgREFURU4gLSBBdXN0cmlh
biBTb2NpZXR5IGZvciBEYXRhIFByb3RlY3Rpb24xJTAjBgNVBAsTHEEtQ0VSVCBDZXJ0aWZpY2F0
aW9uIFNlcnZpY2UxGDAWBgNVBAMTD0EtQ0VSVCBBRFZBTkNFRDEdMBsGCSqGSIb3DQEJARYOaW5m
b0BhLWNlcnQuYXQwHhcNMDUwOTA2MDAwMDAwWhcNMDcwOTA2MTM0NjMzWjCBgTELMAkGA1UEBhMC
QVQxCjAIBgNVBAgTAS0xDTALBgNVBAcTBFdpZW4xCjAIBgNVBAoTAS0xLDAqBgNVBAMTI0Rhbmll
bCBXZWxsZXIsIE5FVUFVU1NURUxMVU5HKFRlc3QpMR0wGwYJKoZIhvcNAQkBFg5kLndAZnJlZW5l
dC5hdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsi4csbc69/NYQqm9X1VdLcgPf2nkfDgi
8C4JDKji3UWoNISFA8UzuNvk65Hfm9ZNaBXK5E/sE7BgCuvNiTKDlyg9u0iJwKqboWoSTvSvQrLc
ADBtqD0wl0K1y8mF1Dra0CInPIMC/x0tJSpDs6vwSKSR5d6yIgH6YNjBXx1LqvcCAwEAAaOCAcIw
ggG+MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFC51MRVwN//xQPfZQO0ZhW1sgA5LMB8GA1UdIwQY
MBaAFDd/Pj6ZcWDKJNSRE3nQdCm0qCTYMBkGA1UdEQQSMBCBDmQud0BmcmVlbmV0LmF0MC8GA1Ud
EgQoMCaBDmluZm9AYS1jZXJ0LmF0hhRodHRwOi8vd3d3LmEtY2VydC5hdDA5BgNVHR8EMjAwMC6g
LKAqhihodHRwOi8vd3d3LmEtY2VydC5hdC9zdGF0aWMvYWR2YW5jZWQuY3JsMA4GA1UdDwEB/wQE
AwIE8DARBglghkgBhvhCAQEEBAMCBPAwUQYDVR0gBEowSDBGBggqKAAYAQEBAzA6MDgGCCsGAQUF
wIBFixodHRwOi8vd3d3LmEtY2VydC5hdC9jZXJ0aWZpY2F0ZS1wb2xpY3kuaHRtbDA7BglghkgB
hvhCAQgELhYsaHR0cDovL3d3dy5hLWNlcnQuYXQvY2VydGlmaWNhdGUtcG9saWN5Lmh0bWwwNAYJ
YIZIAYb4QgENBCcWJUEtQ0VSVCBBRFZBTkNFRCBDZXJ0aWZpY2F0aW9uIFNlcnZpY2UwDQYJKoZI
hvcNAQEFBQADggEBAI7lW+WJbVm6E3qwY0w9F21LjKI3nf19NxWg9jmHN8vwfLsWnwatW3cBpxQO
4jAfxl8xqpX36e3QGXOiDPnYOJ3blmcOxZ3sNL15s+Iq6P9DPyLv/7L0La2FRh4gfWGEbh15BEfh
S65VdxR+LTr9prIt1FSTpl2qIO/nIs+6ouN6TQ6B2JUAeXXaMuQGxM7LNL4XcWVveOaC3oem+Ym7
c2omf3Sge5nRj6Eg7KYh5VCvy6Dhvk8AT25f2qimhXAyl1hMV3ESpZOJVxPqMSoQO8+hSlXbLPsC
MWk88fnm2YdRTU4RKVbmCrfjvrFO6Rvx1/3AaJQ7gFJdbmLUCOm3LUc=

si4csbc69/NYQqm9X1VdLcgPf2nkfDgi8C4JDKji3UWoNISFA8UzuNvk65Hfm9ZNaBXK5E/sE7Bg
CuvNiTKDlyg9u0iJwKqboWoSTvSvQrLcADBtqD0wl0K1y8mF1Dra0CInPIMC/x0tJSpDs6vwSKSR
5d6yIgH6YNjBXx1Lqvc=

AQAB

Don’t have a digital signature yet? Order now!

TRUST2GO® Qualified

Enveloping Signature:

FJw+7uwssGSno6pC01roT5pCrOE=

Me4KrnkhFFP6+1wcw0r54UMS4sn0pyCgLWKJbEMEIvQw9NJ0Jrw/QfRegg0AcHvuYidCS5dDnLm2
vXM5TQFhzsW2PtpBWKG4cdX9D/HYjve4rhdgkH/z9ATqIJEtF1bARL3J46xm93NcnNOHb1vY8m9D
YHUrkPjrmnwirfLm2Wg=

