2. SSH key creation: SSH keys refer to a pair of cryptographic keys used for secure communication and authentication between the bank and SurePay's systems.

• 1. To generate the SSH Key, you will need to enter the following command into the command line:

$ ssh-keygen -P "" -t rsa -b 4096 -f bankname

• 2. When you generate an SSH key via the command line, the key pair is typically stored in your user's home directory within a hidden folder called .ssh. Inside this .ssh directory, you will find two files:

  • bankname : This is your private SSH key, and it should be kept secret and never shared.

  • bankname.pub: This is your public SSH key which you can share with us enabling access securely.

• 3. After being created, share the public key (bankname.pub) with us via MSafe in the designated folder.

2. Connect to the SFTP endpoint

1. We will provide you with the necessary items to perform the connection via MSafe:

• SFTP account credentials will be shared: username and password.
• You will receive a 4096-bit public GPG key for data encryption.
• We will provide the hostname and port details for the SFTP server.

2. To connect to our testing SFTP server using the command line, you need to follow these steps:

• 1. Open your terminal or command prompt on your local machine.
• 2. Use the 'sftp' command followed by the port using the '-P' option, the username and the SurePay's hostname:

sftp -P PORT_NUMBER username@sftp.surepay.com

• 3. As this is your first time connecting to the SurePay SFTP server, you need to accept the SurePay's host key. Type "yes" to accept it.
• 4. You'll then be prompted to enter your SFTP password (provided via MSafe). Enter the password associated with your SFTP account.
• 5. Once you're connected, you can navigate the SurePay server using SFTP commands. For example, you can use ls to list files on our remote server and get or put to transfer files between your local machine and SurePay.

3. Create GPG key for signing and metadata.json

1. Create GPG for signing key and upload it into the root folder.

• 1. GPG signing involves using the private key of the GPG key-pair to generate a digital signature for a file or a message. This signature provides a way to verify the authenticity and integrity of the data.
• 2. To generate the GPG Key, you will need to enter the following command into the command line. This command will create and export the key.

                %echo Generating a default key
                Key-Type: default
                Key-Usage: sign
                Key-Length: 4096
                Name-Real: signingkey.bankname.com
                Name-Email: operations@bankname.com
                Expire-Date: 2y
                Passphrase: xxxxxxxxxxxxxxxxxx
                %commit
                %echo done

                $ gpg --batch --gen-key config

                $ gpg --export -a "signingkey.bankname.com" > pkey.pem

• 3. When you generate a GPG key (pkey.pem) via the command line, the file containing the exported public key will be stored in the same directory from which you ran the command.
• 4. After created, upload this key (pkey.pem) into the root folder with the command put.

  Upload pkey.pem file to the root folder

  
  sftp> put pkey.pem
  
  

  CopyCopied!

2. Create metadata.json and upload it into the root folder.

• 1. To ensure that the customer receives a notification via email of the status of the data loaded into the SFTP connection, metadata.json is the medium to ensure so.
• 2. The metadata.json contains the following fields which have to be filled in with the customer's emails.

  Content of the metadata.json

  
      {
          "emailAddressSuccessfulLoad": "Your email",
          "emailAddressFailedLoad": "Your email"                    
      }
  
  

  CopyCopied!
• 3. This file should be generated and filled (adding the expected name and extension 'metadata.json'), upload this file into the root folder with the command put.

  Upload metadata file

  
  sftp> put metadata.json
  
  

  CopyCopied!

4. Create and encrypt a file with dummy data

• 1. Within the File Format section, you will find the layout and the required data fields that should be included by you in the .xml file.
• 2. The main data file should undergo both encryption and signing processes, adhering to the openPGP. To encrypt and sign the file, you will need to encrypt the file through the following command:

  Command line

  
  $ gpg --recipient 'encryption.endpoint.nl' --local-user 'signingkey.bankname.com' --encrypt --sign accounts
  
  

  CopyCopied!

• In the command example, you'll find the following values:

  • Replace 'signingkey.bankname.com' with the actual key.
    • --recipient 'encryption.endpoint.nl': This option specifies the recipient of the encrypted message or file. In this case, the recipient is identified as 'encryption.endpoint.nl,' which means the output will be encrypted for Surepay.
    • --local-user 'signingkey.bankname.com': This option specifies the local user's key to use for signing the message or file. The key identified as 'signingkey.bankname.com' has to be replace and will be used to sign the message.

5. Deliver the first file via SFTP with data

Depending on the environment you are connecting to, we will require different file to be uploaded:

• For test environment: A Dummy file with not production data added for us to analise the fields provided, the encryption and signing and the connection itself.

• For production environment (PRD): A file with production data.

• 1. To transfer the 'Accounts' file (account_bankname.pgp), use the command set on code snippet to add it from your local machine. And send a copy of the file not encrypted via email to service@surepay.nl.
• 2. Make sure that you are in the root folder before adding the file using the pwd command and use the command put followed by the file name:

sftp> pwd
Remote working directory: /data-provisioning/bankName
sftp> put account_bankname.pgp

• 2. We will verify whether the encryption and format of file is correct and if all accounts are loaded correctly into the system. Otherwise, we'll notify you if the load was not successful.

6. Celebrate! and next steps

Congratulations on the successful establishment of the offline data provisioning connection with SurePay! Your trust in us is greatly valued. If you have completed the connection to our test environment, you'll have to repeat the same steps for Production environment.

For those who have successfully established the connection in the PRD environment, here are the next steps:

1. We will actively monitor the received data for quality.
2. In the event that the data does not meet the required level of quality, we will provide support to help you achieve the expected data quality.
3. We will promptly notify you if the data provided has the necessary level of quality and when subsequent checks have been conducted against the data you've provided.