USER MANUAL. Malaysian Investment Development Authority. Handling Digital Certificate via 1CRS (PUBLIC USER ACCESS)

Transcription

1 USER MANUAL Handling Digital Certificate via 1CRS (PUBLIC USER ACCESS)

2 CONTENTS 1 Introduction System Overview Roles and Responsibility of Public User Certificate PIN and Challenge Response Security Measure Point of Contact Organization of Manual Minimum System Requirements Check Certificate Request New Certificate (via URL redirect) Resubmit Application (if MIDA AP has not satisfy with previous submission) Setup PIN and Challenge Response Sign Transaction using Roaming Certificate with Multi Factor Authentication; PIN and Challenge Response Reset PIN and Challenge Response (if user forgot their roaming certificate credentials) Appendices Sample Photocopy NRIC Sample Company Authorisation Letter for Certificate Request Sample Authorisation Letter for Revocation Request

3 GLOSSARY This glossary may contain context-specific technical terms, abbreviation or everyday concepts that have a special meaning in the given context. No. Terms Description 1. MIDA 2. CRL Certificate Revocation List 3. Signing A process where user performs digital signing on specified data 4. DSA 1997 Digital Signature Act DSR 1998 Digital Signature Regulation CPS Certificate Practise Statement. A declaration of the practices which a certification authority employs in issuing certificates generally, or employed in issuing a particular certificate. 7. SSL Secure Socket Layer 8. PKI Public Key Infrastructure 9. LDAP Lightweight Directory Access Protocol 10. Certification Authority (CA) Certification Authority is Digicert Sdn. Bhd. who guide on the digital certificate operation which controlled by MCMC 11. Registration Registration Personnel is a CA representative who assist in Personnel (RP) 12. Registration Officer (RO) 13. Authorised Personnel (AP) management of digital certificate Registration Officer is a CA representative which has higher authority than RP. RO assists in management of digital certificate and the decision maker for revocation of the certificate plus to secure user s certificate information. Authorized Personnel is a MIDA representative authorised by DIGICERT to perform identity verification and responsible to ensure the supporting documents provided are clear, no doubt and complete according to supporting document requirement by CA. 14. API Application Program Interface. The allowance and processes to give programs access to connect and essentially, communicate with other programs. Their APIs are their languages. 15. MIDA CRS MIDA Certificate Registration System 16. Soft Certificate X.509 Certificate which is stored in the common rewriteable media such as hard disk, diskette, thumb drive and CD 17. KMC Key Management Centre, a Managed PKI Service comprises the system infrastructure (hardware and network), and PKI software infrastructure for providing PKI security services and key management services to Subscribers. It is a centralized solution to facilitate the CA system. 18. Multi-Factor Authentication (MFA) a method for verifying the digital identity using at least two or more digital ID authentication/verification techniques or technologies CRS Certificate Registration/ Management System which used by 20. Consultant Company end user as well as appointed MIDA Authorised Personnel (AP) Company which has been authorised by MIDA to fill in the Tax Exemption Form on behalf of other company 3

4 1 Introduction 1.1 System Overview MIDA JPC online application has integrated with Digicert 1CRS system. Digicert is the Digital Certificate issuer. 1CRS is a Digital Certificate Registration and Management System that handles the full lifecycle of certificate. Both User and MIDA AP can access 1CRS system. However the access right are based on user s role. Major functions performed by the system are: User Functions include request new certificate, request renew certificate, reset PIN and Challenge Response, View Status, request revoke, change PIN, reset PIN, Update Challenge Response, and others. MIDA Authorized Personnel (AP) has additional functions apart from the above which are Verify Application (to verify Company User Certificate Request), Audit Trail, and Certificate Registration Report The main guide in this user manual is how to register digital certificate (roaming) via URL redirect from MIDA JPC Online application and perform digital signing during declaration in order to submit Tax Exemption form in MIDA JPC Online system. MIDA has upgraded its PKI Solution from using soft certificate to roaming certificate utilizing Digicert KMC Roaming Services. MIDA users will be able to achieve mobility by having the flexibility to access MIDA system at any computer, anywhere and anytime by leveraging the Roaming technology. What is roaming certificate? Roaming Certificate is a type of digital certificate that are not stored in the token, smart card or on a client computer (soft certificate). Roaming certificate is also a soft certificate type but it is stored at Digicert Secure CA Facility (Key Server) that allow user to access flexibly. This way, there will be no installation required at the user end. User s roaming certificate and private key are protected with dedicated hardware security module (HSM). All forms within MIDA JPC online have been integrated with Digicert KMC Roaming Services. JPC Online Forms PC1 - Import Duty And/ Or Sales Tax Exemption On Machinery And Equipment For Agriculture Sector PC2 - Import Duty And/ Or Sales Tax Exemption On Raw Materials And A Components For The Manufacture Of Finished Products PC2-1 - Import Duty And/ Or Sales Tax Exemption On Additional Quantities Of Raw Materials And Components For The Manufacture Of Finished Products 4