MIIFCzCCA/OgAwIBAgICAPAwDQYJKoZIhvcNAQEFBQAwgcwxCzAJBgNVBAYTAkFUMRAwDgYDVQQI
EwdBdXN0cmlhMQ8wDQYDVQQHEwZWaWVubmExOjA4BgNVBAoTMUFSR0UgREFURU4gLSBBdXN0cmlh
biBTb2NpZXR5IGZvciBEYXRhIFByb3RlY3Rpb24xJTAjBgNVBAsTHEEtQ0VSVCBDZXJ0aWZpY2F0
aW9uIFNlcnZpY2UxGDAWBgNVBAMTD0EtQ0VSVCBBRFZBTkNFRDEdMBsGCSqGSIb3DQEJARYOaW5m
b0BhLWNlcnQuYXQwHhcNMDUwOTA2MDAwMDAwWhcNMDcwOTA2MTM0NjMzWjCBgTELMAkGA1UEBhMC
QVQxCjAIBgNVBAgTAS0xDTALBgNVBAcTBFdpZW4xCjAIBgNVBAoTAS0xLDAqBgNVBAMTI0Rhbmll
bCBXZWxsZXIsIE5FVUFVU1NURUxMVU5HKFRlc3QpMR0wGwYJKoZIhvcNAQkBFg5kLndAZnJlZW5l
dC5hdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsi4csbc69/NYQqm9X1VdLcgPf2nkfDgi
8C4JDKji3UWoNISFA8UzuNvk65Hfm9ZNaBXK5E/sE7BgCuvNiTKDlyg9u0iJwKqboWoSTvSvQrLc
ADBtqD0wl0K1y8mF1Dra0CInPIMC/x0tJSpDs6vwSKSR5d6yIgH6YNjBXx1LqvcCAwEAAaOCAcIw
ggG+MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFC51MRVwN//xQPfZQO0ZhW1sgA5LMB8GA1UdIwQY
MBaAFDd/Pj6ZcWDKJNSRE3nQdCm0qCTYMBkGA1UdEQQSMBCBDmQud0BmcmVlbmV0LmF0MC8GA1Ud
EgQoMCaBDmluZm9AYS1jZXJ0LmF0hhRodHRwOi8vd3d3LmEtY2VydC5hdDA5BgNVHR8EMjAwMC6g
LKAqhihodHRwOi8vd3d3LmEtY2VydC5hdC9zdGF0aWMvYWR2YW5jZWQuY3JsMA4GA1UdDwEB/wQE
AwIE8DARBglghkgBhvhCAQEEBAMCBPAwUQYDVR0gBEowSDBGBggqKAAYAQEBAzA6MDgGCCsGAQUF
BwIBFixodHRwOi8vd3d3LmEtY2VydC5hdC9jZXJ0aWZpY2F0ZS1wb2xpY3kuaHRtbDA7BglghkgB
hvhCAQgELhYsaHR0cDovL3d3dy5hLWNlcnQuYXQvY2VydGlmaWNhdGUtcG9saWN5Lmh0bWwwNAYJ
YIZIAYb4QgENBCcWJUEtQ0VSVCBBRFZBTkNFRCBDZXJ0aWZpY2F0aW9uIFNlcnZpY2UwDQYJKoZI
hvcNAQEFBQADggEBAI7lW+WJbVm6E3qwY0w9F21LjKI3nf19NxWg9jmHN8vwfLsWnwatW3cBpxQO
4jAfxl8xqpX36e3QGXOiDPnYOJ3blmcOxZ3sNL15s+Iq6P9DPyLv/7L0La2FRh4gfWGEbh15BEfh
S65VdxR+LTr9prIt1FSTpl2qIO/nIs+6ouN6TQ6B2JUAeXXaMuQGxM7LNL4XcWVveOaC3oem+Ym7
c2omf3Sge5nRj6Eg7KYh5VCvy6Dhvk8AT25f2qimhXAyl1hMV3ESpZOJVxPqMSoQO8+hSlXbLPsC
MWk88fnm2YdRTU4RKVbmCrfjvrFO6Rvx1/3AaJQ7gFJdbmLUCOm3LUc=

si4csbc69/NYQqm9X1VdLcgPf2nkfDgi8C4JDKji3UWoNISFA8UzuNvk65Hfm9ZNaBXK5E/sE7Bg
CuvNiTKDlyg9u0iJwKqboWoSTvSvQrLcADBtqD0wl0K1y8mF1Dra0CInPIMC/x0tJSpDs6vwSKSR
5d6yIgH6YNjBXx1Lqvc=

AQAB

Daniel
Weller

The big difference between these two formats is that for the enveloped signature the reference is URI=”” – meaning it refers to the entire document (excluding the content of the signature tag), while for the enveloping signature the reference is URI=”# 5pg5d8xpho” is. So this reference refers to the same document, specifically to the element with the id “5pg5d8xpho”. This element is the object element in which the data to be signed is packaged.
So these reference tags make it possible to determine exactly what the signature refers to: whole XML documents, parts of XML documents, non-XML data.
It is also possible to sign a section of an XML file defined using an XPath expression – the possibilities are virtually endless.

Detached Signature

YHkJTgkmev7VDyv1/Iiqm6RMRYk=

bdGQ7KXzwCESRRMW49Wd+Fg3LPpzs7KKjGwQfnr0EYMVqku75HaLoxjtssGzwAylvemQEkIiEhIO
szZeH/LeM97e4knNwNSXN4Wor2djqQFQOsMJQt4x9vW+9i+uPVlXF1jOMPDS2TSsgoQWTZog9+h4
/veQvi10H6LVxp+XHIM=

MIIFCzCCA/OgAwIBAgICAPAwDQYJKoZIhvcNAQEFBQAwgcwxCzAJBgNVBAYTAkFUMRAwDgYDVQQI
EwdBdXN0cmlhMQ8wDQYDVQQHEwZWaWVubmExOjA4BgNVBAoTMUFSR0UgREFURU4gLSBBdXN0cmlh
biBTb2NpZXR5IGZvciBEYXRhIFByb3RlY3Rpb24xJTAjBgNVBAsTHEEtQ0VSVCBDZXJ0aWZpY2F0
aW9uIFNlcnZpY2UxGDAWBgNVBAMTD0EtQ0VSVCBBRFZBTkNFRDEdMBsGCSqGSIb3DQEJARYOaW5m
b0BhLWNlcnQuYXQwHhcNMDUwOTA2MDAwMDAwWhcNMDcwOTA2MTM0NjMzWjCBgTELMAkGA1UEBhMC
QVQxCjAIBgNVBAgTAS0xDTALBgNVBAcTBFdpZW4xCjAIBgNVBAoTAS0xLDAqBgNVBAMTI0Rhbmll
bCBXZWxsZXIsIE5FVUFVU1NURUxMVU5HKFRlc3QpMR0wGwYJKoZIhvcNAQkBFg5kLndAZnJlZW5l
dC5hdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsi4csbc69/NYQqm9X1VdLcgPf2nkfDgi
8C4JDKji3UWoNISFA8UzuNvk65Hfm9ZNaBXK5E/sE7BgCuvNiTKDlyg9u0iJwKqboWoSTvSvQrLc
ADBtqD0wl0K1y8mF1Dra0CInPIMC/x0tJSpDs6vwSKSR5d6yIgH6YNjBXx1LqvcCAwEAAaOCAcIw
ggG+MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFC51MRVwN//xQPfZQO0ZhW1sgA5LMB8GA1UdIwQY
MBaAFDd/Pj6ZcWDKJNSRE3nQdCm0qCTYMBkGA1UdEQQSMBCBDmQud0BmcmVlbmV0LmF0MC8GA1Ud
EgQoMCaBDmluZm9AYS1jZXJ0LmF0hhRodHRwOi8vd3d3LmEtY2VydC5hdDA5BgNVHR8EMjAwMC6g
LKAqhihodHRwOi8vd3d3LmEtY2VydC5hdC9zdGF0aWMvYWR2YW5jZWQuY3JsMA4GA1UdDwEB/wQE
AwIE8DARBglghkgBhvhCAQEEBAMCBPAwUQYDVR0gBEowSDBGBggqKAAYAQEBAzA6MDgGCCsGAQUF
BwIBFixodHRwOi8vd3d3LmEtY2VydC5hdC9jZXJ0aWZpY2F0ZS1wb2xpY3kuaHRtbDA7BglghkgB
hvhCAQgELhYsaHR0cDovL3d3dy5hLWNlcnQuYXQvY2VydGlmaWNhdGUtcG9saWN5Lmh0bWwwNAYJ
YIZIAYb4QgENBCcWJUEtQ0VSVCBBRFZBTkNFRCBDZXJ0aWZpY2F0aW9uIFNlcnZpY2UwDQYJKoZI
hvcNAQEFBQADggEBAI7lW+WJbVm6E3qwY0w9F21LjKI3nf19NxWg9jmHN8vwfLsWnwatW3cBpxQO
4jAfxl8xqpX36e3QGXOiDPnYOJ3blmcOxZ3sNL15s+Iq6P9DPyLv/7L0La2FRh4gfWGEbh15BEfh
S65VdxR+LTr9prIt1FSTpl2qIO/nIs+6ouN6TQ6B2JUAeXXaMuQGxM7LNL4XcWVveOaC3oem+Ym7
c2omf3Sge5nRj6Eg7KYh5VCvy6Dhvk8AT25f2qimhXAyl1hMV3ESpZOJVxPqMSoQO8+hSlXbLPsC
MWk88fnm2YdRTU4RKVbmCrfjvrFO6Rvx1/3AaJQ7gFJdbmLUCOm3LUc=

