Release 2.7 Information

Overview

Release 2.7 introduces support for cross-border STIR/SHAKEN in accordance with ATIS-1000087.v002.

This update standardizes how STIR/SHAKEN participants access trust-related artifacts and adds support for STI-PA root certificate rollover.

As part of this release:

• The new Cross-Border Trust List (CBTL), the Certificate Revocation Lists (CRLs), and the Trusted CA Lists now use standardized public URLs.
• Authentication and URL whitelisting of verification artifacts are no longer required.
• Existing URLs remain supported during the transition period but are now deprecated.
• A new CBTL workflow supports verification of PASSporTs issued outside the United States.
• Support to rollover STI-PA root certificates.

Standardized URLs

The APIs for obtaining the Trusted CA List, Certificate Revocation List, and new Cross-Border Trust List have been modified and standardized such that all participants - STI-CAs, Service Provider, RespOrgs, and Relying Parties will access the same URLs.

The new URL formats are as follows:

Cross-Border Trust List (CBTL)    

• CBTL Endpoint:
      https://authenticate-api.iconectiv.com/api/v1/cbtl
• CBTL Signing Certificate Download:
      https://authenticate-api.iconectiv.com/download/v1/external/certificate/cbtlCert_<certId>_20311209.pem

Certificate Revocation List (CRL)   

•  CRL Endpoint:
      https://authenticate-api.iconectiv.com/download/v1/crl/20311209
•  CRL Signing Certificate Download:
      https://authenticate-api.iconectiv.com/download/v1/external/certificate/crlCert_<certId>_20311209.crt

Trusted CA List  

• CA List Endpoint:
      https://authenticate-api.iconectiv.com/api/v1/ca-list/20311209
• CA List Signing Certificate Download:
      https://authenticate-api.iconectiv.com/download/v1/external/certificate/ca-listCert_<certId>_20311209.crt

STI-PA Root Certificate Rollover

When the STI-PA root certificate rollover occurs:

• New STI-PA signing certificates will be issued by the new root certificate.
• The URLs for the CRL, Trusted CA List, and all signing certificates will be updated.
• The entries in the CBTL will be updated to include the new root certificate, CRL URL and Trusted CA List URL.
• GUI Support and Download Lists pages will automatically point to the new artifacts.

Backward Compatibility

Artifacts associated with the previous root certificate will remain valid until the old root certificate expires.

Cross-Border Trust List:

The Cross-Border Trust List (CBTL) supports verification of PASSporTs (Personal Assertion Tokens) generated by jurdictions outside of the United States, as defined in ATIS-1000087.v002.    

All Service Providers and Relying Parties should update their verification flows to follow ATIS-1000087.v002 Section 4.3.
        
CBTL URL:
https://authenticate-api.iconectiv.com/api/v1/cbtl

1. Download the CBTL.
2. Verify the CBTL using the certificate from the URL in the CBTL x5u field.
3. Obtain the PASSporT signing certificate using the PASSporT x5u field.
4. Match the CRL Distribution Point extension in the PASSporT signing certificate to the corresponding CBTL entry.
5. Use the matching CBTL entry to determine the Trusted CA List URL and CRL URL.

Certificate Revocation List:
STI-CAs should use the new CRL URL in newly issued intermediate certificates for the CRL Distribution Points extension. This URL will be returned to Service Providers and RespOrgs in responses to SCP Token requests and used by STI-CAs in the issued end-entity certificates.

        New CRL URL:
        https://authenticate-api.iconectiv.com/download/v1/crl/20311209

        Deprecated Endpoint:
        https://authenticate-api.iconectiv.com/download/v1/crl

        The CRL URL will change over time when the root certificate rolls over and CBTL will be updated accordingly.
        STI-CAs will be notified of the change and the previous URL will become deprecated.

Trusted CA List:
Participants should use the CA List URL obtained from the appropriate CBTL entry.
        
        New Trust CA List URL:
        https://authenticate-api-dev.iconectiv.com/api/v1/ca-list/20311209
        
        Deprecated Endpoint:
        https://authenticate-api.iconectiv.com/api/v1/ca-list

The Trusted CA List URL will change over time when the root certificate rolls over and the CBTL will be updated accordingly. 
All parties will be notified of the change and the previous URL will become deprecated.

Download Lists Web Page

The links for all artifacts on the download-lists web page (https://authenticatereg.iconectiv.com/download-lists) have changed to use the new standardized URLs. All STIR/SHAKEN participants should use these URLs.

The old links using the authenticate-ext-api.iconectiv.com domain are deprecated. The URLs associated with this domain will still be available, but they will be removed in the future. All parties will be notified prior to removal.

Summary of Required Actions

• Service Providers and Relying Parties: For those planning on supporting ATIS 1000087.v002, update verification flow for CBTL support.  (The release is backward compatible so those service providers and relying parties not planning on supporting ATIS 1000087.v002 do not have to make this change.)
• STI-CAs: Use new CRL URL in issued intermediate certificates
• All Participants: Transition to standardized public URLs
• All Participants: Prepare for future root certificate rollover events