ECA instructions

ECA Certificate Guidance Obtaining, Installing, and Exporting ECA Certificates

A step-by-step guide to obtaining and installing ECA certificates for use with the USSOCOM SITEC published Bidder’s Library areas.

Table of Contents

Background

USSOCOM has established a Bidder’s Library workspace for those industry partners interested in pursuing potential opportunities on SITEC. In order to gain access to the SITEC site, potential users must request access and have an eligible DOD certificate for authentication.

To request access the offeror shall provide the name of one individual authorized to access the information on behalf of the contractor and the contractor’s Cage code to the SITEC Contracting Officer at contracting@socom.mil . Please include the words “SITEC Bidders Library Access Request” in the title.

For all users that do not currently have a Common Access Card (CAC), an alternative certificate may be obtained that will provide appropriate credentials to access information hosted in the SITEC Bidder’s Library. For potential users that already have a current CAC, skip to Section VIII for detailed instructions for exporting and saving credentials.

Note: There is an annual cost to obtain an External Certificate Authority (ECA) Certificate. The cost is approximately $100/year. This cost is the sole responsibility of the contractor and shall not be reimbursed by the Government. Do not initiate certificate procurement process until the SITEC Contracting Officer has verified/approved your eligibility for access.

External Certification Authority (ECA) Program:

The DoD has established the ECA program to support the issuance of DoD-approved certificates to industry partners and other external entities and organizations. The ECA program is designed to provide the mechanism for these entities to securely communicate with the DoD and authenticate to DoD Information Systems.

The DoD PKI Program Management Office (PMO) has designated the ECA External Liaison Officer (ELO) as the single point of contact to receive and coordinate all communications between the ECA community, DoD programs, and the DoD PKI PMO.

The DoD PKI PMO has approved three ECA vendors: (click hyperlink to view vendor-specific site):

· Operational Research Consultants, Inc. (ORC) (http://www.eca.orc.com/)

· VeriSign, Inc. (https://eca.verisign.com/)

· IdenTrust, Inc. (http://www.identrust.com/certificates/eca/index.html) While the remainder of this document covers the process of obtaining an ECA certificate using VeriSign, it is not to be considered an endorsement or recommendation for any single/specific vendor.

Verisign ECA Certificates VeriSign is certified by the United States Department of Defense (DoD) as a provider of PKI digital certificates for external entities (government contractors, state and local governments and individuals). ECA certificates enable secure on-line transactions with government agencies. Installed in a browser or email program, ECA certificates can be used for such activities as; authenticating identity for access to DoD Web sites and applications, digitally signing documents, and for encrypting e-mail communications.

VeriSign ECA certificates are sold as a set including both an ECA Identity certificate and an ECA Encryption certificate. A key escrow service protects and enables the recovery of a private encryption key in the event that a user loses the key and needs to access information previously encrypted with the key.

Who Can Purchase an ECA Certificate?

· Employees of organizations conducting business with U.S. government agencies.

· Employees of state and local governments conducting business with other U.S. government agencies.

· Employees of foreign governments or organizations conducting business with U.S. government agencies.

· Individuals who need to communicate securely with U.S. government agencies

Step-by-Step Overview

ECA certificates are specific to you and the computer you use. You need to complete the steps below using the browser on the computer where you will use ECA authentication and encryption services.

Enrollment Initiate a request for an ECA digital certificate by completing the enrollment process. You will be asked to provide identity information online, print and complete enrollment forms, have them notarized, and mail them to VeriSign.

VeriSign, Inc.

Attn: Enterprise Authentication Team M/S 3-2-1 487 E. Middlefield Road Mountain View, CA 94043 eca-authentication@verisign.com

NOTE: New regulations require proof of citizenship prior to obtaining a certificate from the VeriSign ECA. At least one of the two forms of identification provided must be a government issued photo ID. To use auto-enrollment for renewals, users will need to have validated citizenship information in place.

On the system where you will be installing the certificate, open your web browser and go to the following page: https://eca2048.verisign.com/enrollintro.htm and follow these instructions:

Step 1. Enroll for your ECA Certificate.

a. Select the appropriate enrollment method. If you are able to appear before a Trusted Agent for your organization, select Subscriber Enrollment using Trusted Agent. Otherwise, select Subscriber Enrollment using Notary. What is a Trusted Agent?

