Certificate

At the time of writing, Taksi Helsinki is handling the certificate renewal. (Note that this responsibility may shift to us in the future.)

After obtaining the new certificate and key, update the VAULT TMS-bookings configuration as follows:

"kela_takso": {
    "cert": "-----BEGIN CERTIFICATE-----MIII+zCC...",
    "client_id": "e7....",
    "client_secret": "8a....",
    "invoke_url": "https://kepo.kela.fi/esb/api/v2/gateway/invoke",
    "key": "-----BEGIN PRIVATE KEY-----MIIG/...",
    "root_ca": "-----BEGIN CERTIFICATE-----MIIF...",
    "takso_url": "https://luova3.kela.fi/taksoGateway/takso",
    "token_url": "https://kepo.kela.fi/authorize",
    "url": "https://luova3.kela.fi/taksoGateway/takso"
},

The Root CA has a long expiration date, so typically only the cert and key need updating.

Please note!: Cert and Key are in one-line format in the VAULT and need to be like that so that app can read them.

Once the certificates are updated in VAULT, upload them to tms-confidential-instance-stable-1/root/scripts/. Then, execute the following script located in the same directory:

upload_takso_cert_no_jq_fixed_v6.sh

#!/usr/bin/env bash

#-------------------------------------------------------------------
# Configuration
#-------------------------------------------------------------------
CONNECTION_URL="https://kepo.kela.fi"
CLIENT_ID="e7b75a4f"
CLIENT_SECRET="8a4881648ca62febc1234e78619d39c8"

# Paths to your mTLS certs & keys
CLIENT_CERT="kela-cert.crt"
CLIENT_KEY="kela-key.crt"
CA_BUNDLE="kela-root-ca.crt"

# The PEM file you want to upload
UPLOAD_PEM="kela-cert.crt"
MSG="test"

#-------------------------------------------------------------------
# 0) PEM → DER → base64 (no line wraps)
#-------------------------------------------------------------------
X509_B64=$(openssl x509 -in "${UPLOAD_PEM}" -outform der | base64 -w0)

# 1) Build JSON payload
JSON_PAYLOAD=$(printf '{"x509":"%s","msg":"%s"}' \
               "$X509_B64" "$MSG")
echo $JSON_PAYLOAD

#-------------------------------------------------------------------
# 1) Obtain OAuth2 access token via client_credentials grant, using mTLS
#-------------------------------------------------------------------
resp=$(curl -s -k \
    --cert "${CLIENT_CERT}" \
    --key "${CLIENT_KEY}" \
    --cacert "${CA_BUNDLE}" \
    -X POST "${CONNECTION_URL}/authorize" \
    -d "grant_type=client_credentials" \
    -d "client_id=${CLIENT_ID}" \
    -d "client_secret=${CLIENT_SECRET}")

# 2) Strip everything up to "access_token":"
#    Then strip everything after the next quote
ACCESS_TOKEN="${resp#*\"access_token\":\"}"
ACCESS_TOKEN="${ACCESS_TOKEN%%\"*}"

# 3) Sanity check
if [[ -z "$ACCESS_TOKEN" ]]; then
    echo "ERROR: Failed to retrieve access token." >&2
    exit 1
fi
echo "Acquired access token: $ACCESS_TOKEN"

#-------------------------------------------------------------------
# 2) Upload your certificate PEM to the KEPO registration API (raw body)
#-------------------------------------------------------------------
echo "Uploading certificate (${UPLOAD_PEM}) to KEPO…"
curl --silent --show-error \
    --cert "${CLIENT_CERT}" \
    --key "${CLIENT_KEY}" \
    --cacert "${CA_BUNDLE}" \
    -X POST "${CONNECTION_URL}/esb/registration/api/v2/account/certificates/upload" \
    -H "Authorization: Bearer ${ACCESS_TOKEN}" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json" \
    --data "$JSON_PAYLOAD"

After all this TMS-Booking application need to be restarted for it to reload configs from VAULT.