5 PC Services - Import Duty, And/ Or Sales Tax Exemption On Machinery, Equipment And Materials For Selected Services Sub-Sectors SPM1/ Surat Pengesahan MIDA (Manufacturing) 2015 SPM 2/ Surat Pengesahan MIDA (Hotel) Roles and Responsibility of Public User The following are the roles and responsibilities of the Digital Certificate User: Register Digital Certificate through 1CRS System Set Challenge Response and PIN during new certificate request Change or Reset Digital Certificate PIN regularly Update Challenge Response Questions whenever necessary Update User Profile whenever necessary Check Digital Certificate Request Status in 1CRS or notification Renew Certificate as early as 2 months before expiry Use roaming certificate for Tax Exemption Form submission 1.3 Certificate PIN and Challenge Response Security Measure User is strictly prohibited from sharing certificate PIN and challenge response answers with others User shall keep the account secure Do not reveal PIN and Challenge Response Answers to anyone Store it where anyone cannot find it Whoever found to disclose the PIN should face disciplinary act The link to set challenge response and PIN provided in the will expire in 30 days. Users are advised to setup PIN and Challenge Response immediately once received the notification For second certificate request onwards, user does not require to setup PIN and challenge response If user enters wrong PIN more than 3 times, system will block the certificate from doing any sign transaction. The user needs to Reset PIN and Challenge Response to unblock PIN The link to reset PIN and Challenge Response will expire in 1 hour. User has to request again if it has expired 5

6 1.4 Point of Contact Head Office: (MIDA) MIDA Sentral No. 5 Jalan Stesen Sentral 5 Kuala Lumpur Sentral Kuala Lumpur Malaysia admin@mida.gov.my Phone: Fax: Website: Organization of Manual To facilitate the user, major sections are organized based on process flow. Basically the process flow to register roaming certificate can be depicted as per below image. Step 1 Register Web Key and Check Certificate status Step 2 Register New Certificate via URL redirect Step 3 Step 4 MIDA Authorized Personnel (AP) verifies application Set Challenge Response and PIN via link in the 6

7 Major sections of the User s Manual (v0.1) and a brief description of content in each section are as following: Section 3 - Check Certificate Section 4 - Request New Certificate (via URL Redirect) Section 5 - Upload New Supporting Document if MIDA AP Has Not Satisfy with Previous Uploaded Supporting Document Section 6 - Set PIN and Challenge Response Section 7 - Sign Transaction using Roaming Certificate with Multi Factor Authentication; PIN and Challenge Response Section 8 - Reset PIN and Challenge Response (if user forgot their roaming certificate credentials) The following functions will be added in the next upgraded version of the user manual (v1.0): Section 9 - General Features Login Logout Forgot Password Change Password Manage Profile Section 10 - View Status Section 11 - Cert Management Reset PIN Change PIN Update Challenge Response Section 12 - Request Renew Certificate (via URL Redirect) Section 13 - Request Revocation Section 14 - Expiry Reminder 7

8 2 Minimum System Requirements Pre-requisite User has to register and get a web key to login to access each online form. User shall own a valid roaming certificate in order to submit the online forms Minimum system requirements for Users to access Certificate Registration/ Management System (1CRS): Item OS Recommended Screen Resolution Recommended Browser Suggested Platform Minimum PC Requirements Internet Software Description Windows XP Service Pack 3 Mac OS X Note: Windows XP Service Pack 3 supports automatic Entrust root certificate (G2) installation at cert store X 768 or higher Internet Explorer 10.0 Chrome Safari PC/ Laptop (Preferred) Mobile Processor : Intel Pentium 4 or equivalent processor 1G Hz or faster CPU required RAM: 1GB RAM or higher Broadband Speed: 1 Mbps speed or higher Data: 512 MB or higher None 8