si4csbc69/NYQqm9X1VdLcgPf2nkfDgi8C4JDKji3UWoNISFA8UzuNvk65Hfm9ZNaBXK5E/sE7Bg
CuvNiTKDlyg9u0iJwKqboWoSTvSvQrLcADBtqD0wl0K1y8mF1Dra0CInPIMC/x0tJSpDs6vwSKSR
5d6yIgH6YNjBXx1Lqvc=

AQAB

The Detached Signature listed signs the same document as the previous examples, only this time the XML data to be signed is included via the Reference URI file:///home/gast/test2.xml – they are therefore in a different file. It is therefore obvious that when using detached signatures, the data to be signed is stored in such a way that it can always be reached via the same URI – otherwise the signature loses its validity.

XML-Addon for qualified Signatures(XAdES)

Qualified XML signatures use the extension (XAdES) in different variants to represent the qualification properties.

What are the costs of not going paperless?

02. August 2023

QES & Competition Law – European Commission to require electronic signatures from 1st September, 2023

11. July 2023

Sign and encrypt emails using an Apple iPhone

12. May 2023

Using the Certificate Revocation List (CRL)

Admin Admin — Tue, 11 Apr 2023 14:57:50 +0000

What is a Certificate Revocation List (CRL)?

The Certificate Revocation List is a file containing revoked certificates issued by a specific root or intermediate certificate. The revocation of the underlying intermediate or issuer certificates is announced in a CRL for the root certificate. (so-called Certificate Authority Certificate Revocation List – CARL) the revocation of the end user certificate is documented in a CRL for an issuer certificate.

Revoked certificates that have already expired can be removed from the CRL – standard-compliant software no longer allows a valid signature (verification) with them. If expired certificates are retained in the CRL, this fact is indicated by the CRL extension expiredCertsOnCrl (OID: 2.5.29.60).

Where the CRL can be obtained from is entered in the individual certificates. This is the X509v3 extension CRL Distribution Point, typically with an http URL to a .crl file.

The CRL files are re-published by GLOBALTRUST whenever a change has been made (i.e. another certificate has been revoked) or when the validity period of the CRL has expired. This guarantees that the CRL is always up to date.

How are CRLs to be interpreted?

A certificate entered in the CRL loses its validity at the time of entry. The signer may no longer use the certificate. However, invoices or documents signed up to this point remain valid. Individual programs sometimes bring misleading messages here, claiming “The signature is invalid because the certificate has been revoked.” However, these messages are not RFC5280 compliant. Correctly working products should therefore be used for sensitive applications.

Which point in time is used?

The time of the certification body is binding. To synchronize the time, GLOBALTRUST also offers the time stamp service GLOBALTRUST QUALIFIED TIMESTAMP, which guarantees that an electronic signature was made at a specific point in time.

Order your Globaltrust Qualified Timestamp now

Order now

CRL Extension for Revocation Reasons

RFC5280 offers the possibility to enter the reason for the certificate revocation in the reasonCode extension for informational purposes. This is intended to allow software vendors to react differently to revoked certificates depending on the severity – for example, the revocation reason cessationOfOperation allows an end user to override a mere warning; in the case of a key compromise (key compromise), a “hard fail” inevitably follows. The mechanism was taken up relatively late and is currently still under development, for example in the area of web browser manufacturers.

Can a revocation be undone?

It is possible to enter a certificate in a CRL from the outset with the reason code “certificateHold”. This has the effect that the entry can be subsequently removed from the CRL. Usually one does not speak of revocation, but of suspension. If no decision is made within 10 days of the suspension being entered, the suspension automatically turns into a final revocation.

The suspension is particularly suitable as a precautionary measure if, for example, a key compromise is suspected – a signature creation unit that was thought lost could be found again, etc.

What must the user of the CRL pay attention to?

Basically, the CRL is automatically requested by the certificate store management and managed locally by the user. Usually, the updated CRL files are automatically requested and updated only after the validity date specified in the CRL has expired. This can mean that a user mistakenly interprets a signed document as correctly signed, even though it is signed with an expired certificate that does not yet contain its local CRL.

To prevent this situation, some certificate administrations offer to update the CRL with every signature verification, while others require the CRL to be updated manually. Other certificate administrations expect you to delete the locally stored CRL and these certificate administrations then automatically retrieve the new CRL. Which variant, the certificate management, your application (your program) uses must be taken from the documentation and cannot be supported by GLOBALTRUST (if in doubt, contact the manufacturer directly). In all cases, however, a connection to the Internet is required.

Due to the wide distribution, GLOBALTRUST has compiled the CRL information from Microsoft Support for Microsoft Windows (see below). No guarantee can be given for the correctness and validity of your computer installation.

Certificate Revocation List (CRL) on Microsoft Windows

In principle, a new CRL is only downloaded from Microsoft operating systems if the validity period entered in the existing CRL has expired or if there is no CRL at all.

Under Microsoft, CRLs are stored in 3 different locations:

in the main memory of the computer,
in the Microsoft certificate store and
in “Temporary Internet Files”

In order to remove CRLs from the “temporary Internet files”, they must be completely deleted using Microsoft Internet Explorer.

In order to remove existing CRLs and force an update of the CRL, Microsoft offers extensive information on CRL management in an article (http://www.microsoft.com/technet/prodtechnol/winxppro/support/tshtcrl.mspx#EDAA). This article also contains a VisualBasic Script to remove outdated CRL’s. Further questions on the administration of CRLs should be queried directly from Microsoft support.

In order to remove CRLs from main memory, a restart of the application that uses the CRL or a restart of the operating system is required.
CRLs can be removed from the Microsoft certificate store with the Microsoft Management Console mmc.exe using the Certificates snap-in.
Start → Run → mmc → Console → Add/Remove Snap-In → Add → Certificates → Add → My User Account → Finish → Close → OK
CRLs that are entered in the certificate list can then be deleted. We recommend saving the console settings.