Note: If you are a U.S. citizen located outside the United States, you must select the Subscriber Enrollment using Notary method and use the notary services at a U.S. consular office. If you are a non-U.S. citizen residing outside of the United States, you must select the Subscriber Enrollment using Trusted Agent method and use the services of a DOD employee authorized to process ECA certificate enrollments in your country.

b. Enter your subscriber enrollment information.

Note: The Organization name that you enter must match the legal name found in official records.

c. Enter payment information. This is typically a credit card for individuals and a Sales Order Number for enterprise members.

d. Choose a challenge password.

e. Submit your order to VeriSign.

Step 2. Prepare your ECA Certificate request to be notarized.

a. Print the Subscriber Enrollment Form and review the "Subscriber Information" section to ensure that the information you entered is correct.

Note: Do not sign the form yet. You will need to sign it in the presence of a notary, Trusted Agent, U.S. consular officer, or authorized DOD employee.

b. Click the Continue button to complete your enrollment.

c. If you select Subscriber Enrollment Form using Notary as your enrollment method, bring the Subscriber Enrollment Form to your organizational representative (for example, your Human Resources Department) to complete and sign the "Subscriber's Organizational Contact" section. Note the following:

· The organizational representative must work for the same organization as you and cannot be you.

· If you enter "Unaffiliated" for your Organization when completing the ECA Certificate Subscriber Information section, skip this step.

d. If you select Subscriber Enrollment Form using Trusted Agent as your enrollment method, your Trusted Agent is your organizational representative, and the "Subscriber's Organizational Contact" section does not appear on the Subscriber Enrollment Form. If your organizational representative has not provided a DUNS number or your company does not have a DUNS number, you must provide other appropriate proof of organization information to VeriSign along with your Subscriber Enrollment Form.

Click here for information about proof of organization.

Step 3. Bring the Subscriber Enrollment Form to your notary or Trusted Agent.

a. Provide the following forms of identification to the notary, Trusted Agent, U.S. consular officer, or authorized DoD employee:

· One government-issued photo ID for proof of identity, such as a driver's license, passport, or military ID.

· One document for proof of citizenship, such as a passport, certified birth certificate, or certificate of naturalization or citizenship. What documents provide proof of citizenship?

· One document for proof of organizational affiliation (if any), such as a valid employee ID that must include a photograph and identify organizational affiliation. What if I don't have an employee ID?

b. In the presence of the notary, Trusted Agent, U.S. consular officer, or authorized DOD employee, sign your name in the "Subscriber Information" section.

Note: You are responsible for any fees that may be charged by the notary.

c. Ask the notary to read the instructions and complete the acknowledgement.

Step 4. Mail the enrollment documentation.

Send the following documentation to the appropriate location:

· The completed original notarized copy of the Subscriber Enrollment Form.

· The Proof of Organization documentation (if required).

Attention: Enterprise Authentication Team M/S 3-2-1 487 East Middlefield Road Mountain View, California 94043

Note: If you have selected the notary enrollment method because you are not able to appear before your organization's designated Trusted Agent, you may still choose to send your documentation to your Trusted Agent.

Step 5. Await your ECA Certificate approval email.

When VeriSign completes authenticating and processing your ECA Certificate request, you will receive an email with instructions for picking up your ECA Identity and Encryption Certificates. If your ECA Certificate request is not approved, VeriSign will notify you, and you will not be billed.

Install Certificate Authorities (CAs)

Digital certificates are verified using a chain of trust. The trust anchor for the ECA digital certificate is the ECA Root Certificate Authority (CA). The next link in the trust chain is the VeriSign ECA CA. You need to install both to verify VeriSign-issued ECA certificates. Use the links below or the ones from the step-by-step page: http://www.verisign.com/authentication/government-authentication/dod-interoperability/step-by-step/index.html Install CAs Using Internet Explorer Open the browser on the computer where you need to install the certificates. You will download two certificates and they will automatically install in your system.

Install the ECA Root CA Certificate

1. Download ECA Root CA Certificate To download 2048 bit CA certificate, click Download 2048 bit ECA Root CA Certificate.

2. You will see a window entitled "File Download" with a warning. Click Open.

3. In the window titled "Certificate," click Install Certificate.

4. The Certificate Import Wizard window will appear. Click Next in this window and the next one, and then click Finish.

5. You will see a dialog box with the message "The import was successful," Click OK in this dialog box and OK again to close the "Certificate" window.

Install the VeriSign ECA CA Certificate

1. Download VeriSign ECA CA Certificate.

To download 2048 bit CA certificate, click Download 2048 bit VeriSign ECA CA Certificate.

