> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/remote-key-storage/certificate-enrolment.md).

# Certificate Enrolment

Enrolment creates the subscriber's long-term key pair and certificate in the eMudhra HSM. It is a one-time step per certificate.

## Prerequisites

* An active eMudhra eKYC account (offline Aadhaar, PAN, bank or organisational KYC).
* Access to the registered mobile for OTP.

## Enrolment flow

| # | Step                                                                                                                                                      |
| - | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 | The ASP redirects the subscriber to the eMudhra enrolment page (`txnreq` form POST).                                                                      |
| 2 | The subscriber completes two-factor eKYC authentication (PIN + OTP, with nonce).                                                                          |
| 3 | The KMS, via CHI, initiates enrolment and obtains the authenticated SAM public key.                                                                       |
| 4 | The subscriber sets a new **Certificate AuthPIN** (6 characters) in a single secure session. KMS encrypts it to the SAM key, bound to the transaction ID. |
| 5 | SAM stores non-recoverable AuthPIN verification material linked to the eKYC ID.                                                                           |
| 6 | CHI generates the key pair (default ECC P-256 / SHA-256) and CSR inside the HSM.                                                                          |
| 7 | KMS sends the CSR and eKYC data to the eMudhra CA, which issues the certificate (default 2-year validity).                                                |
| 8 | The subscriber reviews and accepts the certificate; enrolment is completed.                                                                               |
| 9 | eMudhra POSTs `txnresp` back to the ASP redirect URL.                                                                                                     |

## Enrolment API

**Request** — browser form POST to the eMudhra enrolment URL

| Parameter       | Value                                                 |
| --------------- | ----------------------------------------------------- |
| Content type    | `application/x-www-form-urlencoded`                   |
| `txnreq`        | Base64(`transactionId` + \`                           |
| `transactionId` | Alphanumeric, ≤ 50 characters, unique per ASP per day |

**Response** — form POST to the ASP redirection URL

| Parameter | Value                                         |
| --------- | --------------------------------------------- |
| `txnresp` | Base64(`transactionId` + \`                   |
| `status`  | `1` success, `0` failure                      |
| `data`    | Username on success; error message on failure |

## Lifecycle rules

* **Renewal, re-key and suspension are not permitted.** Enrol a new certificate when the current one expires.
* On **revocation**, the private key is deleted from the HSM no later than 15 minutes after revocation.
* A subscriber may hold more than one certificate (for example personal and organisational); each has its own AuthPIN.