BANCO CENTRAL DE BOLIVIA

ESTADO PLURINACIONAL DE BOLIVIA

EXTERNAL CIRCULAR

La Paz, June 19, 2017
SGDB N° 030/2017

FROM: GENERAL MANAGEMENT
FINANCIAL ENTITIES MANAGEMENT
TO: FINANCIAL ENTITIES PARTICIPATING IN THE INTEGRATED PAYMENT CLEARING SYSTEM (LIP) SUBJECT: GENERATION OF DIGITAL CERTIFICATES FOR THE PAYMENT SYSTEM

Ladies and Gentlemen:

The Central Bank of Bolivia (BCB) informs participants in the Integrated Payment Clearing System (LIP) that, in accordance with the procedures established in the Operational and IT Guide of the Integrated Payment Clearing System GOISLIP (v.1.0), to generate digital certificates that allow their operation in the LIP System, they must consider the characteristics described in the attached document.

For any inquiries, please contact the LIP Help Desk at Phones 2662154, 2661117, 2661623, 2661645, 2407262, 2147077 and/or email ayudalip@bcb.gob.bo.

Sincerely,

RONALD Q. PINTO RIBERA
Acting Manager of Financial Entities
BANCO CENTRAL DE BOLIVIA

ABEL F. SANJINÉS ÁLVAREZ
Acting General Manager
BANCO CENTRAL DE BOLIVIA

ASA/RPR/JDM/APM/CED/OAU/jkt
Attachment: As cited

Ayacucho Street corner Mercado · Phone: (591-2) 2409090 · Fax: (591-2) 2661590 www.bcb.gob.bo · bancocentraldebolivia@bcb.gob.bo · La Paz Bolivia

---

BANCO CENTRAL DE BOLIVIA

ESTADO PLURINACIONAL DE BOLIVIA

Characteristics that digital certificates must meet to operate in the LIP System

For the generation of digital certificates, the X.509 standard must be considered obligatorily in the following aspects: (these are not exhaustive)

1. Technical Characteristics

a. Public Key.- The public key algorithm at the time of its generation must be RSA and its length must be 2048 bits. b. Validity.- The validity of digital certificates must be 2 years.
c. Signature Algorithm.- At the time of its generation, the signature algorithm (signatureAlgorithm) "SHA256withRSA" must be used.

2. Data Format for the Subject

a. Certificates used for “web services”
i. Certificates for transactions
1. Subject: In the digital certificate, within the subject attributes, the fields that must be filled in obligatorily are Common Name (CN), Organization (O) and Country (C), according to the following format:
- a. Common Name (CN) Field. The “Common Name” field aims to identify the certificate owner; it must contain the name(s) of the legal representative(s) of the entity and the purpose of the certificate. For the LIP system, it must comply with the following format: CN= “Name(s) of the legal representative(s)” – LIP Transactions.
- b. Organization (O) Field. The “Organization” field aims to identify the organization to which the certificate holder belongs; it must include the name of the entity.
- c. Country (C) Field. The “Country” field aims to identify the country corresponding to the certificate and must contain the value "BO".
ii. Certificates for revocation
1. Subject: In the digital certificate, within the Subject attributes, the fields that must be filled in obligatorily are “Common Name (CN), Organization (O) and Country (C), according to the following format”:

3. Example of certificate generation with technical characteristics using java keytool.

---

BANCO CENTRAL DE BOLIVIA

ESTADO PLURINACIONAL DE BOLIVIA

a. Common Name (CN) Field. The “Common Name” field aims to identify the certificate owner; it must include the name(s) of the legal representative(s) of the entity and the purpose of the certificate. For the LIP system, it must comply with the following format: CN= “Name(s) of the legal representative(s)” – LIP Revocation. b. Organization (O) Field. The “Organization” field aims to identify the organization to which the certificate holder belongs; it must include the name of the entity.
c. Country (C) Field. The “Country” field aims to identify the country corresponding to the certificate and must contain the value "BO".

b. Certificates used by the web application.
i. Certificates for transactions.
1. Subject: In the digital certificate, within the Subject attributes, the fields that must be filled in obligatorily are “Common Name (CN), Organization (O) and Country (C), according to the following format”.
- a. Common Name (CN) Field. The “Common Name” field aims to identify the certificate owner; it must include the name(s) of the legal representative(s) of the entity and the purpose of the certificate. For the LIP system, it must comply with the following format: CN= “Name(s) of the legal representative(s)” – LIP Web Application Transactions.
- b. Organization (O) Field. The “Organization” field aims to identify the organization to which the certificate holder belongs; it must include the name of the entity.
- c. Country (C) Field. The “Country” field aims to identify the country corresponding to the certificate and must contain the value "BO".

3. Example of certificate generation with technical characteristics using java keytool.

---

BANCO CENTRAL DE BOLIVIA

ESTADO PLURINACIONAL DE BOLIVIA

keytool -genkey -alias¹ test -keyalg rsa -keysize 2048 -sigalg sha256withrsa -validity 730 -keystore test.jks²

4. Example of Values Generated in the Subject Field and Technical Characteristics

Web Services

Web Application

---

¹ The alias is defined by the participant at the time of generating the digital certificate. In the example, the alias name test is used; however, this must be chosen by the participant. ² The name of the file that will serve as the container is chosen by the participant. It is important to assign the “.jks” extension for identification.

JOSE S. DELGADO MACHISADO
Systems Manager
BANCO CENTRAL DE BOLIVIA