Here is the procedure to generate the certificates used for mutual TLS between your organization and Qombo.
<aside> ⚠️
If you use the mTLS, please note that the right URIs are:
Staging: api<u>-mtls</u>.staging.qombo.tech
Production: api<u>-mtls</u>.qombo.tech
</aside>
[ ] Qombo send a CSR.
[ ] Your organization send back a client certificate signed by your private CA.
This certificate will be used to perform calls to your /account-holder endpoint.
Schema - which certificates are needed?
<aside> ℹ️
Verify a bank account you own (with the API or the platform).
→ You should get a response and your account-holder endpoint should have been called.
</aside>
<aside> ⚠️
Qombo checks the serial of the certificate on each call: only the certificates registered for your organisation are accepted. During a renewal, your current certificate and the new one are both accepted, so you can switch over at your own pace.
</aside>
Renewal. Before your certificate expires, send Qombo a new CSR; Qombo sends back a new certificate signed by its private CA. Install it on your side: both certificates are accepted during the changeover. Once you have used only the new certificate for 7 days, Qombo stops sending reminders about the old one. Qombo reminds your technical contacts from 45 days before expiry.
<aside> ℹ️
Send a call to /verify with the API to any bank account (do not use the manual form on the platform as the mTLS is bypassed here.)
→ You should get a response.
</aside>