2. You will see a window entitled "File Download" with a warning. Click Open in this window.

3. You will now see a window entitled "Certificate", click Install Certificate.

4. The Certificate Import Wizard window will appear. Click Next in this window and the next one, and then click Finish.

5. You will see a dialog box with the message "The import was successful", Click OK in this dialog box and OK again to close the "Certificate" window.

Install CAs Using Other Browsers Open the browser on the computer where you need to install the certificates. You will download two certificates and they will automatically install in your system. The following link provides directions to install the CAs using other browsers:

· Install CAs Using Netscape - Mozilla Firefox - Mozilla

Retrieving Your ECA Certificate

Your ECA certificates are bundled as a set: one used for signing and authentication and the other for encryption. You will receive an email from VeriSign containing your PIN and a pickup URL for your ECA digital certificates. Be sure to pick up both certificates.

Your approved ECA Certificate pair includes the ECA Identity and Encryption Certificates. An installation wizard will lead you through downloading and installing your certificates.

Important: To complete this process, you must use the same computer you used to enroll for your ECA Certificate. Do not close your browser until both your ECA Identity and Encryption Certificates are installed.

Follow the link below, or the link you receive in your email, to retrieve your certificate:

https://eca.verisign.com/client/mspickup.htm You will need your Personal Identification Number (PIN), which is included in the email.

Installing Your ECA Certificate

The following are links to flash videos covering tutorials on installing, exporting, and importing your ECA certificates:

Installation Tutorials

Export Tutorials

Import Tutorials

Step-by-Step – How to Retrieve and install ECA Certificates using Internet Explorer:

1. Open the approval e-mail from Verisign

2. Highlight & Copy your PIN and click the link to go to the Verisign pickup page.

3. Paste your PIN in the PIN box and click the Continue button

4. If you receive a pop-up window “Potential Scripting Violation,” Click “Yes”

5. You should now have your ECA Identity Certificate information displayed. Click Continue.

6. In the “Choose a digital certificate’ pop-up window, select your new ECA certificate and click OK.

7. In the “Signing data with your private exchange key” pop-up window, Click the OK button.

8. Please wait…

9. Another message appears – “Do not close this page until you have installed your encryption certificate successfully” Click OK

10. Your Private Key password will now be displayed. Print and save this information so you have a record of your key.

11. Highlight & Copy the password. Then click Download Certificate:

12. Click on the Open button in the File Download pop-up window.

13. The Certificate Import Wizard will launch… Click Next

14. Click Next again (The file field should be pre-populated)

15. Paste your password into the password field AND click the 2nd box – “Mark this key as exportable” and Click Next

16. On the Certificate Store page, use the automatically select the store option and click Next.

17. Click Finish on the completing the certificate import wizard.

Step-by-Step – How to Test Your ECA Certificate

1. Launch your browser and go to the following URL: https://services.onr.navy.mil

2. From the “Choose a digital certificate” pop-up window, Select your ECA Certificate and Click OK

3. Windows Vista and Windows 7 users may receive a grant or deny permission request – Click Grant permission and Click OK.

4. You should have the following pop-up window appear:

5. Click OK

6. If the following website does appear, your certificate is installed correctly.

How to Export Your Certificate for use with the SITEC Portal.

1. Launch Internet Explorer

2. From the Tools menu, Select Internet Options

3. Click on the Content Tab

4. Click on the Certificates button

5. Select your ECA Encryption Certificate and Click the Export button.

6. The Certificate Export Wizard will launch. Click Next.

7. Click Next again (No, do not export the private key)

8. Click Next again (leave the default DER selection)

9. Click Browse to save the file in a location you will remember!

10. Save the file using your name as the file name (i.e, first.last.cer) and Click Next.

11. Click Finish to complete the Certificate Export wizard.

12. You should receive a pop-up window declaring the export was successful.

13. When complete, e-mail your *.cer file to contracting@socom.mil. Be sure to provide your company cage code and type “SITEC Bidders Library Access Request” in the title. You may need to rename the file extension from .cer to .txt to bypass your local e-mail security.

14. Once your credentials have been updated and access has been granted, you will receive an e-mail with instructions for accessing USSOCOM’s SITEC Bidder’s Library.

image2.png image3.png image4.png image5.png image6.png image7.png image8.png image9.png image10.png image11.png image12.gif image13.png image14.png image15.png image16.png image17.png image18.png