What are the costs of not going paperless?

02. August 2023

QES & Competition Law – European Commission to require electronic signatures from 1st September, 2023

11. July 2023

Sign and encrypt emails using an Apple iPhone

12. May 2023

Mozilla Thunderbird – Install certificate, how to sign, Encrypt e-mails, LDAP directory service V1.2

Admin Admin — Thu, 06 Apr 2023 12:58:57 +0000

Inhaltsverzeichnis

1 Basics

1.1 Purpose of this document

The purpose of this document is to provide a step-by-step tutorial on how to install certificates in Mozilla Thunderbird, sign e-mails and to encrypt them and how to receive signed and encrypted mails which you can decrypt later on. You can download this manual as a PDF here: http://www.globaltrust.eu/thunderbird-anleitung-en.pdf

1.2 Definitions and abbreviations

S/MIME:

– Standard for signing and encryption for e-mails.

-LDAP:

– abbreviation for „Lightweight Directory Access Protocol“ and gives you the opportunity to connect to a directory service over an IP network (e.g. internet). The directory could be a contact directory, like in this tutorial.

2 Short version

Install certificate:

– Download the root certificate from: https://www.globaltrust.eu

– Import the crt fie in the certificate manage of Thunderbird under the tab „certification bodies“

– Import the personal certificate under the tab “Your certificates” (ð 3.1.3 Installation certificates for signing p7)

– Choose the certificate for signing in the account settings under the category S/MIME safety.

→ Done

Sign e-mails:

– Create new e-mail.

– Choose S/MIME in the menu bar and then “sign message”. Afterwards, a sealed envelope symbol will appear in the right bottom corner.

→ Done

Encrypt e-mails:

– Open the certificate manager, go to the tab “Persons” and import the certificate of the recipient.

– Create new e-mail, decide S/MIME in the menu bar and then “Encrypt message”. Afterwards, a lock symbol will appear in the right bottom corner.

→ Done

Receive signed/encrypted e-mails:

– Open e-mail with double click.

– At the top right you can see the sealed envelope and, if the message was also encrypted, the lock. By clicking on one of the icons, the details of the signer and the signer’s certificate can be retrieved.

→ Done

LDAP installation short version

Open the address book and after that under “New” you can find the option “LDAP Directory” which you choose.

Insert the server data (without the quotation marks):

– Name: „GLOBALTRUST“

– Server address: „ldap.globaltrust.eu“

– Basis-DN: „c=at“

– Port-Number: „389“

Select “GLOBALTRUST” in the address book on the left side, and now you can search in the right top corner.

→ Done

3 Detailed documentation certificate management

3.1 Installation of certificates

Purchase suitable S/MIME certificates:

– purchase GLOBALTRUST CLIENT https://order.globaltrust.eu/php/formservice.php?form=order_signature_en&st=CLI
– info GLOBALTRUST COMPANY: https://globaltrust.eu/en/company/
– note: for encrypted e-mail communication, both sender and recipient need a suitable key (certificate)

3.1.1 Import Globaltrust Root-CA certificate

Legend:

– Open http://www.globaltrust.eu/certificate-policy.html

– In the sections „GLOBALTRUST Root CA 2006“, „GLOBALTRUST Root CA 2015“ and „GLOBALTRUST Root CA 2020“ click on the download links for the “DER-format” and save the file.

Direct links of the GLOBALTRUST Root-CA certificates:

3.1.2 Open Thunderbird options

→ Extras → Settings → Advanced → Certificates → Certificates → Certification bodies → Import

→ Open

→ tick all boxes → OK

Open window: → Certificate Manager → Settings close it

The GLOBALTRUST Root-CA certificate is installed.

3.1.3 Install certificates for signing

3.1.3.1 Import Software-certificates

Software-certificate + key can be used because of the import of the PKCS#12 file.

→ Extras → Settings → Advanced → Certificates → Certificates → Your Certificates → Import → Choose directory (here C:\temp) → Choose file type PKCS12 ð Pick the suiting PKCS#12-file (here Filename: mein-software-zertifikat.p12) → Open

→ Password entry dialog → Password: your chosen PKCS#12-Password → OK

Your software certificate + key is now installed!

3.1.3.2 Import E-Token certificate Safenet (Previously Aladdin)

Certificates on external devices (Smartcards, eToken) can be used with a PKCS#11 interface. The module for that PKCS#11 interface needs to be imported to Thunderbird.

→ Extras → Settings → Advanced → Certificates → Cryptography modules → Load

→ Rename to a suiting Module name, Recommendation: SafeNet eToken PKCS#11 Module → Search

→ C:\Windows\System32 → choose the eTPKCS11.dll file → Open

Safenet-E-Token is now prepared for signing/encrypting!

3.2 Set up certificates for signing

→ Extras → Account Settings

→ Choose user account, example: hanxxxx@xxxx.at → S/MIME-Safety →Choose (certificate for signing) + Choose (Hint for the certificate to encrypt! Here you have to choose the receiver certificate, not your own one because otherwise the receiver will not be able to decrypt the e-mail!)

Optional: → choose to Sign messages digitally, so it will be signed always

3.2.1 Create message and send signed

→ Create

→ S/MIME → Sign message

→ send → there will pop up a window where you have to put in the E-Token password (only with an E-Token certificate), otherwise it will ask you for the password of the software certificate

3.3 Encrypt e-Mail

3.3.1 Import receiver certificate

“Open” → OK → OK → done

3.3.2 Create new mail + encrypt

Choose “create” in the main window

Hint I:

“Encrypt message“ is only available, if the receiver certificate is already installed (here: test@testdomain.test).

Hint II:

The Message can be signed also, but the key and the certificate of the e-mail sender have to be installed.

Hint III:

The subject of the e-mail is not being encrypted!

3.4 Receive signed/Encrypted e-mails

3.4.1 Open received e-mail

– After double-clicking the received e-mail, there should be the two symbols in the right top corner (lock and sealed envelope) that’s how you can see if the mail is signed and encrypted.

3.4.2 Check signature

– Clicking on the symbols opens the details for signing and encryption. If you click on „View signature certificate“ you can see the details from that certificate.

– You can close the window by clicking the OK button.

3.4.3 Show certificate details

Legend:

After checking the certificate, you can close the window with the “close” button. → Done!

4 Mozilla Thunderbird LDAP Address book

GLOBALTRUST provides its customers with an LDAP directory. All certificates issued by GLOBALTRUST can be found in this directory. This makes it possible to send encrypted emails to anyone with a GLOBALTRUST certificate. It is also possible to integrate this directory into the Mozilla Thunderbird address book.

4.1 Detailed documentation LDAP

4.1.1 Open Address book

– Click on “address book” in the main window

– Click on File → New → LDAP-directory…

4.1.2 Fill in server details

Legend:

_– Enter the information for the directory in the new appeared window.