9 3 Check Certificate There are 4 steps to check certificate: Step 1 Go to Step 2 Click on 'Click Here' hyperlink to register. System will redirect to Web Key Registration Form Step 3 Fill in Web Key Registration Form. Then click 'Register Web Key' button. System prompt successful message. Notice that system will display the registered form. 9

10 Step 4 Click on 'Check Cert' button. System will display your certificate status. System shall enable Register Certificate button if you do not have digital certificate. 10

11 4 Request New Certificate (via URL redirect) There are 8 steps to request new certificate via URL redirect from MIDA JPC Online application: Step 1 Click on 'Register Certificate' button. System will redirect to 1CRS > Request New Certificate Wizard. There are four steps to be completed by user; Personal Information, Company Information, Select Package and Document and Payment 11

12 Step 2 Fill in 'Personal Information' section. Then click on 'Next Step' button Note: Some field has been auto populated based on MIDA JPC Online application. Please confirm before proceed to next step. Step 3 Confirm 'Company Information' section and update if neccessary. Then click on 'Next Step' button Note: All fields has been auto populated based on MIDA JPC Online application. Please confirm before proceed to next step. 12

13 Step 4 System displays 'Package Details' for acknowledgement. Click 'Next Step'. Step 5 System proceed to 'Documet & Payment' section. At 'Supporting Document' table, click 'Browse' button to search for the file to upload NRIC/Passport and Company Authorization Letter. Note: There are 2 tables, Supporting Document table to upload NRIC/ Passsport and Company Authorization Letter. The other table is Payment' table to upload Payment Slip. Please refer the sample Photocopy NRIC (Section 9.1) and Company Authorisation Letter (Section 9.2) Please upload only PDF, JPEG and PNG file format. The file size must not exceed 1MB. 13

14 Step 6 At 'Payment' table, click 'Browse' button to search for the file to upload Payment Slip. Step 7 Click on 'Submit' button. System displays pop-up message to confirm submission.then click on 'OK' button. User will receive message notifying application has been accepted for processing as well as notification. 14

15 Step 8 Login to your account as per registered in 1CRS Personal Information. Check whether you have received the . Note: MIDA Authorized Personnel (AP) will verify your certificate request application by checking uploaded NRIC/Passport, Company Authorization Letter, Payment status and whether the information provided is true. In case of any doubt, MIDA AP will notify applicant via . The applicant has to upload new supporting document(s) again or make correction wherever necessary. 15

16 5 Resubmit Application (if MIDA AP has not satisfy with previous submission) There are 12 steps to resubmit application (only if MIDA AP need confirmation from applicant). Step 1 Login to your account as per registered in 1CRS Personal Information. Check the from MIDA AP about insufficient info. Step 2 Open the respective . MIDA AP remarks is in the middle of the content. Click on the provided link in the to update the required info. The link will direct user to 1CRS Login page. 16

17 Step 3 Enter username to login. Then click on 'Next' button. Step 4 Please make sure Security Image and Security Phrase are correct. Enter password then click on 'Login' button. Note: User will be directed to Need User Confirmation page. 17

18 Step 5 Click on icon at 'Action' column. There are four sections for user to confirm before resubmit application; Personal Details, Organization Details, Select Package, Supporting Document Step 6 Update the required info in 'Personal Details' section. Then click on 'Next' button. 18

19 Step 7 Update the required info in 'Organization Details' section. Then click on 'Next' button. Step 8 Confirm details in 'Select Package' section. Then click on 'Next' button. User will be directed to Supporting Document page 19

20 Step 9 Click on icon at 'Upload' column 20

21 Step 10 Delete the existing IC if you want to upload new copy of IC. Then click on 'OK' button to confirm. Close the window. Note: System only allow user to upload 1 copy of IC. Please refer Section 9.1 Sample Photocopy NRIC 21

22 Step 11 Click on 'Finish' button to resubmit application. User will receive an notifying certificate request confirmation has been successfully resubmitted for processing. 22

23 Step 12 Login to your account as per registered in 1CRS Personal Information. Check whether you have received the . Note: MIDA Authorized Personnel (AP) will verify your certificate request resubmission. Next step is you have to check your to set your roaming certificate credentials. Your roaming certificate credentials consist of Challenge Response Answers and PIN. This is known as Multifactor Authentication. It is a security mechanism that requires at least two types of credentials for authentication and is designed to provide an additional layer of validation, minimizing security breaches. 23

