Digital Signing guidelines - NatWest

7. Hardware Security Module
Customers opting for a Hardware Security Module (HSM) solution should look to have this device installed and
part-configured* ahead of submitting the Bankline Direct registration mandate.
Bankline Direct certificates will be supplied as part of service registration process and are chargeable with a lifespan of
three years. Please refer to your Relationship Manager or Implementation Manager for more details.
*pre-configuration of Bankline Direct transmissions security (as outlined in section 5) cannot be completed until
the details have been supplied.
7.1 HSM Requirements
The Bankline Direct service requires HSMs to conform to the FIPS 140-2, Level 2 standard. Please consult your
HSM supplier for more information.
7.2 HSM Setup
During the registration process, the customer will receive a letter and a form from NatWest containing details on
how to generate a Certificate Request.
The Certificate Request must be generated from the HSM module and copied to a CD. The CD must be posted to
NatWest (details outlined in the letter). Once the Certificate Request has been received by NatWest,
a customer specific Certificate will be generated by TrustAssured (who are the NatWest certificate authority).
The customer specific Certificate will be emailed in a zip file back to the requester for uploading into the HSM
module. The following details will be sent to the customer:
Production root.cer
Production Sub CA.cer (This is the issue certificate of the Certificate Authority that signed the customer’s
Certificate Signing Request)
.cer (this is the uploaded into the HSM)
7.3 Integration
The HSM module must be configured to apply a digital certificate to payment files to an S/MIME standard.
The following S/MIME file signing options must be enabled:
the message syntax can be PKCS7 or CMS
the algorithm must be SHA-1
the signature can be detached (original data not included) or embedded (original data included)
the Content Transfer Encoding can be None or Base64
23
The signing certificate can be included but it is not used. The customer’s public certificate(s) will already have
been registered on Bankline Direct as part of the registration process.