– Name: „GLOBALTRUST“

– Server address: „ldap.globaltrust.eu“

– Base-DN: „c=at“

– Port-Number: „389“

When filled in all data, click on “OK”.

4.1.3 Search for entries

_– Choose the fitting address book on the left side. Here “GLOBALTRUST”.

_– On the right top searching bar, you can look for the desired name/e-mail address. In the list below, you can select the right entry. → Done!

You could also like…

QES & Competition Law – European Commission to require electronic signatures from 1st September, 2023

11. July 2023

On letters, stamping and (e-)seals

10. May 2023

On letters, stamping and (e-)seals Still stamping or already sealing? Fully automated and at the highest security level? If no, you should think about it: You can use the electronic seal as a digitization turbo and make it the central game changer of your organization. Did you know that there are administrative...

Encryption and digital signature of e-mails: free of charge for new UPC-customers

08. May 2023

Cyber attacks on companies and public authorities usually begin unspectacularly - with an e-mail. Malware is used to introduce computer viruses into the IT system with the aim of extorting a ransom or committing industrial espionage or data theft. Employees are often not to blame, as phishing attacks are becoming...

Verify your company in the EPREL database

31. January 2023

How can we get in touch with you?



Contact our team: +43 1 532 0 944

Our employees are available for an obligation-free consultation.

Availability: Mon-Fri 9:00-17:00

Verify your company in the EPREL database

Administrator — Tue, 31 Jan 2023 13:20:02 +0000

The European Product Energy Labelling Database (EPREL) requires the use of qualified electronic seals to ensure the authenticity of uploaded information. Since February 2022, suppliers have to digitally verify their identity on the EPREL platform using electronic sealing technology. The European Commission specifically requires the use of Qualified Electronic Seals due to their effectiveness in meeting verification requirements. By obtaining a Qualified Electronic Seal, organisations can not only comply with the legal obligations related to EPREL, but also securely establish their business presence in other use cases.

Click here to place your order – get your EPREL seal now!

purchase now

Evolution of energy labels and the European Product Energy Labelling Database (EPREL)

Energy labels have a long history, first introduced in the European Union in 1994 for selected household appliances. Over time, these labels have evolved into a mature framework. As technology advances, the EU is committed to keeping pace. As a result, the European energy label has led to the creation of an online product database known as EPREL (European Product Database for Energy Labelling). Suppliers are required to upload specific information to this database in order to generate the mandatory energy label for their products.

EPREL: Empowering Consumers and Suppliers Alike

The purpose of EPREL is twofold. Firstly, suppliers must upload the necessary technical documentation to comply with Regulation (EU) 2017/1369. Secondly, the public section of the database allows consumers to access key information about the products, such as energy efficiency, dimensions, warranty details, annual consumption and more, simply by scanning the QR code on the energy label.

Mandatory EPREL registration for various product groups as of 2019

Since 1 January 2019, EPREL registration is mandatory for various product groups, including air conditioners, household cooking appliances, household dishwashers, space and water heaters, light bulbs and lamps, local space heaters, household refrigerators and freezers, professional refrigeration, refrigeration with direct sales function, solid fuel boilers, electronic displays including televisions, tumble dryers, residential ventilation units, household washing machines and tyres.

To register products in EPREL, organisations must first register on the platform. However, from February 2022, the EPREL platform will require suppliers (as legal entities) to digitally verify their identity. This verification process is based on electronic seal technology. Electronic seals, similar to electronic signatures, are categorised into three types: Basic Electronic Seal, Advanced Electronic Seal and Qualified Electronic Seal. For EPREL registration, the European Commission requires a Qualified Electronic Seal because of its ability to effectively ensure the authenticity of uploaded information.

Enhance your digital security with our full range of trust services

In addition to being mandatory for EPREL registration, qualified electronic seals have wider applications beyond the database – digital seals replace a company stamp and are widely used for various purposes, including e-invoicing, certificates, quotations and the digitisation of incoming mail, where they ensure the integrity and authenticity of electronic documents, protecting businesses and customers alike. Qualified electronic seals are also used to secure sensitive documents and transactions in industries such as finance, healthcare and legal. As a Qualified Trust Service Provider, we offer a comprehensive range of trust services to meet the diverse needs of organisations. Our offering extends beyond qualified seals to include electronic signatures, time stamps, S/MIME and codesigning, SSL and other Certificates Services. By leveraging our full stack of trust services, organisations can strengthen their digital security posture, improve regulatory compliance, and create a trusted digital environment for their customers and partners. organisations to digitally seal their documents with.

Boost Your Document Security with EPREL-Compliant Digital Seals!

Order your EPREL compliant seal today and benefit from:

Affordable Solution
Easy Application
Global Delivery: Available in 100+ countries,
Quick delivery within 1-2 business days
No Additional Hardware Needed: Easy implementation without extra equipment

Click here to place your order – get your EPREL seal now!

purchase now

How can we get in touch with you?



Contact our team: +43 1 532 0 944

Our employees are available for an obligation-free consultation.

Availability: Mon-Fri 9:00-17:00

You could also like…

QES & Competition Law – European Commission to require electronic signatures from 1st September, 2023

11. July 2023

Sign MS-Office documents using a UPC token

30. May 2023

Sign and encrypt with the UPC token in Outlook

11. May 2023

GLOBALTRUST UPC-Token

admin — Sat, 14 Jan 2023 12:00:23 +0000

Inhaltsverzeichnis

UPC token (ACS) – Installation and Use

Used Token:

ACS CryptoMate EVO

1 End user installation UPC token on Windows

Please note that the software can only be installed and used on Windows. The software is not compatible with Linux or MacOS.

Since complications often occur with emulations on Windows 10 and Windows 11, we cannot guarantee this.

1.1 Download and unpack UPC token software

Download-Link

https://service.globaltrust.eu/static/upc-token.zip
Copy the file to a suitable folder on your computer, e.g. C:\download
Unpack the file upc-token.zip

Note

Do NOT plug in the token before having successfully installed the UPC-Token software. Otherwise, the necessary drivers of the ACOS5-EVO- PKI Kit are NOT correctly populated under Windows.

2 Installation requirements

The installation is started via autorun.exe as administrator. Only in this case it is ensured the software is installed including all necessary drivers for all users.

1.2 How to install the User Package

run autorun.exe (double click) → as administrator (double click) →

Install ACOS5-EVO PKI Kit User Package →

Note

Depending on your system, the start might take several minutes

Answer yes to question about “Allow installation”

Tick the box “I accept the terms in the Licence Agreement” ✔

Choose a folder for the installation

Our recommendation:
Do NOT change the installation directory.