24 6 Setup PIN and Challenge Response There are 7 steps to setup PIN and Challenge Response. Step 1 Login to your account as per registered in 1CRS Personal Information. Check the . Step 2 Open the respective . Click on the provided link to setup your roaming certificate PIN and Challenge Response. The link will direct user to PIN and Challenge Response Setup page 24

25 Step 3 Setup PIN and Confirm PIN. System accept 8-16 aplhanumeric input only. Step 4 Set Challenge Response Questions and Answers. System does not allow same question to be repeated. Then click on 'Submit' button. A confirmation pop-up window will be displayed. 25

26 Step 5 Click on 'OK' button to confirm submission. User will receive an notifying certificate has been successfully created. Step 6 System prompts successfull message and notify user to wait for 5-10 minutes before using the certificate. Click on 'OK' button. 26

27 Step 7 Login to your account as per registered in 1CRS. Check whether you have received the . Note: You are now allowed to perform digital signing at MIDA JPC Online Declaration page. Declaration by user is required in order to submit Tax Exemption form in MIDA JPC Online system. 27

28 7 Sign Transaction using Roaming Certificate with Multi Factor Authentication; PIN and Challenge Response There are 4 steps to digital sign during form submission: If user has not logged in to respective Tax Exemption Form in MIDA JPC Online, please login first. Step 1 Go to Enter the web key in the login box. Then click on 'Login' button. JPC Online system will direct user to Application Details and Application Status page. 28

29 Step 2 At Application Status section, click on Data Entry hyperlink. JPC Online system will direct user to the respective form for data entry activity. Step 3 Fill in the form as required. Once complete, Click on 'Declaration' button to proceed with submission. JPC Online system will direct user to Declaration page. 29

30 Step 4 Fill in the required info. Once submission is good to go, click on 'Roaming Sign and Submit' button. Digital Signing pop up will be displayed. Step 5 Enter challenge resposne answer and PIN to submit and sign the transaction. Note: PIN attempt can t be more than 3 times. System will block the user certificate. User has to Reset PIN and Challenge Response to unblock the certificate. Refer Section 8 Reset PIN and Challenge Response. 30

31 Step 6 Click on 'OK' button to confirm digital signing transaction is done by you. 31

32 8 Reset PIN and Challenge Response (if user forgot their roaming certificate credentials) If 1CRS system blocks the user certificate due to more than 3 wrong PIN attempts then user has to Reset PIN and Challenge Response to unblock the certificate. There are 8 steps to Reset PIN and Challenge Response. Step 1 Click on 'here' hyperlink at PIN has been blocked message. System will direct user to verification page. 32

33 Step 2 Enter matching address as per registered in 1CRS account. Then click on 'Send Reset Link Now' button. Step 3 Click on 'OK' button to confirm reset PIN and Challenge Resposne request. 1CRS will the link to reset PIN and Challenge Response to the respective user . 33

34 Step 4 Login to your account as per registered in 1CRS. Check the respective . Click on the provided link in the . The link will direct user to Reset PIN and Challenge Response page 34

35 Step 5 Enter PIN and Confirm PIN. System accept 8-16 aplhanumeric input only. Step 6 Enter Challenge Response Questions and Answers. System does not allow same question to be repeated. Then click on 'Submit' button. A confirmation pop-up window will be displayed. 35

36 Step 7 Click on 'OK' button to confirm reset PIN and Challenge Response request. Step 8 System prompts successfull message and notify user to wait for 5-10 minutes before using the new PIN and Challenge Response. Click on 'OK' button. System will user that PIN and Challenge Response has been successfully updated. 36

37 Step 8 Login to your account as per registered in 1CRS. Check whether you have received the . 37

38 9 Appendices 9.1 Sample Photocopy NRIC Both sides of photocopy NRIC in one file is required for verification by MIDA Authorized Personnel (AP). 38

39 9.2 Sample Company Authorisation Letter for Certificate Request An authorisation letter from Company Board of Director or Higher Management is required to allow a representative of the organisation to submit digital certificate application. 39

40 9.3 Sample Authorisation Letter for Revocation Request An authorisation letter from Board of Director or Higher Management is required to allow a representative of the organisation to submit digital certificate revocation request. 40