> For the complete documentation index, see [llms.txt](https://docs.pagopa.it/centrostella-1/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.pagopa.it/centrostella-1/centro-stella/instructions-for-agenzia-delle-entrate-mandate/how-to-join/02.-integrate-pagopa-environments/request-the-mutual-authentication-certificates.md).

# Request the mutual authentication certificates

## Batch Service Authentication

The communication between Batch Service and PagoPA endpoints uses TLS 1.2 with mutual authentication. The client certificate for acquirers will be issued by PagoPA using its own private certification authority, please follow the next steps in order to get your certificates (one for UAT environment, one for PROD environment).

### Personalize the configuration template

Use the PagoPA configuration template to generate both UAT and PROD Certificate Signing Request. Run the following command to download it:

```
wget https://raw.githubusercontent.com/pagopa/cstar-cli/main/integration_check/certificate_configuration_template.cnf
```

After the download you **must** **edit** the configuration template according to actual Sender information.

Below the section that **must** be customized:

```
[ dn ]
countryName         = IT
stateOrProvinceName = Yourcity
localityName        = Yourcity
organizationName    = COMPANY_NAME S.p.A.
commonName          = Certificato client Batch Service - COMPANY_NAME S.p.A.
emailAddress        = youremail@COMPANY_NAME.it
```

{% hint style="info" %}
To obtain a **compliant csr file** please don't remove any field of the configuration template.

For PROD environment *`emailAddress`* ***must*** match the one specified in the agreement with PagoPA.
{% endhint %}

{% hint style="danger" %}
If you have not yet signed the agreement please **do not** proceed with the request in **PROD** environment!
{% endhint %}

### Generate a certificate request file

Use the following command to generate the csr file and the related private key (please remember to customize `COMPANY_NAME`):

#### UAT Environment

```
openssl req -new -config certificate_configuration_template.cnf -keyout COMPANY_NAME_UAT.key -out COMPANY_NAME_UAT.csr
```

#### PROD Environment

```
openssl req -new -config certificate_configuration_template.cnf -keyout COMPANY_NAME_PROD.key -out COMPANY_NAME_PROD.csr
```

{% hint style="warning" %}
Once the csr file is created, send it  by email to **<cstar@assistenza.pagopa.it>** with the following subject:

> certificate `COMPANY_NAME`
> {% endhint %}