Install →

Note
The installation process may take a few minutes

Finish →

4 Repair ACOS5-EVO PKI Kit User Package

After successful installation, you can plug in your UPC token. The token must light up green continuously. If the UPC token is only flashing green or the EVO Certificate Manager cannot be called up correctly, follow the steps below. Do NOT unplug the UPC Token.

Note

You can skip this step if you have not had any complications in the course of installation.

Run autorun.exe as administrator

(right click) → “run as administrator” →

Repair →

Choose “Do not close applications. A reboot will be required.”

OK →

Finish →

Yes →

Note
You should restart your computer as soon as possible

1.3 Important Informationen

After the installation, you will find the following important information that you or your IT administrator will need[1]:

ACS user documentation (English)
– C:\Program Files (x86)\Advanced Card Systems Ltd\ACS ACOS5-EVO PKI Kit – User\Documentation\USR-ACOS5-EVO_PKI_Kit_User_Manual_(Windows)-1.01.pdf

Token management tool
– C:\Program Files (x86)\Advanced Card Systems Ltd\ACS ACOS5-EVO PKI Kit – User\EVO Certificate Manager\EVO-CM.exe

Note
The token management tool EVO-CM.exe should also appear as a link on the desktop.

File names of the Token PKCS#11 interface

32bit: C:\Windows\System32\acos5evopkcs11.dll
64bit: C:\Windows\SysWOW64\acos5evopkcs11.dll

Note 1
The UPC token supports Windows-CAPI and is therefore automatically recognised by numerous Windows programs.

Note 2
With the help of the PKCS#11 interface of the token, you can integrate the UPC token in many other programs and use the certificate on it for many applications. Depending on the type of program, it may be necessary to use the 32bit or 64bit version. This or third party documentations provide information for the use of it.

Note 3
If you are already using tokens or smart cards from other providers, conflicts may arise in individual cases. In such cases, we recommend that you only connect the token or smart card that you actually need.

1.4 Token Management Tool EVO-CM (“EVO Certificate Manager”)

Note
Normally, you do not need the EVO-CM administration tool. However, it can be useful if you need support from GLOBALTRUST.

Start EVO-CM.exe →

You can log in to the UPC token with the TransportPIN you assigned when you placed your order. If you no longer know the TransportPIN, please contact us.

Caution

You only have 7 tries to type the right PIN, after that your UPC token is locked and you have to send the token to us so we can unlock it. (subject to a charge)

Log-in →

Enter User PIN (== TransportPIN from your order)

Log-in →

After logging in, you can change your PIN (“Change PIN”) you may optionally rename your token (“Rename”).

Recommendation 1
If you choose to change your PIN do not lose it. As mentioned above, after 7 tries your token gets locked and you have to send the token back to us, so we can unlock it. (chargeable)

Recommendation 2
The name of the UPC token is per default our reference number, which internally documents the issuance of the token, You can change the name of the token, but you should keep the reference number for future reference to GLOBALTRUST. This speeds up the support process.

Note 1
If you use different tokens on your pc, you will get this message in the app “Invalid Card” _. But you can ignore it because the program can only read its on tokens.

Note 2
Never delete any certificates from the token, otherwise the token will become unusable.

3 Show Certificate under Windows

Prerequisites

UPC-Token must be plugged in

Go to „Internet Options” →

Internet Options →

Tab „Content” →

Button Certificates → Personal Certificates →

Your certificate MUST be displayed in the tab “Personal certificates”

Troubleshooting

We have been observing the following phenonema during our tests:

[1] The token is not shown in the tab “Personal certificates”

→ 4 Repair ACOS5-EVO PKI Kit User Package

[2] The UPC token flashes green instead of glowing continuously:
→ 4 Repair ACOS5-EVO PKI Kit User Package

[3] Gemalto Classic Client is installed:

Please check if you have the Gemalto Classic Client installed. If the Gemalto Classic Client is installed on your PC, the UPC token will not work on the Unified Patent Court website. Please uninstall this software before attempting to log in to the UPC website.

[4] If you have Kaspersky’s antivirus program installed, you must uninstall it (disabling will do nothing) or whitelist the UPC token or root certificate. Please contact Kaspersky support for more information.

3 Use of the UPC token

These brief instructions is optimised for use as an access key to the UPC. However, the UPC token with a GLOBALTRUST certificate allows you countless other uses, please note:

The ACS documentation
Documentation of third-party software that offers certificates with HSM or token support
For further applications we are happy to advise you

3.1 Use for UPC

The European Patent Court requires authentication by a hardware token certificate for login to its website. The UPC token we provide meets exactly this requirement.

Before you can use the login of the European Patent Court, you therefore need a correctly configured browser:

→ 2 Authentication via UPC token – Browser Chrome

→ 3 Authentication via UPC token – Browser Mozilla-Firefox

After successful browser configuration, you can test the login process via the website of the Patent Court.

Test website UPC

https://auth-secure.unified-patent-court.org/test-smart-card

Note
The following sequence is described for the Chrome browser, for other browsers the sequence and appearance may be different.

You will be asked which certificate you want to present for authentication. The UPC token contains only one certificate, but you may be using other certificates for other purposes, so you must select the correct certificate.

The certificate contains the following information:

Issued from: CN=GLOBALTRUST 2020 AATL 1,O=e-commerce monitoring GmbH,C=AT
saved on: [The token name: the serial number of the UPC token (reference number after delivery) or the name you previously chose when renaming the token]

OK →

You will be prompted to enter the UserPIN of the UPC token. If you have not changed it, this is the TransportPIN according to your order.

If the test is successful, you will receive the following message (with your personal identification data):

Error message if the authentication does not work:

Trouble shooting

In the course of our extensive testing, we found the following issues:

[1] Sometimes the website is not available and shows a 505-error message → try again later

[2] Sometimes the browser does not respond anymore

→ Clear your cache,
→ Close the browser,
→ Open the UPC website only

[3] Sometimes the shown screen differs completely from the above screenshot

→ there is a transmission error, just reload the page

[4] Gemalto Classic Client is installed:

[5] If you have Kaspersky’s antivirus program installed, you must uninstall it (disabling will do nothing) or whitelist the UPC token or root certificate. Please contact Kaspersky support for more information.

Example test page not displayed correctly

2.2 Authentication via UPC token – Browser Chrome

Requirements

the UPC token must be plugged in
the installation (→ 2 Install UPC token User Package) must be completed (restart of the computer required)

Chrome uses Microsoft Windows certificate management directly and does not require any specific configuration of the UPC token.

However, it is advisable to check whether the certificate of the UPC token has actually been correctly recognised before using it for the first time.

Start Chrome → chrome://settings/security →

Alternatively: Start Chrome → → Settings → Privacy and security → Security →

Manage device certificates →

All certificates installed on your computer are shown.

The certificate contains following details:

Issued from: CN=GLOBALTRUST 2020 AATL 1,O=e-commerce monitoring GmbH,C=AT

Select this certificate →

Below “certificate intended purposes” you can find: Client Authentication
You can also view more details about the certificate

Anzeigen →

Under → Details you will find the information about yourself that is presented to the “remote computer” in the course of each authentication.

Trouble shooting

If your token is NOT recognised, follow these steps:

[1] Check whether the token is actually plugged into a USB port (the UPC token should light up green).

[2] Check whether your computer recognises the intended USB interface (you can do this easily by plugging in a USB drive as a test).

[3] Sometimes USB interfaces lose the connected devices: simply disconnect and reconnect them (the UPC token should light up green).

[4] Check with your system administrator whether your computer allows USB devices at all (some company networks have disabled the use of USB devices, in which case your administrator must enable the interface).

[5] Remove all USB devices that are not immediately necessary.

[6] Check if you have installed the UPC token User Package → 2 Install UPC token User Package.

[7] Restart your computer

[8] Contact your IT manager regarding other possible incompatibilities.

[9] Try configuring the UPC token on another device.

[10] Use the token management tool EVO-CM.exe to check if the UPC token is displayed.

[11] Gemalto Classic Client is installed: Please check if you have the Gemalto Classic Client installed. If the Gemalto Classic Client is installed on your PC, the UPC token will not work on the Unified Patent Court website. Please uninstall this software before attempting to log in to the UPC website.

[12] If you have Kaspersky’s antivirus program installed, you must uninstall it (disabling will do nothing) or whitelist the UPC token or root certificate. Please contact Kaspersky support for more information.

2.3 Authentication via UPC token – Browser Mozilla-Firefox

Requirements

the UPC token must be plugged in
the installation (→ 2 Install UPC token User Package) must be completed (restart of the computer required)

Start Mozilla Firefox → Extras →

Settings →

Privacy & Security → scroll all the way down to the bottom of the page →

Security Devices… →

Depending on earlier installations, already installed cardreader and token will be shown.

Load →

Modul Name: Enter a suitable name for your module, we recommend “UPC token”

Module filename: the file name of the PKCS#11 interface must be specified here. Depending on the installation of your browser 32bit or 64bit version:

32bit: C:\Windows\System32\acos5evopkcs11.dll
64bit: C:\Windows\SysWOW64\acos5evopkcs11.dll

OK →

If the UPC token is found, you will see an entry similar to the one above. Your personal token is displayed with the assigned token name (by default this is an 18-digit reference number).

Select your personal token →

You can now use the Mozilla Firefox token manager.

Trouble shooting

It may happen that your token is NOT recognised during the Mozilla Firefox installation. Take the following steps:

[1] Check whether the token is actually plugged into a USB port (the UPC token should light up green).

[2] Check whether your computer recognises the intended USB interface (you can do this easily by plugging in a USB drive as a test).

[3] Sometimes USB interfaces lose the connected devices: simply unplug and plug in (the UPC token should light up green).

[5] Check whether you have selected the correct interface file.

[6] Remove all USB devices that are not immediately required.

[7] Restart Mozilla Firefox and clear all cache files (History → Clear Recent History → All → OK →).

[8] Check if you have installed the UPC token User Package → 2 Install UPC token User Package.

[9] Restart your computer

[10] Contact your IT manager regarding other possible incompatibilities.

[11] Update your Mozilla Firefox browser.

[12] Try configuring the UPC token on another device.

[13] Use the token management tool EVO-CM.exe to check if the UPC token is displayed.

[14] Gemalto Classic Client is installed: Please check if you have the Gemalto Classic Client installed. If the Gemalto Classic Client is installed on your PC, the UPC token will not work on the Unified Patent Court website. Please uninstall this software before attempting to log in to the UPC website.

[15] If you have Kaspersky’s antivirus program installed, you must uninstall it (disabling will do nothing) or whitelist the UPC token or root certificate. Please contact Kaspersky support for more information.

When contacting GLOBALTRUST support, please have the reference number and the screenshot of the token management tool EVO-CM.exe ready. Furthermore, describe which of the above steps you have taken and with what result.

2.4 Signing via UPC-Token – Adobe Acrobat Reader DC

Der UPC token wird nach Installation des 2 UPC token User Package installieren in Adobe ohne weitere Konfigurationsmaßnahmen erkannt.

Signatur erstellen

gewünschte Datei mit Adobe Acrobat Reader DC öffnen →

Tools →

Certificates →

Digitally sign → place the signing block at the desired position →

Select certificate from UPC token

Note
If you have several certificates, you can find out which certificate is the correct one by clicking on “Show details”.

Continue →

Select desired appearance → Sign → choose destination folder+ choose filename →

type in your token PIN → Login →

Note
This advanced signature is displayed as trustworthy by Adobe readers worldwide. However, it is NOT a qualified signature. In normal business life, this form of signature is sufficient. However, where a qualified signature is mandatory (e.g. for entries at the UPC), please use the second certificate supplied in the UPC bundle. To do this, use the e-Sign Agent (→ separate documentation: https://service.globaltrust.eu/static/trust2go-benutzer-en.pdf).

You could also like…

QES & Competition Law – European Commission to require electronic signatures from 1st September, 2023

11. July 2023

On letters, stamping and (e-)seals

10. May 2023

Encryption and digital signature of e-mails: free of charge for new UPC-customers

08. May 2023

Verify your company in the EPREL database

31. January 2023

How can we get in touch with you?



Contact our team: +43 1 532 0 944

Our employees are available for an obligation-free consultation.

Availability: Mon-Fri 9:00-17:00

Certificate authentication for traders in the European electricity market

Administrator — Tue, 02 Aug 2022 08:21:02 +0000

Companies that cooperate with international energy suppliers on the European electricity and gas market need certificates for reliable identification for their traders and all employees involved in energy trading. GLOBALTRUST is listed with the relevant platforms and provides a suitable tool for the mandatory identity certificates.

The European Energy Market: JAO, OKTE and Consorts

The liberalisation of the energy markets since the end of the 1990s has not only led to energy customers being able to freely choose their local or supraregional suppliers. European energy exchanges and capacity platforms have also emerged, on and with which electricity and gas are traded and distributed across national borders. In our neighbouring countries, for example, these are the Hungarian RBP and FGSZ, the Slovenian ELES, the Czech CEPS or the Slovak DAMAS Energy, OKTE and the Dutch JAO.

Energy trading: Login only for verified traders and employees

The principle of supply and demand prevails on the international electricity and gas markets and the interaction between trading exchanges, settlement agencies and energy supply companies is strictly regulated: Strict professional and technical requirements apply to trading in energy products and access to the electronic trading exchanges is only open to authorised companies.

In addition, all traders and participants – from senior traders to back office contacts and commercial representatives – only have access to the trading systems if they can identify themselves beyond doubt. They need certificates for their reliable identification. For example, the auction rules of the electronic Capacity Auction Tool (eCAT) stipulate that authentication can only be done using a client certificate from a provider on the EU Trusted List.

GLOBALTRUST AUTHENTICATION: Certificates for the European energy market

Trust is good, verifiable trust is better – GLOBALTRUST AUTHENTICATION guarantees the effective identification of persons and prevents unauthorised logins, identity manipulation and Internet fraud.

GLOBALTRUST AUTHENTICATION is trusted by critical infrastructures and renowned energy trading platforms throughout Europe. Contact us if you as an energy service provider need to ensure the authentication of your employees. We will be happy to inform you in more detail about the system integration, the customised setting thanks to hardware and platform independence and the interesting conditions.

What are the costs of not going paperless?

02. August 2023

QES & Competition Law – European Commission to require electronic signatures from 1st September, 2023

11. July 2023

On letters, stamping and (e-)seals

10. May 2023

5 good reasons for implementing qualified electronic signatures

Administrator — Mon, 01 Aug 2022 13:21:42 +0000

“Do we really need electronic signatures? What a waste!” It still sounds like this and similar in many companies when it comes to the topic of e-signatures. Does this sound familiar, or are the advantages of digital signatures already known in your company? Read here what the e-signature – or more precisely, the qualified e-signature – can also bring to your company. And in this context, learn more about our qualified cloud signature TRUST2GO®.

Purchase your qualified signatures TRUST2GO®

Buy

In the years of the COVID-19 pandemic, many companies came closer to the paperless office and digitized the sending and receiving of documents, including contract management. The only obstacle – and thus annoying media disruption – often remained the legally binding signature.
In times of home offices and lockdowns, the need to integrate also the signing in to the digital workflow increased. A process that was frequently put on the back burner out of fear of the effort involved. However, system integration is just as simple as the application itself: The effort is therefore manageable, the benefits far greater, and secure tools for this have long been available. The advantages are obvious:

Advantage 1: cost savings

Most companies ignore the costs that are associated with conventional signatures. This starts with the cost of paper, printing, and postage for transporting signed documents and ends with their storage or the space required for this and a security concept for archiving. – The costs of introducing digital signatures can pay for themselves within a very short time.

Advantage 2: time savings

Electronic signatures are workflow accelerators: If documents can be delivered digitally and immediately, employees save themselves the trouble of printing them out. Rescanning becomes redundant, days of postal mailing are eliminated, and the cycle time for business processes is significantly shorter.

Advantage 3: workflow optimization

Electronic documents can be distributed more easily and processed more effectively. Contracts signed with e-signatures do not have to be physically on hand to be legally valid – a major advantage for companies operating internationally or with multiple locations.

Advantage 5: complete digital transformation

You may know it yourself: Digitization is already well advanced, but the legally valid e-signature as the last important building block for streamlining business and contract processes is missing. Digital document management only works with e-signatures!

Advantage 5: legal certainty

A qualified electronic signature uniquely links the signer to the signature and secures the document against subsequent changes. Our e-signature solution TRUST2GO® meets the strict requirements of the EU eIDAS Regulation. It is therefore not only absolutely legally secure throughout the EU, but also meets the highest compliance requirements: The signature on sensitive files and documents has the same legal effect as a handwritten signature and remains protected in your hand at all times.

TRUST2GO® makes electronic signing so natural and easy that your employees won’t want to work any other way. We will be happy to advise you in more detail about your individual options. Contact us now for a free consultation.

Knowledge | Global Trust

What are the costs of not going paperless?

Click here to place your order – get your Cloud QES now!

Annual printing expenses: a significant impact

Wet ink signatures – the last show stopper for digitization?

Substantial savings with e-signatures

Paperless contracts: a crucial building block of modern process rationalization

Get your electronic signature in 3 steps

Click here to place your order – get your Cloud QES now!

How can we get in touch with you?

Contact our team: +43 1 532 0 944

You could also like…

GLOBALTRUST QUALIFIED TIMESTAMP – qualified time stamp according to eIDAS-VO for audit-proof document management

Why GLOBALTRUST QUALIFIED TIMESTAMP?

What can’t a timestamp do?

Internationally recognized standard

How does the qualified timestamp work?

GLOBALTRUST archives issued time stamps

Conditions

Accuracy of GLOBALTRUST QUALIFIED TIMESTAMP

Who can use GLOBALTRUST QUALIFIED TIMESTAMP?

What do you need to use it?

Automated timestamp services and bulk timestamps

Which hash algorithms are supported?

Which usage variants are supported?

Issue TIMESTAMP using TCP/IP port: timestamp.globaltrust.eu port 10318

Issue TIMESTAMP using HTTPS (Port 443 + 11080)

Issue TIMESTAMP using HTTPS (Port 10080)

Issue TIMESTAMP using HTTPS (port 13080)

Developer information

TCP/IP access to GLOBALTRUST QUALIFIED TIMESTAMP Server

Basic process

Access to GLOBALTRUST QUALIFIED TIMESTAMP Server with TCP/IP

Creation of a timestamp request in Java

You might be interested in that

Creation of a PKCS12 file from a certificate with or without a key

Create PKCS12 file from private key and new certificate

Process:

Create certificate without private key in PKCS12 format

Generation using openssl:

Content control:

You might be interested in that

Digital signature for XML documents (XML signature) including XaDES

XML – DSig – XaDES

XML default information

“DSig” is the W3C XML default signature

Don’t have a digital signature yet? Order now!

Enveloping Signature:

Detached Signature

XML-Addon for qualified Signatures(XAdES)

You might be interested in that

Using the Certificate Revocation List (CRL)

What is a Certificate Revocation List (CRL)?

How are CRLs to be interpreted?

Which point in time is used?

Order your Globaltrust Qualified Timestamp now

CRL Extension for Revocation Reasons

Can a revocation be undone?

What must the user of the CRL pay attention to?

Certificate Revocation List (CRL) on Microsoft Windows

You might be interested in that

Mozilla Thunderbird – Install certificate, how to sign, Encrypt e-mails, LDAP directory service V1.2

1 Basics

1.1 Purpose of this document

1.2 Definitions and abbreviations

2 Short version

3 Detailed documentation certificate management

3.1 Installation of certificates

3.1.1 Import Globaltrust Root-CA certificate

3.1.2 Open Thunderbird options

3.1.3 Install certificates for signing

3.1.3.1 Import Software-certificates

3.1.3.2 Import E-Token certificate Safenet (Previously Aladdin)

3.2 Set up certificates for signing

3.2.1 Create message and send signed

3.3 Encrypt e-Mail

3.3.1 Import receiver certificate

3.3.2 Create new mail + encrypt

3.4 Receive signed/Encrypted e-mails

3.4.1 Open received e-mail